JP2014003353A - Network device, network system, and alert information processing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect and record an alert without interfering with data communication.SOLUTION: A network device connected, via a network, to a management device for collecting data comprises a plurality of communication processing processes for controlling communication according to a prescribed communication protocol, and an alert output process for outputting alert information to the management device. The plurality of communication processing processes perform first filtering in which they detect the alert in their respective communication processing processes, apply first statistical processing to the detected alert, and output alert information generated based on the result of the first statistical processing to the alert output process. The alert output process performs second filtering in which it applies second statistical processing to the alert information on the plurality of communication processing processes using the degree of congestion of the network, and outputs alert information selected based on the result of the second statistical processing to the management device.

Description

  The present invention relates to a network apparatus of a control system, and more particularly to a method for processing alert information using a network state.

  In a control system such as a power distribution control system owned by an electric power company and an operation control system owned by a railway company, a control controller is installed for each base having a device to be controlled. For example, as shown in FIG. 10, a control controller 14 is installed for each base such as a substation or a line switching point, and the subordinate equipment 12 connected via the local network 11 is locally controlled. Yes. Further, the control controllers 14 at a plurality of locations are connected to the management center 16 via a private network 15 which is a wide area network, and an application server 17 installed in the management center 16 manages the whole.

  In recent years, for the purpose of improving the efficiency of the system and reducing the cost, so-called cloud development is progressing, in which functions of control controllers distributed and installed at a plurality of bases are virtualized and aggregated in an application server of a management center. For wide area networks, there is a growing demand for using communication carrier networks that are cheaper than private networks.

"Cyber Security Systems Security Management", NERC CIP-007-5, 2011

Due to such changes in the system configuration, the following two new problems arise.
1) Since the controller for control installed at the site is replaced with a simple network interconnection device at a low cost such as a built-in device from hardware equivalent to a conventional server, the processing capability on the site side is lowered.
2) Depending on the type of communication carrier network (for example, wireless network), the communication capacity of the network is small. For this reason, when the network to be used is changed from the private network to the communication carrier network, the throughput and delay of the network become unstable.

  On the other hand, the control system is different from a general information system in that high reliability is required as in the conventional system even if the system configuration changes as described above. For example, in the field of power distribution control systems in the United States, NERC (North American Electric Reliability Corporation) has established CIP (Critical Infrastructure Protection) as a standard for ensuring reliability. In CIP, it is stipulated that an event defined as abnormal in each component of a control system can always be detected and a record of the occurrence of the event is left as a log.

  As described above, when the system configuration is changed, the controller for control is replaced with the network interconnection device, and the network is changed from the private network to the communication carrier network, the network interconnection device has various abnormal events ( It is required to detect and record all alerts.

  That is, even if the system configuration changes in this way, it becomes a new problem to ensure the high reliability required for the control system.

  Specifically, when using the network interconnection device with the low cost and low processing capability described above, all alerts generated within the device are detected and the detected alerts are output. May occur. In this case, the load of inter-process communication is increased, and there is a possibility that the original communication function is hindered.

  Further, when all alerts generated in the network interconnection device are sent to the management center via the communication carrier network, the network capacity of the network may be consumed, the original data communication may be hindered, and the communication cost will be high.

  For this reason, the present invention does not interfere with data communication originally required as a control system system, even when using a low-cost and low-performance network interconnection device or an unstable communication carrier network. It is an object of the present invention to provide a method capable of detecting and recording an alert.

  A typical example of the present invention is as follows. That is, a network device connected via a network to a management device that collects data from a communication terminal, and a plurality of communication processing processes that control communication using a predetermined communication protocol, and output alert information to the management device The plurality of communication processing processes detects an alert in each communication processing process, performs first statistical processing on the detected alert, and based on a result of the first statistical processing First filtering is performed to output the generated alert information to the alert output process, the alert output process receives alert information from the plurality of communication processing processes, and the received alert information is subjected to a second statistical process. And the alert information selected based on the result of the second statistical process is sent to the management device. The second filtering output.

  According to a typical embodiment of the present invention, high reliability required as a control system can be ensured.

