Procedure for the analysis of malfunctions and/or changes of the state of devices in a system (A) used in automation engineering, wherein said system (A) has multiple field devices (FA, FB, FC, FD), wherein said field devices (FA, FB, FC, FD) have a communication connection with one another via a communication network (D, F), either directly or via at least a communication unit (PLC), particularly a gateway, a control unit or a remote I/O, and wherein said devices are designed to generate an appropriate diagnostic message (Diag1, Diag2, Diag3) depending on a malfunction and/or changes of state of the field devices (FA, FB, FC, FD) located in the system (A), and wherein the diagnostic messages (Diag1, Diag2, Diag3) are transmitted to a database (DB) and are saved in same, wherein said procedure comprises the following steps: - Reading the diagnostic messages (Diag1, Diag2, Diag3) out of the database; - Filtering of the diagnostic messages that are read out (Diag1, Diag2, Diag3) using at least one selection criterion; - Linking of the filtered diagnostic messages (Diag1, Diag2, Diag3) with timestamps, wherein a timestamp contains a date of occurrence of a malfunction contained in the corresponding diagnostic message (Diag1, Diag2, Diag3); - Definition of time intervals (Δt), particularly of the same size; - Grouping of the diagnostic messages (Diag1, Diag2, Diag3) linked with the timestamps into the defined time intervals (Δt) according to their timestamp; - Evaluation of the grouped diagnostic messages (Diag1, Diag2, Diag3) with regard to defined anomalies (CL1, CL2, CL3, CL4), wherein the grouped diagnostic data is evaluated using a diagram, particularly a heatmap, created from the grouped diagnostic messages (Diag1, Diag2, Diag3), characterized in that the field devices (FA, FB, FC, FD) are located on a first axis of the diagram, wherein the defined time intervals (Δt) are represented on a second axis of the diagram, wherein in the event that one of the diagnostic messages (Diag1, Diag2, Diag3) is grouped in one of the time intervals (Δt), the point of intersection between the respective time interval (Δt) and the corresponding field device (FA, FB, FC, FD) is marked, and wherein a computer unit examines the diagram for the defined anomalies, during the evaluation process, using algorithms implemented on the computer unit for detecting images or patterns and/or algorithms for cluster detection, wherein, on the basis of the evaluation, a proposal to rectify a cause of the malfunctions and/or of the changes of state of the devices is created. - Reading the diagnostic messages (Diag1, Diag2, Diag3) out of the database; - Filtering of the diagnostic messages that are read out (Diag1, Diag2, Diag3) using at least one selection criterion; - Linking of the filtered diagnostic messages (Diag1, Diag2, Diag3) with timestamps, wherein a timestamp contains a date of occurrence of a malfunction contained in the corresponding diagnostic message (Diag1, Diag2, Diag3); - Definition of time intervals (Δt), particularly of the same size; - Grouping of the diagnostic messages (Diag1, Diag2, Diag3) linked with the timestamps into the defined time intervals (Δt) according to their timestamp; - Evaluation of the grouped diagnostic messages (Diag1, Diag2, Diag3) with regard to defined anomalies (CL1, CL2, CL3, CL4), wherein the grouped diagnostic data is evaluated using a diagram, particularly a heatmap, created from the grouped diagnostic messages (Diag1, Diag2, Diag3), <EOS>