JP7829341B2 - Anomaly detection device, anomaly detection system, anomaly detection method, and program - Google Patents

Description

This disclosure relates to an anomaly detection device, an anomaly detection system, an anomaly detection method, and a program.

Patent Document 1 discloses an anomaly monitoring system that monitors plant abnormalities using multiple anomaly detection methods. This system constructs detection models for each method, such as the MT method, K-nearest neighbor method, neural network method, generalized linear method, SVM method, and random forest method, and performs anomaly detection using each detection model. Weights are then assigned to the detection results of each detection model to make an overall determination of normal or abnormal. For example, for detection models 1 to 4, weights a is assigned to detection model 1, b to detection model 2, c to detection model 3, and d to detection model 4. If detection models 1 and 2 determine the plant is normal, and detection models 3 and 4 determine it is abnormal, then if a + b > c + d, the plant is determined to be normal; if a + b < c + d, the plant is determined to be abnormal.

Here, let's assume that the anomaly detection by detection model A is performed by the following process, for example. That is, detection model A acquires eight types of signals 1 to 8 measured at the plant. Then, it estimates the value of signal 4 from the measured values of signals 1 to 3, and estimates the value of signal 8 from the measured values of signals 5 to 7. Then, if the deviation between the estimated value and the measured value of signal 4 is greater than or equal to a threshold, or if the deviation between the estimated value and the measured value of signal 8 is greater than or equal to a threshold, it is determined to be an anomaly. Furthermore, let's assume, for example, that the measured value of signal 4 has a tendency to have a large variability. In that case, even though the value of signal 4 is actually normal, due to the large variability, the deviation between the estimated value and the measured value for signal 4 may exceed the threshold, and as a result, detection model A may determine that it is an anomaly. According to the method of Patent Document 1, it can be understood that weighting is performed on detection model A taking such risks into consideration, but it is not possible to suppress false detections by detection model A itself. For example, if detection model A is given a relatively small weight to account for false positives due to the instability of signal 4, there is a risk that detection model A's correct detection of an anomaly may be overlooked. In contrast, if the anomaly determination is weighted based on the signal used for anomaly detection, rather than the model itself, it is believed that more accurate anomaly detection can be achieved. For instance, if detection model A in the above example could assign different weights to its determination results depending on whether it determines an anomaly based on 1) signal 4, 2) signal 8, or 3) both signal 4 and signal 8 (for example, weighting such that 2) is considered more likely to indicate an anomaly than 1), and 3) is considered more likely to indicate an anomaly than 2), it is believed that this would lead to more accurate anomaly detection.

Japanese Patent Publication No. 2019-091113

It is believed that more accurate anomaly detection can be achieved by weighting the signals used for anomaly detection, rather than weighting the models used for anomaly detection.

This disclosure provides an anomaly detection device, an anomaly detection system, an anomaly detection method, and a program that can solve the above-mentioned problems.

The abnormality detection device of this disclosure includes: a signal acquisition unit that acquires a plurality of signals indicating the state of a plant; a setting unit that sets an abnormality level corresponding to the number of signals that fall outside a threshold range among the plurality of signals; and an abnormality determination unit that compares the plurality of signals with a threshold predetermined for each of the signals to calculate the number of signals that fall outside the threshold range, calculates an abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level, and determines an abnormality in the plant based on the calculated abnormality level. The setting unit calculates the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal for each of the plurality of signals, classifies the plurality of signals into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold, and may set a smaller abnormality level for the same number of signals compared to the case where the number of signals greater than or equal to the first threshold is greater than the number of signals less than the first threshold. The setting unit, upon inputting learning data having multiple data points for multiple signals used to construct the estimation model into a predetermined estimation model, determines for each signal whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, calculates the number of signals that exceed the predetermined value, sets the calculated number of signals as the first number of signals which are outside the first acceptable range, divides the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals equally and rounds up the fractional part, and sets the second number of signals which are outside the second acceptable range, a predetermined value determined considering the possibility of false detection of an abnormality in the plant, may be set as the abnormality level when the number of signals outside the acceptable range is equal to or greater than the first number of signals and less than the second number of signals.
Furthermore, the abnormality detection device of this disclosure includes: a signal acquisition unit that acquires a plurality of signals indicating the state of the plant; a setting unit that sets a correspondence between the range of the number of signals whose values are outside the permissible range and the abnormality level; an abnormality determination unit that compares the plurality of signals with the permissible range defined for each of the signals to calculate the number of signals that are outside the permissible range, calculates the abnormality level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of the number of signals and the abnormality level, and determines an abnormality in the plant based on the calculated abnormality level , wherein the correspondence between the range of the number of signals that are outside the permissible range and the abnormality level The abnormality level is set according to how many of the multiple signals have a large variation in value, and the abnormality level set in the correspondence is a weighting of how likely it is that the values of the number of signals included in the range are outside the allowable range, and when comparing the case in which a predetermined number of signals have a large variation with the case in which no signals have a large variation among the multiple signals, a higher abnormality level is set for the case in which no signals have a large variation than for the case in which a predetermined number of signals have a large variation in the range below the predetermined number.

The anomaly detection system of this disclosure includes the anomaly detection device and a notification device, the notification device comprising: an acquisition unit that acquires information relating to an anomaly detected by the anomaly detection device; a setting unit that accepts the setting of anomalies to be notified; and a notification unit that notifies the anomaly to be notified when the information relating to the anomaly acquired by the acquisition unit includes the anomaly to be notified.

The abnormality detection method of this disclosure includes the steps of: acquiring a plurality of signals indicating the state of a plant; setting an abnormality level corresponding to the number of signals whose values are outside an acceptable range among the plurality of signals; comparing the plurality of signals with the acceptable range defined for each of the signals to calculate the number of signals that are outside the acceptable range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level. In the setting step, for each of the plurality of signals, the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal is calculated, and the plurality of signals are classified into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold, and if the number of signals whose standard deviation is greater than or equal to the first threshold is greater than or equal to the number of signals whose standard deviation is less than the first threshold, a smaller abnormality level may be set for the same number of signals compared to the case where the number of signals whose standard deviation is greater than or equal to the first threshold is less than or equal to the number of signals whose standard deviation is less than the first threshold. In the setting step, when a predetermined estimation model is input to a predetermined estimation model, learning data having multiple data points for multiple signals used to construct the estimation model is used to determine whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, the number of signals whose deviation exceeds the predetermined value is calculated, and the calculated number of signals is set as the first number of signals which is outside the first acceptable range, and the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals is divided equally and rounded up is set as the second number of signals which is outside the second acceptable range, and the abnormality level when the number of signals which is outside the acceptable range is greater than or equal to the first number of signals and less than the second number of signals may be set to a predetermined value determined considering the possibility that an abnormality in the plant may be falsely detected.
Furthermore, the abnormality detection method of this disclosure includes the steps of: acquiring a plurality of signals indicating the state of the plant; setting a correspondence between the range of the number of signals whose values are outside the acceptable range and the abnormality level; comparing the plurality of signals with the acceptable range defined for each of the signals to calculate the number of signals that are outside the acceptable range; calculating the abnormality level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of the number of signals and the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level, wherein the correspondence between the range of the number of signals that are outside the acceptable range and the abnormality level is The abnormality level set in the correspondence is determined according to how many of the multiple signals have a large variation in value, and is weighted to indicate the likelihood that the value of the number of signals included in the range being outside the allowable range indicates that the plant is in an abnormal state. When comparing the case in which a predetermined number of signals have a large variation with the case in which no signals have a large variation, a higher abnormality level is set for the case in which no signals have a large variation than for the case in which a predetermined number of signals have a large variation within the range below the predetermined number.