1 is an overall configuration diagram of a control system according to an embodiment of the present invention. It is a functional block diagram of the network interconnection apparatus of the Example of this invention. It is explanatory drawing which shows the process starting state at the time of the software execution of the network interconnection apparatus of the Example of this invention. It is a block diagram of the network interconnection apparatus of the Example of this invention. It is a block diagram which shows the detail of the alert detection function of the Example of this invention. It is a figure explaining the structural example of the input alert ID definition table of the Example of this invention. It is a figure explaining the definition of the item used as the component of the input alert ID definition table of the Example of this invention. It is a figure explaining the structural example of the alert statistical process table of the Example of this invention. It is a figure explaining the definition of the item used as the component of the alert statistical processing table of the Example of this invention. It is a block diagram which shows the detail of the alert output function of the Example of this invention. It is a figure explaining the structural example of the integrated alert statistical processing table of the Example of this invention. It is a figure explaining the definition of the item used as the component of the integrated alert statistical process table of the Example of this invention. It is a figure explaining the structure of the filter of an Example to this invention. It is a whole block diagram of the conventional control system.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is an overall configuration diagram of a control system according to an embodiment of the present invention.

  In FIG. 1, a wide area network (first network) WAN (Wide Area Network) 25 and a local network (second network) LAN (Local Area Network) 28 are connected by a network interconnection device 21.

  The network interconnection device 21 performs communication processing for transferring data between networks. The network interconnection device 21 may perform other processing necessary for network interconnection, such as encryption.

  The local network 28 is connected to a facility device to be controlled and monitored by the control system. The equipment devices are sensors such as temperature sensors, monitoring cameras, switches, actuators, and the like, and are connected to the network interconnection device 21 via the communication terminal 22.

  A management center 26 having a management computer is connected to the wide area network 25. As the wide area network 25, a network provided by a communication carrier is used.

  FIG. 2 is a functional block diagram of the network interconnection device 21 according to the embodiment of this invention.

  The local network reception function 31 in the network interconnection device 21 receives data transmitted from the communication terminal 22. The received data is sent from the wide area network transmission function 34 to the management center 26 via the wide area network 25 through processing necessary for network interconnection such as the encapsulation function 32 and the protocol conversion function 33.

  On the other hand, the wide area network reception function 35 in the network interconnection apparatus receives the control command transmitted from the management center 26 via the wide area network 25. The received control command is sent to the communication terminal 22 from the local network transmission function 38 via the local network 28 through processing necessary for network interconnection such as the protocol conversion function 36 and the decapsulation function 37.

  The alert detection function 39 detects an abnormal event that has occurred in the communication process. The log recording function 310 records the detected abnormal event. The wide area network monitoring function 311 monitors the communication status of the wide area network 25. The alert output function 312 performs processing according to the communication status monitored by the detected abnormal event, and then outputs it to the wide area network 25. Details of the alert detection function 39, the wide area network monitoring function 311 and the alert output function 312 will be described later. In the network interconnection device 21 of the present embodiment, the wide area network monitoring function 311 monitors the communication status of the wide area network 25, so that the normal data transmission / reception processing and load can be distributed.

  The management computer of the management center 26 is a computer having a processor and a memory, and has a wide area network reception function 313, a wide area network transmission function 314, an alert display function 315, and a delay measurement function 316. The wide area network reception function 313 calculates the transmission delay of the network by receiving the data transmitted from the network interconnection device 21. The wide area network transmission function 314 notifies the network interconnection device 21 of the calculated delay amount. The alert display function 315 is a display device for displaying an alert transmitted from the network interconnection device 21. The delay measurement function 316 calculates the transmission delay of the wide area network 25.

  FIG. 3 is an explanatory diagram showing a process activation state during software execution of the network interconnection device 21 according to the embodiment of this invention.

  In the software of the network interconnection device 21, each function described with reference to FIG. 2 operates as a generally independent process when executed as software. For example, the local network reception function 31 is associated with the local network reception process 41, and the wide area network transmission function 34 is associated with the wide area network transmission process 42. The processes associated with the encapsulation function 32 and the protocol conversion function 33 are not resident processes and are activated only when necessary. In addition to the individual functions, there is also a main process 47 that controls the overall movement.

  The alert detection function 39 is distributed to each process and implemented as an alert detection thread 43. The alert detection function 39 detects an abnormal event that has occurred in a plurality of threads executed within each process, performs processing according to the occurrence state, and generates an alert. The output process 44 and the log recording process 45 are notified.

