Patent Description:
For control of various facilities and control of various devices installed in various facilities, a controller system such as PLC (Programmable Logic Controller) is used. A control device is capable of monitoring abnormalities that occur to facilities and/or machines to be controlled, and also capable of monitoring abnormalities of the control device itself. When a certain abnormality is detected, the control device gives a notification outward in a certain way.

For example, <CIT> (PTL <NUM>) discloses a programmable controller that transmits an electronic mail to an address designated in advance, when an abnormality history is registered or when a predetermined time is reached.

With the recent advances of ICT (Information and Communication Technology), a control device is connected to a wider variety of external devices over a network and more sophisticated processing is performed by the control device. While networks for FA (Factory Automation) sites have various names such as industrial network, FA network, and field network, the term "network" or "FA network" is used in the following.

As a control system is networked or made intelligent, kinds of expected threats are increasing. Meanwhile, on FA sites, a variety of communications are done depending on production devices.

Generally, communication on the network is monitored to detect occurrence of a security incident. On the FA network over which a wide variety of communications are performed, however, occurrence of a security incident cannot easily be specified by communication monitoring only.

An object of the present invention is therefore to facilitate monitoring of the condition of communication over the FA network.

In a first aspect, the present invention provides a communication monitoring system according to claim <NUM>.

In accordance with the foregoing, monitoring of the condition of communication over the FA network can be facilitated. Statistics of communication data are irrelevant to production data. Because of this, it is difficult to detect occurrence of a security incident by merely monitoring the communication data. However, the communication data can be associated with the production data in such a manner that the communication data is synchronized with the production data, to thereby enable a change of the condition of communication and a change of the condition of production to be confirmed simultaneously. For example, when one factor of a certain abnormality occurring to a production line is an attack through the FA network, the production data and the communication data could be changed simultaneously. In such a case, it is possible to detect occurrence of the incident to the network.

Preferably, the production data is a production score representing abnormality occurring to a production line.

In accordance with the foregoing, it is possible to identify an incident of the network, from a change of the production score. A rise of the production score represents the fact that a certain abnormality is occurring to a production line. When the rise of the production score occurs at the same time as a large change of the communication data, a possibility of occurrence of an incident to the network can be detected.

Preferably, the production score is a score calculated for each of frames that represents a unit time of the production by the production device.

In accordance with the foregoing, a change of the communication data can be monitored for each unit time of production. Accordingly, the relation between the condition of communication and the condition of production can further be clarified.

Preferably, the communication data includes a volume of communication over the network and a communication log, and the data analysis unit is configured to hold communication logs generated in a predetermined number of the respective frames including a frame in which the production score has an abnormal value, and discard communication logs generated in frames other than the predetermined number of the respective frames.

In accordance with the foregoing, increase of the volume of log data can be restrained.

In a second aspect, the present invention provides a communication monitoring method according to claim <NUM>.

In accordance with the foregoing, monitoring of the condition of communication over the FA network can be facilitated.

In accordance with the present invention, monitoring of the condition of communication over the FA network can be facilitated.

Embodiments of the present invention are described in detail with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference characters, and a description thereof is not herein repeated.

Initially, a description is given of a control device <NUM> that communicates with a target to be monitored, in a monitoring system according to the present embodiment.

<FIG> is an external view showing an example configuration of control device <NUM> according to the present embodiment. Referring to <FIG>, control device <NUM> includes a control unit <NUM>, a communication unit <NUM>, a safety unit <NUM>, one or more functional units <NUM>, and a power supply unit <NUM>.

Control unit <NUM> is connected with communication unit <NUM> through any data transmission line (such as PCI Express® or Ethernet®, for example). Control unit <NUM> is connected with safety unit <NUM> and one or more functional units <NUM> through an internal bus (not shown).

Control unit <NUM> performs central processing in control device <NUM>. In accordance with required specifications that are designed arbitrarily, control unit <NUM> performs a control operation for controlling a target to be controlled. Relative to a control operation to be performed by safety unit <NUM> described later herein, the control operation performed by control unit <NUM> is also referred to herein as "standard control. " In the example configuration shown in <FIG>, control unit <NUM> includes one or more communication ports.

Communication unit <NUM> is connected to control unit <NUM> and responsible for a security function for control device <NUM>. In the example configuration shown in <FIG>, communication unit <NUM> includes one or more communication ports. Details of the security function provided by communication unit <NUM> are described later herein.