The program of this disclosure causes a computer to perform the following steps: acquire a plurality of signals indicating the status of a plant; set an abnormality level corresponding to the number of signals whose values are outside an acceptable range; compare the plurality of signals with the acceptable range defined for each of the signals to calculate the number of signals that are outside the acceptable range; calculate the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determine an abnormality in the plant based on the calculated abnormality level. In the setting step, for each of the plurality of signals, the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal is calculated, and the plurality of signals are classified into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold. If the number of signals whose standard deviation is greater than or equal to the first threshold is greater than the number of signals whose standard deviation is less than the first threshold, a smaller abnormality level may be set for the same number of signals compared to the case where the number of signals whose standard deviation is greater than or equal to the first threshold is less than the number of signals whose standard deviation is less than the first threshold. In the setting step, when a predetermined estimation model is input to a predetermined estimation model, learning data having multiple data points for multiple signals used to construct the estimation model is used to determine whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, the number of signals whose deviation exceeds the predetermined value is calculated, and the calculated number of signals is set as the first number of signals which is outside the first acceptable range, and the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals is divided equally and rounded up is set as the second number of signals which is outside the second acceptable range, and the abnormality level when the number of signals which is outside the acceptable range is greater than or equal to the first number of signals and less than the second number of signals may be set to a predetermined value determined considering the possibility that an abnormality in the plant may be falsely detected.
Furthermore, the program of this disclosure includes the steps of: acquiring a plurality of signals indicating the status of a plant; setting a correspondence between the range of the number of signals whose values are outside an acceptable range and an abnormal level; comparing the plurality of signals with the acceptable range defined for each of the signals to calculate the number of signals that are outside the acceptable range; calculating the abnormal level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of the number of signals and the abnormal level; and determining an abnormality in the plant based on the calculated abnormal level, wherein the correspondence between the range of the number of signals that are outside the acceptable range and the abnormal level is The abnormality level set in the correspondence is a weighting of the likelihood that the values of the number of signals included in the range being outside the allowable range indicates that the plant is in an abnormal state, and when comparing the case in which a predetermined number of signals are included in the range with the case in which no signals are included in the range, a higher abnormality level is set for the case in which no signals are included in the range below the predetermined number than for the case in which a predetermined number of signals are included .

According to the anomaly detection device, anomaly detection system, anomaly detection method, and program of this disclosure, it is possible to set weights (anomaly levels) for signals that are to be judged as anomalies in anomaly detection.

Block diagram is an example of an anomaly detection system according to each embodiment. This is a flowchart showing an example of the modeling process according to the first embodiment. This figure shows an example of an anomaly detection method according to the first embodiment. This figure shows an example of setting the execution conditions for the anomaly detection method according to the first embodiment. This figure shows an example of setting up training data according to the first embodiment. This figure shows an example of a screen for setting anomaly detection conditions according to the first embodiment. An example of an anomaly detection condition file according to the first embodiment is shown. This is a flowchart showing an example of an anomaly detection process according to the first embodiment. This figure shows an example of a list screen of anomaly detection results according to the first embodiment. This is a flowchart showing an example of the modeling process according to the second embodiment. This figure shows an example of a screen for suggesting distribution patterns according to the second embodiment. This figure shows an example of the hardware configuration of the anomaly detection system according to each embodiment.

The setting of anomaly detection conditions and anomaly detection based on these conditions according to the embodiment will be described in detail below with reference to the drawings.
(System configuration)
Figure 1 is a block diagram showing an example of an anomaly detection system according to each embodiment. The anomaly detection system 20 includes an anomaly detection device 10, a display device 2, and other devices 3. The anomaly detection device 10 acquires various signals representing the state of the plant 1 from sensors installed on each piece of equipment constituting the plant 1 during operation, and performs anomaly detection based on the acquired signals. When anomaly detection is performed, a trained model for anomaly detection is used, and when this model determines whether or not there is an anomaly based on multiple signals acquired from the plant 1, it performs anomaly determination by weighting those signals.

As shown in the figure, the anomaly detection device 10 includes a signal acquisition unit 11, an input receiving unit 12, a control unit 13, and a storage unit 18.
The signal acquisition unit 11 acquires signals such as temperature, pressure, rotation speed, and vibration from sensors installed on each piece of equipment that makes up the plant 1. The plant 1 and the anomaly detection device 10 are connected by a communication line 4, allowing various signals to be acquired in real time from the operating plant 1. The signal acquisition unit 11 also acquires previously measured signals (training data) to be used in building a model for anomaly detection.

The input receiving unit 12 is configured using input devices such as a keyboard, mouse, touch panel, and buttons. The input receiving unit 12 receives input from the user via the input device to the anomaly detection device 10 and outputs the input information to the control unit 13.

The control unit 13 controls the operation of the anomaly detection device 10. The control unit 13 includes a setting unit 14, a learning unit 15, an anomaly determination unit 16, and an anomaly notification unit 17.

The setting unit 14 performs various settings necessary for building the model used for anomaly detection, as well as various settings necessary for anomaly detection itself. While specific setting details will be described later, for example, the setting unit 14 sets the weighting of signals, which signals to use for anomaly detection determination, and which signals to use as explanatory variables for estimating the values of the signals used for anomaly determination. The setting unit 14 has a function to acquire setting information entered by the user and perform various settings (first embodiment) and a function to perform settings automatically (second embodiment). Furthermore, the setting unit 14 creates a setting screen for user input and outputs it to the display device 2.

The learning unit 15 learns from the signals (learning data) acquired by the signal acquisition unit 11 based on the settings set by the setting unit 14, and constructs a model. For example, the learning unit 15 may construct a normal model (e.g., a unit space in the MT method) by learning signals collected when plant 1 is in a normal state, or it may construct an estimation model that estimates the value of a signal used for anomaly detection from one or more signals.