  The alert detection function 39 functions as first statistical processing and first filtering. When an alert of a certain amount or more is generated in each process, notification of the alert is performed at a stage inside the process (without inter-process communication). By reducing the frequency and amount of data, the processing load on the network interconnection device 21 is reduced.

  The alert output function 312 is associated with the alert output process 44. The alert output process 44 processes the signal output from the alert detection thread of a plurality of processes according to the communication status of the wide area network 25 notified from the wide area network monitoring process 46 and outputs the processed signal to the wide area network 25. The log recording function 310 is associated with the log recording process 45.

  FIG. 4 is a block diagram of the network interconnection device 21 according to the embodiment of this invention.

  The network interconnection device 21 includes a local network communication interface (I / F) 51 connected to the local network 28 and a wide area network communication I / F 52 connected to the wide area network 25. The local network communication interface (I / F) 51 and the connected wide area network communication I / F 52 are connected to a processor (CPU) 54, a hardware accelerator 55, and a calculation memory 56 via an internal bus 53. The processor 54 is connected to a program storage memory 57 that stores a program executed by the processor 54. The processor 54 and the hardware accelerator 55 constitute a processing unit, and the arithmetic memory 56 and the program storage memory 57 constitute a storage unit.

  The hardware accelerator 55 replaces a part of software operations executed by the processor 54 with a hardware circuit to speed up the operations, and may use an FPGA (Field Programmable Gate Array). For example, the statistical processing units 61 and 92 (included in the alert detection function 39 and the alert output function 312, respectively), the encapsulation function 32, and the decapsulation function 37 are converted into hardware by the hardware accelerator 55, and fixed calculation is performed. Can be speeded up.

  Further, the program storage memory 57 stores programs (for example, a local network transmission program 59, a wide area network reception program 510, a log recording program 511, etc.) corresponding to each process shown in FIG. Each function shown in FIG. 2 can be realized by software processing executed by the CPU 54 of a program stored in the program storage memory 57.

  On the other hand, the calculation memory 56 has an area for storing alert detection statistical information 512, wide area network congestion degree information 513, and the like, which will be described later, according to the execution status of programs corresponding to the functions. A table to be described later may be stored in either the calculation memory 56 or the program storage memory 57 constituting the storage unit.

  FIG. 5 is a block diagram showing details of the alert detection function 39 according to the embodiment of the present invention.

  As described above, the alert detection function 39 is distributed and implemented in each process, and includes an alert detection unit 61, a statistical processing unit 62, an alert generation amount measurement unit 63, and a filter 64. The alert detection unit 61 has an input alert ID definition table 65, and the statistical processing unit 62 has an alert statistical processing table 66.

  The alert detection unit 61 detects all alerts in the process thread when an event considered abnormal occurs in a series of communication-related processes performed in each process thread. The statistical processing unit 62 reversibly compresses the notification frequency and data amount of the detected alert. For example, the data amount can be compressed by deleting unnecessary “0” data. The alert generation amount measuring unit 63 measures the alert generation amount in the process. The filter 64 selects the alert information after the statistical processing according to the measured alert generation amount, and outputs it to the alert output process 44.

  FIG. 6A is a diagram illustrating a configuration example of the input alert ID definition table 65 according to the embodiment of this invention, and FIG. 6B illustrates definitions of items that are components of the table.

  As shown in FIG. 6A, the input alert ID definition table 65 includes a process ID, an input alert ID, and alert contents.

  The input alert ID definition table 65 may be a fixed value described directly in the source code instead of a table format, or may be set as a parameter by reading a specific file during software operation. Note that an alert statistical processing table 66 and an integrated alert statistical processing table 93, which will be described later, can also be implemented in the same manner as the input alert ID definition table 65.

  As illustrated in FIG. 6B, the process ID is an identifier for identifying a process in which an abnormal event has occurred. For example, “0x0” is defined for each process such as a main process. The input alert ID is an identifier for identifying the type of alert (abnormal event itself) that occurs in each process.

  FIG. 7A is a diagram illustrating a configuration example of the alert statistical processing table 66 according to the embodiment of this invention, and FIG. 7B illustrates definitions of items that are components of the table.

  The alert statistical processing table 66 includes post-filter alert ID, process ID, input alert ID, filter type, cumulative measurement time T, cumulative alert count N, and filter validation level.

  As illustrated in FIG. 7B, the process ID is an identifier for identifying a process in which an abnormal event has occurred. The input alert ID is an identifier for identifying the type of alert (abnormal event itself) that occurs in each process.