Safety unit <NUM> performs, independently of control unit <NUM>, a control operation for implementing a safety function for a target to be controlled. The control operation performed by safety unit <NUM> is also referred to herein as "safety control. " Usually, "safety control" is designed to satisfy requirements for implementing the safety function defined in IEC <NUM> or the like. "Safety control" is a general term for processes for preventing threats to human safety from facilities, machines or the like.

Functional unit <NUM> provides various functions for implementing control for a target to be controlled by control device <NUM>. Typically, functional unit <NUM> may include an I/O unit, a safety I/O unit, a communication unit, a motion controller unit, a temperature adjustment unit, and a pulse counter unit, for example. Examples of the I/O unit include a digital input (DI) unit, a digital output (DO) unit, an analog output (Al) unit, an analog output (AO) unit, a pulse catch input unit, and a composite unit made up of a plurality of different kinds of I/O units, for example. The safety I/O unit is responsible for an I/O process for safety control.

Power supply unit <NUM> provides electric power of a predetermined voltage to each of the units constituting control device <NUM>.

Next, a description is given of an example hardware configuration of each of the units constituting control device <NUM> according to the present embodiment.

<FIG> is a schematic diagram showing an example hardware configuration of control unit <NUM> that is a part of control device <NUM> according to the present embodiment. Referring to <FIG>, control unit <NUM> includes, as principal components, a processor <NUM> such as CPU (Central Processing Unit) and GPU (Graphical Processing Unit), a chipset <NUM>, a primary memory <NUM>, a secondary memory <NUM>, a communication controller <NUM>, a USB (Universal Serial Bus) controller <NUM>, a memory card interface <NUM>, network controllers <NUM>, <NUM>, <NUM>, an internal bus controller <NUM>, and an indicator <NUM>.

Processor <NUM> reads various programs stored in secondary memory <NUM> and deploys and executes the programs in primary memory <NUM> to implement a control operation for the standard control as well as various processes as described later herein. Chipset <NUM> acts as an intermediate agent for data exchange between processor <NUM> and each component to implement a process to be performed by control unit <NUM> as a whole.

In addition to a system program, a control program running in an execution environment provided by the system program is stored in secondary memory <NUM>.

Communication controller <NUM> is responsible for data exchange with communication unit <NUM>. As communication controller <NUM>, a communication chip adapted to the PCI Express or Ethernet, for example, may be employed.

USB controller <NUM> is responsible for data exchange with any information processor via USB connection.

Memory card interface <NUM> is configured to allow a memory card <NUM> to be attached to and detached from memory card interface <NUM>, and enable data of a control program and/or various settings to be written to memory card <NUM>, or enable data of a control program and/or various settings to be read from memory card <NUM>.

Each of network controllers <NUM>, <NUM>, <NUM> is responsible for data exchange with any device through a network. For network controllers <NUM>, <NUM>, <NUM>, an industrial network protocol such as EtherCAT®, EtherNet/IP®, DeviceNet®, CompoNet® may be employed.

Internal bus controller <NUM> is responsible for data exchange with safety unit <NUM> and one or more functional units <NUM> that are a part of control device <NUM>. For the internal bus, a communication protocol unique to a manufacturer may be used, or a communication protocol identical to or pursuant to any industrial network protocol may be used.

Indicator <NUM> gives a notification of an operational state for example of control unit <NUM>, and is made up of one or more LEDs arranged on the unit surface.

While <FIG> shows an example configuration where processor <NUM> executes a program to provide necessary functions, a part or all of these provided functions may be implemented by means of a dedicated hardware circuit (such as ASIC (Application Specific Integrated Circuit) or FPGA (Field-Programmable Gate Array), for example). Alternatively, a principal part of control unit <NUM> may be implemented by means of hardware (industrial personal computer based on a general-purpose personal computer, for example) conforming to a general-purpose architecture. In this case, virtualization technology may be used to cause a plurality of OSs (Operating Systems) for different uses to be executed in parallel and cause a necessary application to be executed on each OS.

<FIG> is a schematic diagram showing an example hardware configuration of communication unit <NUM> that is a part of control device <NUM> according to the present embodiment. Referring to <FIG>, communication unit <NUM> includes, as principal components, a processor <NUM> such as CPU and GPU, a chipset <NUM>, a primary memory <NUM>, a secondary memory <NUM>, a communication controller <NUM>, a USB controller <NUM>, a memory card interface <NUM>, network controllers <NUM>, <NUM>, and an indicator <NUM>.