The abnormality determination unit 16 determines an abnormality in plant 1 based on the model constructed by the learning unit 15 and the signals acquired by the signal acquisition unit 11. When determining an abnormality using the normal model, the abnormality determination unit 16 compares the monitored signal with the normal model. If the monitored signal falls within the range considered normal based on the normal model, plant 1 is determined to be normal; otherwise, plant 1 is determined to be abnormal. When using the estimation model, the abnormality determination unit 16 inputs the signal set as an explanatory variable into the estimation model to estimate the value of the signal used for abnormality determination. If the deviation between the estimated value and the measured value of the signal used for abnormality determination is greater than or equal to a threshold, plant 1 is determined to be abnormal; if the deviation is less than the threshold, plant 1 is determined to be normal. The abnormality determination unit 16 performs abnormality determination using either the normal model or the estimation model, or both. When both are used, the abnormality determination unit 16 weights the determination result from the normal model and the determination result from the estimation model to make the final abnormality determination. Furthermore, when the anomaly detection unit 16 performs anomaly detection using an estimation model, it considers the weighting of the signals used for anomaly detection. Details of the anomaly detection considering the signal weighting will be described later. The anomaly detection unit 16 also records the result of the anomaly detection in the storage unit 18.

The abnormality notification unit 17 outputs information related to the abnormality detected by the abnormality determination unit 16 to the display device 2 or transmits it to other devices 3 via the communication line 5. For example, the abnormality notification unit 17 may generate a list screen of the abnormality detection results and output this list screen to the display device 2. The information related to the abnormality includes, for example, the determination result by the abnormality determination unit 16, the time the abnormality was determined, the identification information of the signal determined to be abnormal, and the abnormality level.

The memory unit 18 stores various information, such as signals acquired by the signal acquisition unit 11 and the judgment results from the abnormality determination unit 16.

The display device 2 is, for example, an LCD (Liquid Crystal Display) or an organic EL (Electro Luminescence) display device, which displays the abnormality detected by the abnormality detection device 10 and its details.
The other device 3 comprises an input/output unit 31, a setting unit 32, a notification unit 33, and a storage unit 34.
The input/output unit 31 inputs or outputs various types of data to and from other devices. For example, the input/output unit 31 is configured to include input devices such as a keyboard, mouse, touch panel, and buttons, as well as input/output interfaces with other devices. The input/output unit 31 receives input from the user using an input device, acquires information related to an anomaly detected by the anomaly detection device 10, and outputs data to the notification unit 33.
The setting unit 32 configures the settings for abnormalities to be notified, such as what kind of abnormalities should trigger a notification and what kind of information should be notified.
The notification unit 33 is comprised of notification means such as a display device, a patrol lamp, and a buzzer. Based on the settings made by the setting unit 32, the notification unit 33 uses the notification means to notify the abnormality to be notified when the abnormality to be notified is included in the abnormality information acquired by the input/output unit 31. For example, if the notification means is a display device, the notification unit 33 displays the plant name of the plant where the abnormality occurred, the time of the abnormality occurrence, the abnormality level, etc.
The memory unit 34 stores setting information set by the setting unit 32, information related to abnormalities obtained from the abnormality detection device 10, and the like.

<First Embodiment>
(Modeling process)
Next, the modeling process according to the first embodiment will be described with reference to Figures 2 to 7.
Figure 2 is a flowchart showing an example of the modeling process according to the first embodiment.
The signal acquisition unit 11 acquires time-series signals measured in the past, which serve as training data, and these signals are stored in the storage unit 18. These signals are those measured when plant 1 is operating normally. First, the user selects the signals to build the model (step S1). For example, if 10 types of signals are needed for anomaly detection, the user selects 10 types of signals from the training data, and then, for the signals that need to be estimated by the estimation model, selects the types of signals necessary for estimating those signals (signals that will be explanatory variables). The user inputs the selected signal types into the anomaly detection device 10. The setting unit 14 records the signal types input by the user into the storage unit 18 via the input reception unit 12.

Next, the user sets the anomaly detection method (step S2). For example, the user selects one of three patterns: (a) MT method (Mahalanovistaguchi method), (b) estimation method, or (c) MT method + estimation method, and inputs it into the anomaly detection device 10. Figure 3 shows an example of an anomaly detection method. For example, anomaly detection methods include the MT method, multiple regression, ridge regression, kernel ridge regression, and random forest. Of these, all except the MT method are estimation methods. An estimation method is a method in which, for example, an estimation model constructed by multiple regression is input with a signal that will be an explanatory variable, and the estimated value of the signal output by the estimation model is compared with the measured value of the same signal obtained from plant 1, and anomalies are detected by the difference. The MT method can be set simultaneously with other methods, but the multiple regression to random forest estimation methods cannot be used together. When the user selects (b) or (c), they select one from multiple regression to random forest and input it into the anomaly detection device 10. The setting unit 14 records the anomaly detection method entered by the user in the storage unit 18 via the input reception unit 12. For example, the storage unit 18 stores an anomaly detection method file as illustrated in Figure 3. In the anomaly detection method file in Figure 3, methods used for anomaly detection are set to "1," and methods not used are set to "0."

Next, the user selects the signals to be used in the estimation method (step S3). If the user selected (b) or (c) in step S2, they set the signals to be used as explanatory variables and the signals to be used as the target variable (signals used for anomaly detection) in the estimation method from the signals selected in step S1. The setting unit 14 records the settings of the explanatory variables and target variables entered by the user in the storage unit 18 via the input reception unit 12. Note that if the user selected (a) or (c) in step S2, and does not use all of the signals selected in step S1 in the MT method, they may select the signals to be used in the MT method from among them.

Next, the user sets the execution conditions for the anomaly detection method (step S4). The user inputs the conditions for performing anomaly detection during the actual anomaly detection phase (operation phase) after model construction. An example of the execution conditions is shown in Figure 4. For example, if Plant 1 is a power plant, the user sets "Power Plant Monitoring Model" as the model name, "Power Generation Amount" as the signal used for execution decision, and the range of power generation amount "X1 to X2 (kW)" as the execution condition for anomaly detection. The setting unit 14 records the execution conditions for anomaly detection entered by the user in the storage unit 18 via the input reception unit 12. This setting makes it possible to suppress unnecessary anomaly detection, for example, when Plant 1 is in an operating state that is not subject to monitoring.

Next, the user sets the data to be used to build the model (step S5). An example of setting the training data is shown in Figure 5. For example, the user sets the data measured from 2021/10/1 to 2021/10/10 for signals A, B, C, ... set in steps S1 and S3, and uses that data as training data. The setting unit 14 records the range of data entered by the user in the storage unit 18 via the input reception unit 12.