The filter type is set for each input alert ID defined in the input alert ID definition table 65. In this embodiment, four types of filters are defined.
0x0: Through (no filter processing is performed)
0x1: Once (The alert is output only once and the flag is turned ON. After that, the alert is masked until the flag is cleared from the management center 26 side.)
0x2: Toggle (Only the change point from alert OFF to ON when an abnormality occurs and from alert ON to OFF when normal recovery is output)
0x3: Cumulative (Alert is passed once if N times are input within measurement time T. If N times or less, alert is masked.)
If the filter type is 0x3 (cumulative), it is necessary to define the unit measurement time T and the cumulative alert occurrence frequency threshold.

  By defining the type of filter in the input alert ID definition table 65, it is possible to perform accurate processing according to the type of alert.

  The cumulative measurement time is a time (for example, seconds) for measuring the number of alerts. The cumulative alert occurrence count threshold is a determination threshold that allows the number of generated alerts (abnormal events) to pass as an alert.

  The filter activation level of the alert statistical processing table 66 is a threshold value for controlling the operation of the filter. For example, when the amount of alerts generated is large by comparing with the amount of all alerts generated per unit time, Alerts to be output can be reduced.

  The alert generation amount measurement unit 63 calculates the total number of occurrences of all the alerts defined in FIG. 6A for each cumulative measurement time T, determines the value based on a predefined threshold N, and filters the determined level. 64 is notified.

  The filter 64 defines a filter activation level for the filter defined for each input alert ID in the alert statistical processing table 66, and enables the filter processing when the alert generation amount measurement level exceeds a predetermined value. If it is less than or equal to the predetermined value, all alerts are passed (output without filtering).

  The post-filter alert ID may be a concatenation of a process ID, an input alert ID, and a filter type. This is because, by defining the alert ID after filtering in this way, the management center 26 can determine what processing has been performed in the network interconnection device 24 based on the received alert ID. When the management center 26 receives an alert that has been subjected to a filtering process with a high filter activation level, the management center 26 detects that a certain amount of alerts have occurred in the network interconnection device 21 and has been filtered. The management center 26 can also request log information of the network interconnection device 21 in order to analyze the cause of the alert.

  The wide area network monitoring function 311 monitors the status of the wide area network 25. For example, the transmission delay of the wide area network 25 is measured using data packets transmitted and received between the network interconnection device 21 and the management center 26, and when the delay amount becomes a certain amount or more, it is determined that the network is congested. By doing so, the status of the wide area network 25 is monitored.

  Specifically, the network interconnection device 21 and the management center 26 are time-synchronized, and a time stamp is given to data transmitted from the wide area network transmission function 34. The wide area network reception function 313 of the management center 26 gives a time stamp when receiving data. The delay measurement function 316 calculates a network transmission delay from the time difference between the two. Then, the wide area network transmission function 314 notifies the network interconnection device 21 of the calculated delay amount. In the network interconnection device 21, the wide area network reception function 35 receives the delay amount, the wide area network monitoring function 311 determines the received delay value based on a predefined threshold value, and the level after the determination is the congestion degree information (wide area network 25), the alert output function 312 is notified. In this way, special data for measuring the status of the network is transmitted and received by measuring the congestion degree of the network using data normally transmitted and received between the network interconnection device 21 and the management center 26. It is not necessary and does not constrain the network bandwidth.

  FIG. 8 is a block diagram illustrating details of the alert output function 312 according to the embodiment of this invention.

  The alert output function 312 includes a statistical processing unit 91 and a filter 92. The statistical processing unit 91 has an integrated alert statistical processing table 93.

  The alert output function 312 functions as second statistical processing and second filtering, and is transmitted from the network interconnection device 21 in accordance with the type of communication carrier network used and the communication status of the network that changes every moment. Limit the type and amount of alarms comprehensively and avoid overloading the line capacity. In addition, the alert output function 312 can make a comprehensive determination across a plurality of processes, thereby compressing the amount of data transmitted further than the first statistical processing and the first filtering.

  The statistical processing unit 91 receives the first filtered alert information collected by the alert detection function 39 in the plurality of processes, and performs the second statistical processing across the plurality of processes. The filter 92 is a second filter that receives congestion degree information of the wide area network 25 from the wide area network monitoring unit 311 and selects alert information after the second statistical processing according to the congestion degree information. Alert information is sent to the wide area network 25.