Processor <NUM> reads various programs stored in secondary memory <NUM> and deploys and executes the programs in primary memory <NUM> to implement various security functions as described later herein. Chipset <NUM> acts as an intermediate agent for data exchange between processor <NUM> and each component to implement a process to be performed by communication unit <NUM> as a whole.

In addition to a system program, a security system program running in an execution environment provided by the system program is stored in secondary memory <NUM>.

Communication controller <NUM> is responsible for data exchange with control unit <NUM>. As communication controller <NUM>, a communication chip adapted to the PCI Express or Ethernet, for example, may be employed, like communication controller <NUM> of control unit <NUM>.

USB controller <NUM> is responsible for data exchange with any information processor through USB connection.

Each of network controllers <NUM>, <NUM> is responsible for data exchange with any device through a network. For network controllers <NUM>, <NUM>, a general-purpose network protocol such as Ethernet® may be employed.

Indicator <NUM> gives a notification of an operational state for example of communication unit <NUM>, and is made up of one or more LEDs arranged on the unit surface.

While <FIG> shows an example configuration where processor <NUM> executes a program to provide necessary functions, a part or all of these provided functions may be implemented by means of a dedicated hardware circuit (such as ASIC or FPGA, for example). Alternatively, a principal part of communication unit <NUM> may be implemented by means of hardware (an industrial personal computer based on a general-purpose personal computer, for example) conforming to a general-purpose architecture. In this case, virtualization technology may be used to cause a plurality of OSs for different uses to be executed in parallel and cause a necessary application to be executed on each OS.

<FIG> is a schematic diagram showing an example hardware configuration of safety unit <NUM> that is a part of control device <NUM> according to the present embodiment. Referring to <FIG>, safety unit <NUM> includes, as principal components, a processor <NUM> such as CPU and GPU, a chipset <NUM>, a primary memory <NUM>, a secondary memory <NUM>, a memory card interface <NUM>, an internal bus controller <NUM>, and an indicator <NUM>.

Processor <NUM> reads various programs stored in secondary memory <NUM> and deploys and executes the programs in primary memory <NUM> to implement a control operation for the safety control as well as various processes as described later herein. Chipset <NUM> acts as an intermediate agent for data exchange between processor <NUM> and each component to implement a process to be performed by safety unit <NUM> as a whole.

In addition to a system program, a safety program running in an execution environment provided by the system program is stored in secondary memory <NUM>.

Memory card interface <NUM> is configured to allow a memory card <NUM> to be attached to and detached from memory card interface <NUM>, and enable data of a safety program and/or various settings to be written to memory card <NUM>, or enable data of a safety program and/or various settings to be read from memory card <NUM>.

Internal bus controller <NUM> is responsible for data exchange with control unit <NUM> through the internal bus.

Indicator <NUM> gives a notification of an operational state for example of safety unit <NUM>, and is made up of one or more LEDs arranged on the unit surface.

While <FIG> shows an example configuration where processor <NUM> executes a program to provide necessary functions, a part or all of these provided functions may be implemented by means of a dedicated hardware circuit (such as ASIC or FPGA, for example). Alternatively, a principal part of safety unit <NUM> may be implemented by means of hardware (an industrial personal computer based on a general-purpose personal computer, for example) conforming to a general-purpose architecture. In this case, virtualization technology may be used to cause a plurality of OSs for different uses to be executed in parallel and cause a necessary application to be executed on each OS.

Next, a typical example of a control system <NUM> including control device <NUM> according to the present embodiment is described. In the following, database is denoted by "DB. " <FIG> is a schematic diagram showing a typical example of control system <NUM> including control device <NUM> according to the present embodiment.

By way of example, control system <NUM> shown in <FIG> is configured to control two lines (Line A and Line B). Typically, each line is equipped with a conveyor for transporting workpieces, as well as a robot capable of giving any physical action on a workpiece on the conveyor.

For each of Line A and Line B, control unit <NUM> is placed. In addition to control unit <NUM> responsible for Line A, communication unit <NUM> and safety unit <NUM> constitute control device <NUM>. For convenience of description, <FIG> does not show functional unit <NUM> and power supply unit <NUM>.