Next, the user sets the upper and lower limits of the signals used to build the model (step S6). For example, if Plant 1 is a power plant, the user sets a lower limit X3 and an upper limit X4 for the signal "Power Generation Amount". The setting unit 14 records the range of data (upper and lower limits) entered by the user in the storage unit 18 via the input reception unit 12. Based on this setting and the setting in step S5, only signals measured within the range of 2021/10/1 to 2021/10/10 (set in step S5), and where the value of the signal "Power Generation Amount" measured at that time falls within the range of X3 to X4, will be used as training data.

Next, the user sets whether or not to sample the training data (step S7). For example, if each signal in the training data is measured every second, the user can set whether to sample values every minute or exclude outliers. The setting unit 14 records the sampling setting information entered by the user in the storage unit 18 via the input reception unit 12.

Next, the setting unit 14 draws histograms and correlation diagrams (step S8). According to the settings up to step S7, the setting unit 14 extracts signals from the training data to be used for model construction, creates histograms for each signal and correlation diagrams between signals, and outputs the created histograms, etc., to the display device 2. The user checks whether the signals used as training data are appropriate by referring to the histograms and correlation diagrams displayed on the display device 2. If inappropriate signals are included, the user adjusts the settings from steps S5 to S7, etc., to select appropriate training data.

Next, the user sets the abnormality detection conditions for the MT method (step S9). Specifically, the user sets the abnormality detection information related to the MT method (i.e., a threshold value for the MD value) as the abnormality detection conditions for the MT method. In the MT method, if the MD value exceeds the threshold value set here, it is determined to be abnormal. Figure 6 shows an example of the abnormality detection condition setting screen 100. For example, the user enters the MD value threshold in setting field 101a and the threshold value for the duration of the state in which the MD value is above the threshold value, which is another condition for determining abnormality, in setting field 101b. The setting unit 14 records the MD value threshold and other information entered by the user in the storage unit 18 via the input reception unit 12.

Next, the user sets the anomaly detection conditions for the estimation method (step S10). Specifically, the user sets the anomaly detection information related to the estimation method (i.e., the threshold for the deviation between the estimated value and the measured value of the signal: the deviation threshold) as the anomaly detection conditions for the estimation method. For example, the user sets this deviation threshold to 3σ. This deviation threshold can be set for each signal. For example, the user enters the deviation threshold for each signal in the setting field 102 of the setting screen 100. The setting unit 14 records the deviation threshold for the estimation method entered by the user in the storage unit 18 via the input reception unit 12.

Next, the user sets the distribution of the anomaly level to be added for the set anomaly detection method (step S11). For example, if there is only one type of anomaly estimation method, that is, (a) MT method or (b) estimation method, the user sets 100% for (a) MT method and 100% for (b) estimation method. For example, in the case of (a), the user enters "100" in the setting field 103, and in the case of (b), the user enters "0" in the setting field 103. Also, in the case of (c) MT method + estimation method, if 40% is set for the MT method and 60% for the estimation method, the user enters "40" in the setting field 103. 40% for the MT method and 60% for the estimation method means that 40% weight is assigned to the anomaly detection judgment result by the MT method, and 60% weight is assigned to the anomaly detection judgment result by the estimation method. The setting unit 14 records the distribution of abnormal levels entered by the user in the storage unit 18 via the input reception unit 12. The storage unit 18 may also have default settings registered, such as (a) 100% for the MT method, (b) 100% for the estimation method, or (c) 40% for the MT method and 60% for the estimation method.

Next, the user sets anomaly judgment information related to the signal for the estimation method settings (for example, setting three patterns of anomaly levels to be added according to the number of signals that exceed the deviation threshold) (step S12). In the case of (b) and (c) where the estimation method is set, the user sets three patterns of anomaly levels to be added according to the number of signals that exceed the deviation threshold. For example, in the case of estimation method (b), if the settings are (1) 40% when there is one signal that exceeds the deviation threshold, (2) 80% when there are three signals, and (3) 100% when there are five signals, the user enters "1" and "40" in setting fields 104a and 104b respectively on the anomaly detection condition setting screen 100 in Figure 6, enters "3" and "40" in setting fields 105a and 105b, and enters "5" and "20" in setting fields 106a and 106b (the settings are made so that the sum of setting fields 104b to 106b is 100). For example, when performing anomaly detection on six signals based on this setting, the anomaly detection unit 16 determines that (1) if one or more but less than three of the six signals exceed the deviation threshold, plant 1 is abnormal with a 40% probability; (2) if three or more but less than five signals exceed the deviation threshold, plant 1 is abnormal with an 80% (40 + 40) probability; and (3) if five or more of the six signals exceed the deviation threshold, plant 1 is abnormal with a 100% (40 + 40 + 20) probability. In this embodiment, weighting can be applied according to the number of signals. This allows for setting weights based on the variability in the behavior of the six signals, thereby suppressing false detections. For example, if many of the six signals can be considered normal even if their behavior is unstable, the abnormality level can be adjusted by (1) lowering it to 20% for one signal and (2) lowering it to 50% for three signals, or by changing the number of signals to (1) lower the abnormality level to 40% for two signals and (2) lowering it to 80% for four signals. This allows the system to be adjusted so that even if the deviation between the estimated and measured values of some signals with large variability exceeds the threshold, it is likely not abnormal if the number of such signals is limited. Conversely, if the variability of the six signals is small (i.e., each of the six signals can be considered to match or reflect the state of Plant 1), the system can be adjusted so that an abnormality is highly likely to occur if the deviation between the estimated and measured values of a relatively small number of the six signals exceeds the threshold, such as (1) 50% if one signal exceeds the deviation threshold, (2) 80% if three signals exceed the threshold, and (3) 100% if four signals exceed the threshold. In this embodiment, when performing anomaly detection using the estimation method, the anomaly level is set in relation to the number of signals, according to the properties (magnitude of variation) of the signals used for anomaly detection. This improves the accuracy of anomaly detection by the estimation method. As an example of default settings in the estimation method (b), the levels may be set as follows: (1) 40% when one signal exceeds the deviation threshold, (2) 40% when half of the total signals exceed the deviation threshold, and (3) 20% when 80% of the total signals exceed the deviation threshold.

Furthermore, in the case of (c) MT method + estimation method, the sum of settings 103, 104b to 106b should be set to 100. For example, if the MT method is set to 40%, then settings 104b to 106b should be set to 10%, 25%, and 25% respectively (the sum of 104b to 106b being 60%).