  FIG. 9A is a diagram illustrating a configuration example of the integrated alert statistical processing table 93 according to the embodiment of this invention, and FIG. 9B illustrates definitions of items that are components of the table.

  The integrated alert statistical processing table 93 includes an output alert ID, a filtered alert ID, a second filter type, a cumulative measurement time T, a cumulative alert count N, a script kick, a script name, and a filter activation level.

  As shown in FIG. 9B, the definition of the items in the integrated alert statistical processing table 93 is almost the same as the definition of the items used in the alert statistical processing table 66 shown in FIG. 7B.

  In the alert statistical processing table 66 (FIG. 7A), the output alert ID is defined at 1: 1 for each input alert ID. In the integrated alert statistical processing table 93 (FIG. 9A), a plurality of input alert IDs are defined. It is different that one output alert ID can be defined from a plurality of output alert IDs, and a plurality of output alert IDs can be defined from one input alert ID.

  For example, an alert with an output alert ID of 0x03F000 is output when the total number of three types of alerts 0x1102, 0x2202, and 0x2213 within a predetermined time exceeds ten.

  In addition, 0x4: mask (not pass through while the filter is valid) is added to the filter type. By using the filter of the mask (0x4), it is possible to comprehensively judge and filter from a plurality of types of alerts transmitted from a plurality of processes.

  The present embodiment further has a function of executing a predetermined program (script) when a specific alert occurs. The script to be executed is executed together with the output of the alert information or instead of outputting the alert information. The script to be executed is defined by a script name (which may include a path name). In this embodiment, the script execution function is implemented in the integrated alert statistical processing table 93 (second filter), but may be implemented in the alert statistical processing table 66 (first filter). Since the filter has a script execution function, it is possible to execute a complicated process that does not simply filter and output an alert.

  The filter validation level of the integrated alert statistical processing table 93 is a threshold value for controlling the operation of the filter according to the degree of congestion of the wide area network 25. When the wide area network 25 is congested, the output alerts are reduced. . This is because, when the wide area network 25 is congested, if a large number of alerts are sent, the network becomes tight and prevents normal data transmission. Moreover, it is possible to suppress the tightness of the wide area network by sending only the aggregated important alerts.

  FIG. 9C is a diagram illustrating the configuration of the filter of the configuration example illustrated in FIG. 9A.

  The second filter 92A is a “cumulative” type filter that receives the alert 0x1102 output from the first filter. When the filter activation level is 3 or more, the alert 0x1102 is received five times in 60 seconds. , Alert 0x031102 is output once. In this case, since the script kick flag is 1, when the alert 0x031102 is output, Reset_count. Start scp.

  Another second filter 92B is a “mask” type filter that receives the alert 0x1111 output from the first filter. When the filter activation level is 2 or more, all the alert 0x1111 is masked and not output. .

  Further, another second filter 92C is a “cumulative” type filter that receives the alerts 0x1102, 0x2202, and 0x2213 output from the first filter. When the filter activation level is 3 or more, the above-described 3 When alerts output from the types of filters are received a total of 10 times per second, alert 0x03F000 is output once.

  According to a typical embodiment of the present invention, it is possible to ensure high reliability required as a control system system while corresponding to cloudization and corresponding to cost reduction and high system efficiency. .

  Although the present invention has been described in detail with reference to the accompanying drawings, the present invention is not limited to such specific configurations, and various modifications and equivalents within the spirit of the appended claims Includes configuration.

21 Local network 22 Communication terminal 24 Network interconnection device 25 Wide area network (communication carrier network)
26 Management Center 27 Application Server 31 Local Network Reception Function 32 Encapsulation Function 33 Protocol Conversion Function 34 Wide Area Network Transmission Function 35 Wide Area Network Reception Function 36 Protocol Conversion Function 37 Decapsulation Function 38 Local Network Transmission Function 39 Alert Detection Function 310 Log Recording Function 311 Wide area network monitoring function 312 Alert output function 313 Wide area network reception function (center side)
314 Wide area network transmission function (center side)
41 Local network reception process 42 Wide area network transmission process 43 Alert detection thread 44 Alert output process 45 Log recording process 46 Wide area network monitoring process 47 Main process 51 Local network communication interface 52 Wide area network communication interface 53 Internal bus 54 Processor (CPU)
55 Hardware Accelerator 56 Operation Memory 57 Program Storage Memory 59 Local Network Transmission Program 510 Wide Area Network Reception Program 511 Log Recording Program 512 Alert Detection Statistical Information 513 Wide Area Network Congestion Information 61 Alert Detection Units 62 and 91 Statistical Processing Unit 63 Alert generation amount measurement unit 64, 92 Filter 65 Input alert ID definition table 66 Alert statistical processing table 93 Integrated alert statistical processing table