Communication unit <NUM> of control device <NUM> is connected to a first network <NUM> through a communication port <NUM> (network controller <NUM> in <FIG>). It is supposed that a support device <NUM> and a SCADA (Supervisory Control And Data Acquisition) device <NUM> are connected to first network <NUM>.

Support device <NUM> can access at least control unit <NUM>, and provides, to users, functions such as creation of a program to be executed by each unit included in control device <NUM>, debugging, and setting of various parameters. Support device <NUM> also collects information from communication unit <NUM> and monitors the communication load on the FA network based on the collected information. Thus, support device <NUM> has a function specific to a monitoring device.

SCADA device <NUM> presents, to an operator, various types of information obtained from a control operation by control device <NUM>, and generates an internal command for example to control device <NUM>, in accordance with manipulation of the operator. SCADA device <NUM> also has the function of collecting data used by control device <NUM>.

Control unit <NUM> of control device <NUM> is connected to a second network <NUM> through a communication port <NUM> (network controller <NUM> in <FIG>). It is supposed that an HMI (Human Machine Interface) <NUM> and a database <NUM> are connected to second network <NUM>.

HMI <NUM> presents, to an operator, various types of information obtained from a control operation by control device <NUM>, and generates an internal command or the like to control device <NUM>, in accordance with manipulation of the operator. Database <NUM> collects various types of data (information about the traceability measured from each workpiece, for example) transmitted from control device <NUM>.

Control unit <NUM> of control device <NUM> is connected to one or more field devices <NUM> through a communication port <NUM> (network controller <NUM> in <FIG>) and the FA network. Field device <NUM> includes a sensor and/or a detector that collects, from a target to be controlled, various types of information necessary for a control operation, and an actuator providing a certain action on the target to be controlled. In the example shown in <FIG>, field device <NUM> includes a robot providing an external action on a workpiece, a conveyer to transport workpieces, and an I/O unit to exchange signals with a sensor and/or an actuator disposed in the field.

Similarly, control unit <NUM> responsible for Line B is also connected to one or more field devices <NUM> through communication port <NUM> (network controller <NUM> in <FIG>) and the FA network.

Regarding a functional aspect of control device <NUM>, control unit <NUM> includes a control engine <NUM> that is a process execution unit executing a control operation for the standard control, and an information engine <NUM> exchanging data with an external device. Communication unit <NUM> includes a communication engine <NUM> for implementing a communication monitoring function as described later herein. Safety unit <NUM> includes a safety engine <NUM> that is a process execution unit executing a control operation for safety control.

Each engine is implemented by any hardware element such as processor for each unit or any software element such as various programs, or a combination of these elements. Each engine can be implemented in any form.

Further, control device <NUM> includes a broker <NUM> acting as an intermediate agent for exchange between engines. The physical body of broker <NUM> may be disposed in one or both of control unit <NUM> and communication unit <NUM>.

Control engine <NUM> holds a variable table that is necessary for execution of a control operation for controlling a target, and holds a function block (FB), for example. Each variable stored in the variable table is collected periodically to have a value obtained from field device <NUM> through an I/O refresh process, and each value is reflected periodically on field device <NUM>. A log of the control operation by control engine <NUM> may be stored in a log database <NUM>.

Information engine <NUM> performs any information processing on data held by control unit <NUM> (values of variables held in the variable table). Typically, information engine <NUM> performs a process of periodically transmitting, to database <NUM> for example, data held by control unit <NUM>. For such data transmission, SQL or the like is used.

Communication engine <NUM> monitors target communication data and stores communication log data in the log database.

Communication engine <NUM> gives a notification, through indicator <NUM>, of the fact that a certain event regarding security has occurred, or a level of an event regarding security that is occurring, for example.

Safety engine <NUM> corresponds to detection means that detects whether or not certain unauthorized access has occurred to control device <NUM>. Safety engine <NUM> obtains and reflects, through control unit <NUM>, safety I/O variables that are necessary for execution of a control operation for safety control. A log of safety control by safety engine <NUM> may be stored in a log database <NUM>.

When communication engine <NUM> detects a certain event, for example, broker <NUM> causes change of operation for example of control engine <NUM>, information engine <NUM>, and safety engine <NUM>.

Control device <NUM> according to the present embodiment is capable of detecting any security threat that hinders normal operation of facilities and/or machines, and carrying out necessary countermeasures.