Next, the user sets an anomaly level threshold that triggers the model to issue a warning (step S13). The anomaly level threshold is the threshold for the anomaly level detected when an anomaly is detected using any of the methods set above: (a) MT method, (b) estimation method, or (c) MT method + estimation method. For example, in the case of (a) the MT method, the calculated anomaly level is either 0% or 100%. Specifically, if the MD value is above the threshold, it is an anomaly (anomaly level of 100%), and if it is below the threshold, it is normal (anomaly level of 0%). In the case of (b) the estimation method, the calculated anomaly level is either the value in setting field 104b in Figure 6, the sum of the values in setting fields 104b and 105b, or the sum of the values in setting fields 104b to 106b, depending on the number of signals where the deviation between the estimated value and the measured value exceeds the deviation threshold set in step S10. For example, if (1) the deviation threshold is set to 40% when there is one signal exceeding the deviation threshold, (2) the deviation threshold is set to 80% when there are three signals exceeding the deviation threshold, and (3) the deviation threshold is set to 100% when there are five signals exceeding the deviation threshold, then when there are two signals exceeding the deviation threshold, the abnormality level will be 40%. (c) In the case of the MT method + estimation method, this is the sum of the abnormality levels calculated by each method. For example, in the MT method + estimation method, if the MT method is weighted at 40% (in this case, the abnormality level of the MT method is 0% or 100%, and multiplying it by a weight of 40% results in possible values of 0% or 40%), and the estimation method is weighted at 60%, and the abnormality level calculated by the MT method is 40%, then the overall abnormality level will be 40% + 40% = 80%. In step S13, a threshold is set for the final abnormality level calculated by any of (a) to (c). For example, to set the threshold to 60%, the user enters 60 in the setting field 107. The setting unit 14 records the final threshold value for the abnormal level entered by the user in the storage unit 18 via the input reception unit 12.

The settings configured in steps S9 to S13 (such as each anomaly detection information) are registered in the storage unit 18 as an anomaly detection condition file, for example, as illustrated in Figure 7.

Next, based on user instructions, the learning unit 15 learns from the training data and constructs a model (step S14). For example, in the case of the MT method, the learning unit 15 constructs a unit space from the training data selected through the processing in steps S1 to S8. In the case of estimation methods such as multiple regression, the learning unit 15 performs regression analysis on the relationship between the explanatory variables and the dependent variable set in step S3 and constructs an estimation model.

Next, the validity of the configured anomaly detection method, training data, and anomaly detection conditions is verified (Step S15). For example, anomaly detection is performed on data for an arbitrary period using the constructed model, and it is confirmed whether the results intended by the user are obtained. The anomaly detection method will be explained next with reference to Figure 8. If it is not valid, the processing from Step S1 onwards is performed as needed to adjust the training data and anomaly detection conditions.

Once validity is confirmed in step S15, the validated model is deployed to the actual monitoring environment (step S16). For example, the learning unit 15 outputs the model (unit space or estimation model) to the anomaly detection unit 16. The anomaly detection unit 16 records the validated model in the storage unit 18.

(Anomaly detection processing)
Next, the anomaly detection process according to the first embodiment will be described with reference to Figure 8.
Figure 8 is a flowchart showing an example of an anomaly detection process according to the first embodiment.
As a prerequisite, the signal acquisition unit 11 acquires multiple signals from plant 1 moment by moment and outputs the signals acquired from plant 1 to the abnormality determination unit 16.
The anomaly determination unit 16 acquires information related to the set anomaly detection method (step S21). For example, the anomaly determination unit 16 reads and acquires an anomaly detection method file illustrated in Figure 3 from the storage unit 18. Next, the anomaly determination unit 16 determines whether the anomaly detection method is the MT method only or not based on the settings in the anomaly detection method file (step S22). If it is the MT method only (step S22; Yes), the anomaly determination unit 16 acquires a signal to be used for anomaly determination (step S23). For example, the anomaly determination unit 16 acquires the signal selected in step S1. Next, the anomaly determination unit 16 acquires anomaly determination information related to the MT method (step S24). The anomaly determination unit 16 reads the anomaly detection condition file illustrated in Figure 7 from the storage unit 18 and acquires the MD threshold. Next, the anomaly determination unit 16 performs anomaly determination using the MT method (step S25). The abnormality determination unit 16 calculates an MD value based on the unit space (model) constructed in the process shown in Figure 2 and the signal acquired in step S23, and makes an abnormality determination by comparing it with the MD threshold of the MT method (abnormality determination information related to the MT method) recorded in the abnormality detection condition file. Specifically, if the calculated MD value is greater than or equal to the MD threshold, the abnormality determination unit 16 determines that plant 1 is abnormal (abnormality level is 100%), and otherwise determines that plant 1 is normal (abnormality level is 0%). If an abnormality is determined (step S26; Yes), the abnormality notification unit 17 notifies an alarm related to the abnormality (step S27). For example, the abnormality notification unit 17 may transmit information such as the plant name, unit name, model name, type of signal used for determination, abnormality level of the signal (0% or 100%), and threshold (MD threshold) to another device 3. Furthermore, for example, the abnormality notification unit 17 may output a list screen of abnormality detection results to the display device 2, displaying the plant name, unit name, model name, abnormality level (0% or 100%), and threshold (MD threshold). Figure 9 shows an example of the list screen 200. The list screen 200 displays the abnormality status, the time (timestamp) when it was determined to be normal or abnormal, the plant name, unit name, the model name used for the determination, the abnormality level calculated in the abnormality determination, the threshold, etc. In the list screen 200, selecting checkbox 201 enables the automatic screen update function, allowing the plant status to be monitored in real time. Also, selecting checkbox 202 displays only the data that has been determined to be abnormal. By monitoring the list screen 200, the user can understand whether or not there is an abnormality in plant 1. In addition, as a notification of an alarm related to the abnormality, the abnormality notification unit 17 transmits information related to the abnormality, including the time when it was determined to be abnormal, the plant name, unit name, the model name used for the determination, the abnormality level calculated in the abnormality determination, various thresholds, and identification information of the signal that was determined to be abnormal based on the deviation threshold, to another device 3. The transmission of information related to the abnormality to other devices 3 is the same in steps S35 and S44.

Furthermore, the anomaly detection unit 16 records the anomaly detection result in the storage unit 18 (step S45). The anomaly detection unit 16 may record data related to the anomaly detection only when an anomaly is detected (for example, the values of each signal and items displayed on the list screen 200 in Figure 9), or it may record data including cases where the detection is deemed normal. It may also be possible to record the actions taken at that time (such as inquiries to the design department or contact with the plant operating company) along with the anomaly detection result. Based on this record, the list screen 200 shown in Figure 9 allows not only real-time anomaly detection but also the retrieval and viewing of previously detected anomalies by setting the extraction start time and extraction time range in the setting fields 203 and 204, respectively. In this way, by collecting and accumulating the anomaly detection results in the database, past anomaly detection results can be viewed, enabling smoother responses to detected anomalies. Furthermore, it becomes possible to analyze currently detected anomalies by comparing them with previously detected anomalies, thereby improving the quality of responses.