Claims (13)

A network device connected via a network to a management device that collects data from a communication terminal,
A plurality of communication processing processes for controlling communication according to a predetermined communication protocol, and an alert output process for outputting alert information to the management device,
The plurality of communication processing processes detect an alert in each communication processing process, perform first statistical processing on the detected alert, and generate alert information generated based on a result of the first statistical processing. Perform the first filtering to output to the alert output process,
The alert output process receives alert information from the plurality of communication processing processes, performs a second statistical process on the received alert information using a status of the network, and based on a result of the second statistical process And a second filtering for outputting the selected alert information to the management device. The network device according to claim 1,
The plurality of communication processing processes include:
Compressing the detected alert in the first statistical process;
In the first filtering, an alert information to be output to the alert output process is generated by selecting an alert after the first statistical processing in accordance with an amount of alerts generated in the communication processing process. Network device. The network device according to claim 1,
A network apparatus comprising: a network monitoring process for determining a status of the network and notifying the alert output process. The network device according to claim 1,
In the second statistical processing, the alert output process performs statistical processing across the plurality of communication processing processes. The network device according to claim 1,
In the second filtering, the alert output process executes a predetermined program together with the output of alert information or instead of outputting the alert information to the management device. The network device according to claim 1,
The first and second filtering are:
(1) Through mode without filtering
(2) Once mode that passes the alert only once, turns on the alert flag, masks the alert until the alert flag is cleared,
(3) Toggle mode that outputs alert-on when alert is detected and outputs alert-off when alert is recovered, and
(4) A network device characterized in that at least two or more of an accumulation mode in which an alert is output once can be switched when an alert is input a predetermined number of times within a predetermined time. A network system comprising the network device according to any one of claims 1 to 6, and a management device connected to the network device via a network,
The network system, wherein the network device determines the status of the network based on a delay time of data transmitted from the network device to the management device. A network device connected via a network with a management device that collects data from a communication terminal that outputs alert information is a method for processing the alert information,
The network device includes a processor that executes a predetermined program, and a memory that stores a program executed by the processor,
The processor implements a plurality of communication processing processes for controlling communication by a predetermined communication protocol by executing the program, and an alert output process for outputting alert information to the management device,
The method
The processor detects an alert in each communication processing process in the plurality of communication processing processes, performs first statistical processing on the detected alert, and is generated based on a result of the first statistical processing Performing a first filtering to output alert information to the alert output process;
In the alert output process, the processor receives alert information from the plurality of communication processing processes, performs second statistical processing on the received alert information using the network status, and the second statistical processing And a second filtering step for outputting the alert information selected based on the result to the management device. The alert information processing method according to claim 8,
In the first statistical process, the processor compresses the detected alert;
In the first filtering, the processor selects an alert after the first statistical processing according to the amount of alerts generated in the communication processing process, and generates alert information to be output to the alert output process An alert information processing method characterized by: The alert information processing method according to claim 8,
A method of processing alert information, comprising: a step of determining the status of the network and notifying the alert output process of the processor. The alert information processing method according to claim 8,
In the second statistical processing, the processor performs statistical processing across the plurality of communication processing processes. The alert information processing method according to claim 8,
In the alert output process, the processor executes a predetermined program in the second filtering together with the output of the alert information or instead of outputting the alert information to the management device. Method. The alert information processing method according to any one of claims 8 to 12,
In the first and second filtering, the processor
(1) Through mode without filtering
(2) Once mode that passes the alert only once, turns on the alert flag, masks the alert until the alert flag is cleared,
(3) Toggle mode that outputs alert-on when alert is detected and outputs alert-off when alert is recovered, and
(4) A method for processing alert information, characterized in that at least two or more of an accumulation mode in which an alert is output once can be switched when an alert is input a predetermined number of times within a predetermined time.

Images