"Security threat" herein refers to any event that hinders normal operation of facilities and/or machines. "Normal operation" herein refers to a condition where facilities and/or machines can continue running as per a system design and a production plan. It should be noted that auxiliary processes such as activation of facilities and/or machines, maintenance thereof, and changeover for allowing facilities and/or machines to keep running as per a system design and a production plan are also included in the concept of "normal operation.

All physical ports mounted on the control device are under security risk of being attacked. For example, control device <NUM> having a PLC as a principal component may be a target of DoS attack (Denial of Service attack) or DDoS attack (Distributed Denial of Service attack). Even during normal operation, access congestion on control device <NUM> may occur. Therefore, based on network settings, DoS attack or DDoS attack can be detected. When a specific port is externally attacked, control unit <NUM> blocks the port from receiving information. Meanwhile, communication through other ports is not blocked. Accordingly, control system <NUM> itself can keep running while control by control device <NUM> is restricted.

When a security incident occurs to the control system, influences of the incident are reflected on production data. For example, when lines cannot be synchronized with each other due to DoS attack or DDoS attack, for example, production may be halted. Besides, a part of required production data may not be acquired or acquisition of the data may be delayed due to attacks. In such a case, the production quality may be deteriorated.

Usually, production data is collected separately from communication data. Further, over the FA network, a wide variety of communications are conducted appropriately for field device <NUM> (production device). Therefore, an incident is difficult to identify by monitoring of communication data only. Analysis of logs for detecting an incident requires a large amount of logs to be stored. As a result, the volume of logs is increased. The high volume logs may be a factor that consumes the server capacity.

A description is given of an example of a user interface for monitoring the FA network in control system <NUM> described above. In the present embodiment, support device <NUM> shown in <FIG> functions as a setting device for a monitoring system that monitors communication regarding the FA network.

<FIG> is a schematic diagram showing an example hardware configuration of support device <NUM> connected to control device <NUM> according to the present embodiment. Support device <NUM> is implemented by means of hardware (general-purpose personal computer, for example) conforming to a general-purpose architecture, by way of example.

Referring to <FIG>, support device <NUM> includes a processor <NUM>, a main memory <NUM>, an input unit <NUM>, an output unit <NUM>, a storage <NUM>, an optical drive <NUM>, and a USB controller <NUM>. These components are connected to each other through a processor bus <NUM>.

Processor <NUM> is configured as a CPU and/or a GPU for example, reads programs (e.g., OS <NUM> and support program <NUM>) stored in storage <NUM>, and deploys and executes the programs in main memory <NUM> to implement settings for control device <NUM>.

Main memory <NUM> is configured as a volatile memory such as DRAM or SRAM. Storage <NUM> is configured as a non-volatile memory such as HDD or SSD, for example.

Storage <NUM> stores, in addition to OS <NUM> for implementing basic functions, support program <NUM> for providing functions specific to support device <NUM> and a network monitoring program <NUM> providing functions specific to the setting device for the monitoring system. Specifically, network monitoring program <NUM> is executed by processor <NUM> to allow support device <NUM> to implement the setting device for the monitoring system according to the present embodiment.

Input unit <NUM> is configured as a keyboard and/or a mouse to receive user's operation. Output unit <NUM> is configured as a display, various indicators, and/or a printer, for example, to output results of processing from processor <NUM>.

USB controller <NUM> exchanges data with control device <NUM> for example through USB connection.

Support device <NUM> has optical drive <NUM>, and a program stored in a recording medium <NUM> (optical recording medium such as DVD (Digital Versatile Disc) for example) that stores a computer-readable program in a non-transitory manner is read and installed in storage <NUM> for example.

While support program <NUM> and network monitoring program <NUM> for example executed by support device <NUM> may be installed through computer-readable recording medium <NUM>, the programs may also be downloaded from a server on the network and then installed. The functions provided by support device <NUM> according to the present embodiment may also be implemented by means of a part of modules provided by the OS.

While <FIG> shows an example configuration where processor <NUM> executes programs to provide necessary functions specific to support device <NUM>, a part or all of these provided functions may be implemented by means of a dedicated hardware circuit (such as ASIC or FPGA, for example).

<FIG> shows a schematic configuration of a monitoring system according to the present embodiment. As shown in <FIG>, the monitoring system includes a tool 602A (monitoring setting tool), communication unit <NUM>, and control unit <NUM>. Processor <NUM> executes network monitoring program <NUM> to implement tool 602A in support device <NUM> (see <FIG>).