Furthermore, if the determination in step S22 determines that it is not solely the MT method (step S22; No), the anomaly determination unit 16 determines whether the anomaly detection method is solely the estimation method based on the settings in the anomaly detection method file in Figure 3 (step S28). If it is solely the estimation method (step S28; Yes), the anomaly determination unit 16 acquires the signal to be used for anomaly determination (step S29). For example, the anomaly determination unit 16 acquires the signal selected in step S3. Next, the anomaly determination unit 16 acquires anomaly determination information related to the estimation method (step S30). The anomaly determination unit 16 reads and acquires deviation thresholds 1 to N from the anomaly detection condition file (Figure 7) in the storage unit 18. Next, the anomaly determination unit 16 performs anomaly determination using the estimation method (step S31). For each signal, the anomaly determination unit 16 calculates the deviation between the estimated value by the estimation model and the measured value transmitted in real time from plant 1, and compares that value with the deviation threshold. The anomaly detection unit 16 determines that a signal is anomaly if the deviation between the estimated value and the measured value exceeds the deviation threshold. The range of the deviation threshold (e.g., 3σ) centered on the estimated value by the estimation model is an example of an acceptable range. The value of the deviation threshold (e.g., 3σ) for each signal may be calculated by the anomaly detection unit 16 based on training data, for example, or the estimation model may be configured to output the value of the deviation threshold along with the estimated value. Next, the anomaly detection unit 16 acquires anomaly detection information related to the signal (step S32). The anomaly detection unit 16 reads and acquires the weights (1) to (3) of the estimation method, the number of signals for (1) to (3), and the signal deviation thresholds 1 to N from the anomaly detection condition file (Figure 7) in the storage unit 18. Next, the anomaly detection unit 16 weights the anomaly detection result from step S31 using the anomaly detection information related to the signal (step S33). The anomaly detection unit 16 counts the number of signals where the deviation between the estimated value and the measured value exceeds the deviation threshold, and calculates the anomaly level based on the number of signals for each weight (1) to (3) of the estimation method. The anomaly detection unit 16 compares the calculated anomaly level with the anomaly level threshold in the anomaly detection condition file (Figure 7). If the calculated anomaly level is greater than or equal to the threshold, plant 1 is determined to be abnormal; if it is less than the threshold, plant 1 is determined to be normal. If an anomaly is determined (step S34; Yes), the anomaly notification unit 17 notifies an alarm related to the anomaly (step S35). For example, the anomaly notification unit 17 may output a list screen of the anomaly detection results to the display device 2, displaying the plant name, unit name, model name, anomaly level (a value corresponding to the number of signals determined to be abnormal), and threshold (the threshold for the anomaly level). The anomaly detection unit 16 records the anomaly determination result in the storage unit 18 (step S45).

Furthermore, if the determination in step S28 determines that it is not solely an estimation method (step S28; No), the anomaly determination unit 16 acquires a signal to be used for anomaly determination (step S36). For example, the anomaly determination unit 16 acquires the signal selected in step S1 or step S3. Next, the anomaly determination unit 16 acquires anomaly determination information related to the MT method and anomaly determination information related to the estimation method (step S37). The anomaly determination unit 16 reads and acquires the MD threshold and deviation thresholds 1 to N from the anomaly detection condition file (Figure 7) in the storage unit 18. Next, the anomaly determination unit 16 performs an anomaly determination using the estimation method (step S38). This process is the same as in step S31. Next, the anomaly determination unit 16 performs an anomaly determination using the MT method (step S39). This process is the same as in step S25. Next, the anomaly determination unit 16 acquires weights for the MT method and weights for the estimation method for each anomaly determination result (step S40). The anomaly detection unit 16 obtains the weights of the MT method from the anomaly detection condition file (Figure 7) in the storage unit 18 and calculates the weights for the estimation method. For example, if the weight of the MT method is 40, the anomaly detection unit 16 calculates that the weight of the MT method is 40 and the weight for the estimation method is 60. Next, the anomaly detection unit 16 obtains anomaly detection information related to the signal and calculates the anomaly level (step S41). This process is the same as in steps S32 to S33. Next, the anomaly detection unit 16 weights the anomaly detection result using the MT method and the anomaly level using the estimation method (step S42). The anomaly detection unit 16 multiplies the anomaly level (0% or 100%) calculated in the anomaly detection using the MT method in step S39 by the weight of the MT method obtained in step S40 (for example, 40%). Furthermore, the anomaly detection unit 16 calculates the final anomaly level by summing the anomaly level calculated in step S41 in the same manner as in step S33 (in the case of (c) MT method + estimation method, a value is set that considers a weight of 60% for the estimation method in the weighting according to the number of signals) with the anomaly level calculated by the MT method by multiplying the anomaly detection result using the MT method in step S39 (i.e., anomaly level of 0% or 100%) by the weight. Next, the anomaly detection unit 16 compares the calculated anomaly level with the threshold value of the anomaly detection condition file (Figure 7). If the calculated anomaly level is greater than or equal to the threshold value, plant 1 is determined to be abnormal; if it is less than the threshold value, plant 1 is determined to be normal. If an anomaly is determined (step S43; Yes), the anomaly notification unit 17 notifies an alarm related to the anomaly (step S44). The anomaly detection unit 16 records the anomaly determination result in the storage unit 18 (step S45).

(effect)
As explained above, according to this embodiment, when detecting anomalies in Plant 1 using the estimation method, the anomaly level is calculated according to the number of signals determined to be abnormal, and this anomaly level is compared with a threshold to determine if Plant 1 is abnormal. For example, if the monitored signals include many signals with large variability, the anomaly level can be set to a high value when most signals show abnormalities, and to a low value when only a few signals show abnormalities, thereby suppressing false detections caused by the magnitude of signal variability. Also, when the signal variability is small, even when a relatively small number of signals show abnormalities, the anomaly level can be set to, for example, a medium or higher, to expect rapid (highly sensitive) anomaly detection. Furthermore, according to this embodiment, the MT method and the estimation method can be combined, so an improvement in anomaly detection capability can be expected by detecting anomalies using different methods. Also, since weights can be set for each method, the sensitivity of anomaly detection can be optimized by appropriately setting the weights. In addition, in step S3 of Figure 2, the signals used for anomaly determination in the estimation method can be narrowed down. This function provides the following effects. For example, in a model consisting of three signals, signal A, signal B, and signal C, it is known that signals B and C are necessary to estimate the value of signal A. However, due to the mechanism of the equipment, signals B and C may not be able to be estimated using the signals in this model. In such cases, by setting only signal A in step S3, signals B and C can be excluded from the anomaly detection target by the estimation method, thereby preventing false detections. Furthermore, according to this embodiment, the results detected as anomalies are collected and stored in a database. This allows for smooth response to anomalies while preventing false detections.

