Programmable logic controller and analyzer

An analyzer communicatively connected to a programmable logic controller including

• an execution engine that repeatedly executes a user program,
• a device memory having a plurality of devices that are storage areas for storing data accessed by the execution engine in accordance with the user program, and
• a collection section for collecting data held by a device as a collection target out of the plurality of devices in accordance with a predetermined collection setting for each scan cycle of the user program,
• the analyzer comprising:
• an acquisition section for acquiring time-series data of each of the devices collected by the collection section from the programmable logic controller;
• a classification section for classifying each of the devices into one of a plurality of types on a basis of a characteristic of time-series data of each of the devices acquired by the collection section;
• a determination section for determining a detection algorithm used in identification of the device as an abnormal device in accordance with the time-series data of the device collected by the collection section and the type of the device classified by the classification section for each of the devices;
• an identification section for identifying an abnormal device by analyzing the time-series data of the device collected by the collection section by using the detection algorithm determined by the determination section for the device in accordance with the type of the device classified by the classification section;
• and
• an output section for outputting a result of the identification by the identification section.