Tool 602A includes a setting tool <NUM> and a visualization application <NUM>. Setting tool <NUM> is a collected-data setting unit that makes settings for data collected by communication unit <NUM> and control unit <NUM> (PLC). Visualization application <NUM> is a display setting unit that makes settings for a display process in communication unit <NUM>.

Communication unit <NUM> includes communication engine <NUM> and a communication application <NUM>. Communication engine <NUM> includes a data collection module <NUM>. Data collection module <NUM> collects time-series communication data of a target to be monitored.

Communication application <NUM> is implemented in communication unit <NUM>. Communication application <NUM> includes an analysis and search module <NUM>, a data management module <NUM>, and a display module <NUM>. Data management module <NUM> collects time-series communication data from communication engine <NUM>, and also collects time-series production data from control unit <NUM>. Analysis and search module <NUM> associates the time-series production data with the time-series communication data. Display module <NUM> shows the time-series production data and the time-series communication data in accordance with settings of visualization application <NUM>. For example, the time-series production data and the time-series communication data are shown on a display (not shown) of support device <NUM>.

Control unit <NUM> includes a user program <NUM>, a production data generation module <NUM>, and a data collection module <NUM>. User program <NUM> is a control program produced by a user, and provided from support device <NUM> to control unit <NUM>. Control unit <NUM> executes the control program so that operation of control unit <NUM> and control system <NUM> is controlled. Production data generation module <NUM> generates production data representing an operating condition (production condition) of control system <NUM>. In one embodiment, the production data may be at least one of AI score, raw data, and feature value. Data collection module <NUM> collects production data from production data generation module <NUM>.

Monitoring setting tool 602A (support device <NUM>), communication unit <NUM>, and control unit <NUM> constitute a monitoring system configured to monitor communication regarding a network. Production data generation module <NUM> constitutes a production data generation unit configured to generate production data representing a condition of production by a production device. Data collection module <NUM>, data collection module <NUM>, and data management module <NUM> constitute a data collection unit configured to collect communication data representing a condition of communication on an FA network, and collect the production data. Analysis and search module <NUM> constitutes a data analysis unit configured to associate the communication data with the production data that are collected by the data collection unit, in such a manner that the communication data is synchronized with the production data. Display module <NUM> is configured to perform a process for displaying the communication data and the production data associated with each other.

<FIG> is a schematic diagram showing an example time series of the volume of communication. As shown in <FIG>, the volume of communication data (volume of communication) varies with time. It is seen from the graph shown in <FIG> that large data flows over the network at some instants of time. However, it is not easy to specify, from this graph, which data relates to production.

<FIG> is a schematic diagram showing an example of time-series production data. In <FIG>, "FRAME" represents a unit of production (Takt for example). When one frame completes, a result of an operation is output from control unit <NUM>. In <FIG>, "SERIES DATA A" corresponds to the results of the operation by control unit <NUM>.

In the example shown in <FIG>, one frame is made up of three statuses. "STATUS" represents a state of control unit <NUM> corresponding to a production step. For example, production data generation module <NUM> extracts, as a feature value, a portion (subframe) corresponding to the second status, from the series data. Based on the extracted feature value, production data generation module <NUM> calculates the production score (AI score).

<FIG> schematically shows an example display of time-series communication data and time-series production data. For example, the display screen shown in <FIG> may be a screen of support device <NUM>. In one example display, the display screen shows a communication data graph <NUM> and a production data graph <NUM>. In addition, the display screen may show a communication data size graph <NUM> that is a circle graph showing the ratio of a data size to the total volume of communication data, as well as a communication node <NUM>.

Communication data graph <NUM> indicates change of the communication data size with time. Production data graph <NUM> indicates change of production data frame by frame. Specifically, the production data is a production score (outlier). When the score has a large value, this value is treated as an abnormality score representing abnormality of production.

In this embodiment, analysis and search module <NUM> associates the production data with the communication data in such a manner that the production data is synchronized with the communication data. Display module <NUM> shows the production data and the communication data. As a result, communication data graph <NUM> and production data graph <NUM> are arranged in the top-to-bottom direction on the display screen. As shown in <FIG>, the time on the horizontal axis of communication data graph <NUM> is synchronized with the time on the horizontal axis of production data graph <NUM>.