(c) Regarding the MT method + estimation method, in the explanation of step S42 above, the example given was that the user considers the magnitude of the remaining weight when the whole is considered as 100% based on the weighting for the MT method (40% in the above example), and sets the values in setting fields 104b to 106b so that the sum of the values entered in setting fields 104b to 106b becomes the magnitude considered (60% in the above example). However, the embodiment is not limited to this. For example, similar to the estimation method (b), the user sets values in each of the setting fields 104b to 106b so that the sum of the values entered in each field is 100%. The anomaly detection unit 16 then calculates the anomaly level of the estimation method based on the number of signals exceeding the deviation threshold and the anomaly detection information related to the signals (values in setting fields 104a to 106a and setting fields 104b to 106b). This anomaly level is then multiplied by a weight of 60% for the estimation method to calculate the final anomaly level of the estimation method. This final anomaly level is then calculated by adding this value to the anomaly level of the MT method, which is calculated by multiplying it by the weight. Furthermore, if a weight of 40% is set for the MT method, a value other than 60% may be set for the weight of the estimation method, and a threshold for the final anomaly level may be set in setting field 107 corresponding to the weight of 40% for the MT method and a weight other than 60% for the estimation method.

Furthermore, in the other device 3, the user may have previously entered setting information via the input/output unit 31, specifying the types of abnormalities to be notified (for example, the type and level of the abnormality) and what kind of information to notify regarding the abnormalities to be notified. In this case, the setting unit 32 records the entered setting information in the storage unit 34. For example, the storage unit 34 may store setting information such as, "Notify if signals A and B are included in the signal determined to be abnormal (example of setting the type of abnormality)," "Notify if the abnormality level is XX or higher (example of setting the abnormality level)," and "Display the plant name, the time of occurrence of the abnormality, and the abnormality level (example of setting what kind of information to notify)." Then, when an alarm related to an abnormality is output from the abnormality notification unit 17 (steps S27, S35, S44), the input/output unit 31 of the other device 3 acquires the information related to that abnormality, and the notification unit 33 determines whether the acquired information related to the abnormality includes an abnormality to be notified based on the setting information recorded in the storage unit 34. If it includes an abnormality to be notified, the notification unit 33 notifies that an abnormality to be notified has occurred. For example, the notification unit 33 displays the time of the anomaly, the type of signal determined to be an anomaly, and the anomaly level on the display device.

<Second Embodiment>
Next, as a second embodiment, a function that automates the setting of thresholds and abnormality levels added according to the number of signals in the MT method and estimation method will be described with reference to Figures 10 to 11.
Figure 10 is a flowchart showing an example of the modeling process according to the second embodiment.
The processes other than steps S9A, S10A, and S12A are the same as in the first embodiment and will be briefly explained. First, the user selects the signals to build the model (step S1) and sets the anomaly detection method (step S2). Next, the user selects the signals to be used for the estimation method (step S3) and sets the execution conditions for the anomaly detection method (step S4). Furthermore, the user sets the data to be used to build the model (step S5) and sets the upper and lower limits of the signals (step S6). Next, the user performs sampling on the training data (step S7) and checks the histogram and correlation diagram drawn by the setting unit 14 in step S8. The user repeats the processes in steps S5 to S8 as needed to select appropriate training data. Next, the learning unit 15 learns the training data and builds a model (step S14). For example, the learning unit 15 builds a unit space with respect to the MT method. Regarding the estimation method, the learning unit 15 builds an estimation model based on the estimation method set in step S2 and the explanatory and target variables set in step S3.

Next, the setting unit 14 automatically sets the abnormality detection conditions for the MT method (step S9A). The setting unit 14 also automatically sets the MD threshold for the MT method. For example, the setting unit 14 applies the training data (training data used to build the model) to the model (unit space) constructed in step S14 and calculates the MD value. This provides time-series data of MD values for the time-series data of the signal. The setting unit 14 calculates the mean and standard deviation of the time-series MD values and calculates x such that the highest MD value falls within the threshold xσ. Here, σ is the standard deviation of the time-series data. For example, when x=1, 68% of the data falls within the 1σ interval; when x=2, 95% of the data falls within the 2σ interval; and when x=3, 99.7% of the data falls within the 3σ interval. For example, if the largest value in the time-series data of MD values is greater than (MD mean + 2 × MD standard deviation) and less than (MD mean + 3 × MD standard deviation), the setting unit 14 sets the MD value threshold to 3σ. Note that when inputting training data into the model, it is also possible to input other normal data instead of the training data used to construct the unit space. This also applies to steps S10A and S12A.

Next, the setting unit 14 automatically sets the anomaly detection conditions for the estimation method (step S10A). The setting unit 14 automatically sets the deviation threshold for each signal. For example, the setting unit 14 applies the training data (the training data used to build the model) to the estimation model constructed in step S14 and calculates the deviation between the time-series data of the estimated values from the estimation model and the time-series data of the measured values included in the training data at the same time. This yields time-series data of the deviation between the estimated and measured values. The setting unit 14 sets the deviation threshold at xσ (mean deviation + x × standard deviation of deviation) so that the largest deviation fluctuation is kept within the threshold. For example, if the largest deviation in the time-series data of deviations is greater than (mean deviation + 2 × standard deviation of deviation) and less than (mean deviation + 3 × standard deviation of deviation), the setting unit 14 sets the deviation threshold to 3σ.

Next, the user sets the distribution of anomaly levels to be added for the configured anomaly detection method (step S11).

Next, the setting unit 14 automatically sets three patterns of abnormality levels to be added to the estimation method settings according to the number of signals that exceed the deviation threshold (step S12A). For example, the setting unit 14 calculates the standard deviation for the time-series data of the deviation between the measured value and the estimated value of each signal. Based on a predetermined threshold, the setting unit 14 classifies the standard deviation calculated for each signal into two groups: one group with a large variation in the standard deviation value (above the threshold) and another group with a standard deviation value (below the threshold). If there are more signals classified into the group with a large standard deviation, the setting unit 14 automatically sets three patterns of abnormality levels, for example, as follows: That is, the setting unit 14 sets (1) 20% of all signals exceed the deviation threshold, (2) 40% of all signals exceed the deviation threshold, and (3) 40% of all signals exceed the deviation threshold. Also, if there are more signals in the group with a small standard deviation, the setting unit 14 automatically sets three patterns of abnormality levels, for example, as follows. Specifically, the setting unit 14 sets the following: (1) 40% if one signal exceeds the deviation threshold, (2) 40% if 30% of all signals exceed the deviation threshold, and (3) 20% if 60% of all signals exceed the deviation threshold.