Usually, statistics of communication data are prepared based on features of communication itself over the FA network. Such statistics are, for example, statistics of the cumulative volume of communication (data amount or the like) from the start of operation of the device, statistics for the band for a second, and statistics of the extent of display. Such statistics, however, are irrelevant to the production data, and therefore, a communication parameter that relates to the unit of production cannot be specified. It is therefore necessary for a user to hold and confirm all data (log data for example), for the sake of management of security.

In accordance with the present embodiment, it is possible to extract (characterize) features from the communication data, frame by frame. Accordingly, the relation between the production data and the communication data can further be clarified. Characterization of the communication data, for example, can be done based on at least one of the following communication parameters.

Further, in the present embodiment, the production data is changed frame by frame. Therefore, change of the communication data is also visualized frame by frame. The communication data is characterized for each unit of production (frame by frame), to thereby facilitate detection of a condition different from the normal condition of the control system (detection of a condition where an incident occurs, for example).

In the present embodiment, change of the communication data associated with production steps can be visualized, and therefore, the relation between the condition of communication and the condition of production can be made more clear. Communication data (volume of communication) when the production score becomes an abnormality score can be specified, and therefore, it is possible, when abnormality relevant to an incident occurs to production, to specify communication data associated with the production data and analyze the data. Accordingly, monitoring of the condition of communication over the FA network can be facilitated.

In the example in <FIG>, sharp increase of the production score and the communication data is identified in a frame 643A. A user can thus confirm that the production score and the communication data have changed simultaneously. In such a case, there is a possibility that a certain incident concerning security of the FA network has occurred. The user can detect the possibility of occurrence of the incident.

Further, in accordance with the present embodiment, increase of the volume of log data can be suppressed. When there is no relation between the communication data and the production data, whether or not an incident has occurred has to be detected from only the condition of communication. It is therefore necessary to leave log data regarding communication as much as possible.

If, however, all the log data is stored in a server or the like, the capacity of the server is reduced by the log data. Further, because a user verifies the data based on only the communication parameters, a large volume of log data has to be analyzed, which increases the burden on the user.

In contrast, in accordance with the present embodiment, production data (production score) is monitored together with the communication data. Therefore, even when only the communication log data of a frame in which the production score has an abnormal value, as well as the communication log data of a few frames preceding the frame in time and a few frames following the frame in time are held, information about the condition of communication when abnormality of production occurs can be collected. As a result, increase of the volume of logs can be restrained and the burden, on the user, of analysis of logs can also be reduced.

<FIG> shows communication data graph <NUM> and production data graph <NUM> extracted from the display screen shown in <FIG>. As shown in <FIG>, frame 643A is a frame in which the production score has an abnormal value. In the example shown in <FIG>, communication log data of six frames is held. The six frames include frame 643A, two frames preceding frame 643A, and three frames following frame 643A.

The above number of frames is not limited to six. Further, the number of extracted frames may be fixed in advance or may be set by a user.

Further, in accordance with the present embodiment, a communication log associated with the production score having an abnormal value can be specified. Therefore, communication logs other than the above communication log may be discarded. For example, the other communication logs may be discarded after elapse of a certain time. Alternatively, the other communication logs may be discarded when the cumulative volume of communication logs reaches a set value.

Thus, in accordance with the present embodiment, production data can be associated with communication data to facilitate monitoring of communication over the FA network. Therefore, it is possible to cause a user to detect occurrence of an incident of communication accompanied by abnormality of production, without requiring the user to have sophisticated expert knowledge.

It should be construed that the embodiments disclosed herein are given by way of illustration in all respects, not by way of limitation. It is intended that the scope of the present invention is defined by claims, not by the description above,.

Claim 1:
A communication monitoring system configured to monitor communication regarding a network to which a production device (<NUM>) is connected, the communication monitoring system comprising:
a production data generation unit (<NUM>) configured to generate production data representing a condition of production by the production device (<NUM>);
a data collection unit (<NUM>, <NUM>, <NUM>) configured to collect communication data representing a condition of communication on the network, and collect the production data;
a data analysis unit (<NUM>) configured to associate the communication data with the production data that are collected by the data collection unit (<NUM>, <NUM>, <NUM>), in such a manner that the communication data is synchronized with the production data; and
a data display unit (<NUM>) configured to perform a process for displaying the communication data and the production data that are associated with each other, the data display unit (<NUM>) configured to display a communication data graph (<NUM>) and a production data graph (<NUM>) such that a time indicated on a horizontal axis of the communication data graph (<NUM>) is synchronized with a time indicated on a horizontal axis of the production data graph (<NUM>).