Furthermore, the setting unit 14 may perform three patterns of automatic setting as follows. First, the automatic setting of the number of signals will be explained. With a deviation threshold of 3σ, the setting unit 14 applies the training data to the estimation model and calculates the deviation between the estimated value obtained by inputting the training data into the estimation model and the actual measured value included in the training data for each signal and for each data point (each point in the time series). For each signal, the setting unit 14 determines whether the number of data points whose calculated deviation exceeds the deviation threshold exceeds 0.3% of the total number of points. If the percentage of data points whose deviation exceeds the deviation threshold exceeds 0.3%, the setting unit 14 sets the number of signals exceeding 0.3% in (1) and sets the remaining number of signals to values that are equally distributed in (2) and (3). If the number of signals is odd, (2) is allocated one more signal (rounding up the fraction). For example, if the total number of signals is 10, and for 5 of those signals, the deviation between the estimated value and the measured value exceeds the deviation threshold of 3σ, then the setting unit 14 sets the number of signals to 5 for (1), 3 for (2), and 2 for (3).

The basis for the 0.3% figure is based on the concept of 3σ. When ±3σ is used as a threshold for normally distributed data, 99.7% of the data falls within the threshold, while the remaining 0.3% falls outside the threshold. Therefore, signals where the number of data points exceeding the threshold exceeds 0.3% of the total data points can be considered signals with many outliers (signals with large fluctuations) even in normal training data. Such signals can lead to an increase in false positives in practical operation; therefore, setting it as (1) suppresses false positives.

Next, we will explain the abnormality levels to be set for (1) to (3). Regarding the automatically allocated weights, for example, the setting unit 14 sets the following for (b) the estimation method: (1) 40%, (2) 40%, (3) 20%. For (c) the MT method + estimation method, it sets the following: (1) 10%, (2) 25%, (3) 25%. In all cases, for the weighting of (1), the abnormality level set when the number of signals exceeding the deviation threshold (where the deviation between the estimated and measured values is greater than or equal to the number of signals in (1) but less than the number of signals in (2)) takes into account the possibility of false detection.

For example, in estimation method (b), if two out of five signals exceed 0.3%, then the number of signals in (1) is two and the anomaly level is 40%, the number of signals in (2) is two and the anomaly level is 40%, and the number of signals in (3) is one and the anomaly level is 20%.

For example, in (c) the MT method + estimation method, if 40% is allocated to the MT method and the remaining 60% to the estimation method, and three of the nine signals exceed 0.3%, then the number of signals in (1) is 3, resulting in 10%, the number of signals in (2) is 3, resulting in 25%, and the number of signals in (3) is 3, resulting in 25%.

Furthermore, the setting unit 14 may generate a suggested distribution pattern screen as illustrated in Figure 11 and output it to the display device 2. For example, by default, settings for abnormality levels are prepared as follows: Pattern A: (1) 40%, (2) 40%, (3) 20%; Pattern B: (1) 20%, (2) 20%, (3) 60%; Pattern C: (1) 60%, (2) 20%, (3) 20%. Then, after applying the training data to the model, if the total signal exceeds 0.3%, the setting unit 14 arranges the above distribution patterns in the recommended order (Pattern B being the most recommended distribution pattern) in the order of Pattern B → Pattern A → Pattern C. If the total signal is less than 0.3%, the setting unit 14 arranges the above distribution patterns in the recommended order (Pattern C being the most recommended distribution pattern) in the order of Pattern C → Pattern A → Pattern B, generates a suggested distribution screen 300 as illustrated in Figure 11, and displays it on the display device 2. Then, the user selects a distribution pattern from the three patterns listed in order of recommendation and clicks the OK button. The percentages specified by the selected distribution pattern are then automatically entered into the settings fields 104b to 1016b on the settings screen.

Next, the user sets the anomaly level threshold that triggers the model to issue a warning (step S13). Then, the user validates the configured anomaly detection method, training data, and anomaly detection conditions (step S15). Once validated in step S15, the validated model is deployed to the actual monitoring environment (step S16).

(effect)
As described above, according to the second embodiment, in addition to the effects of the first embodiment, the threshold in the MT method and estimation method, the number of signals to be added according to the number of signals, and the abnormality level can be set automatically.

Figure 12 shows an example of the hardware configuration of an anomaly detection system according to each embodiment. The computer 900 includes a CPU 901, main memory 902, auxiliary storage 903, input/output interface 904, and communication interface 905. The anomaly detection device 10 and other devices 3 described above are implemented in the computer 900. The functions described above are stored in the auxiliary storage 903 in program form. The CPU 901 reads the program from the auxiliary storage 903, loads it into the main memory 902, and executes the above processing according to the program. The CPU 901 also allocates storage space in the main memory 902 according to the program. Furthermore, the CPU 901 allocates storage space in the auxiliary storage 903 to store data being processed, according to the program.

A program to implement all or part of the functions of the anomaly detection device 10 and other devices 3 may be recorded on a computer-readable recording medium, and the program recorded on this recording medium may be loaded into a computer system and executed to perform processing by each functional unit. Here, "computer system" includes hardware such as the OS and peripheral devices. Furthermore, if a WWW system is used, "computer system" also includes the homepage provisioning environment (or display environment). "Computer-readable recording medium" refers to portable media such as CDs, DVDs, USBs, and storage devices such as hard disks built into the computer system. Also, if this program is distributed to computer 900 via a communication line, computer 900 may load the program into main memory 902 and execute the above processing. Furthermore, the above program may only implement some of the functions described above, and may also be able to implement the above functions in combination with programs already recorded in the computer system.

As described above, several embodiments relating to this disclosure have been explained. These embodiments are presented as examples only and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included within the scope and spirit of the invention, as well as within the scope of the claims and its equivalents.

<Note>
The anomaly detection device, anomaly detection system, anomaly detection method, and program described in the embodiment can be understood, for example, as follows:

(1) The abnormality detection device 10 according to the first embodiment includes a signal acquisition unit 11 that acquires a plurality of signals indicating the state of the plant, a setting unit 14 that sets an abnormality level (weighting) according to the number of signals whose values are outside the allowable range (the range of a deviation threshold (e.g., 3σ) centered on the estimated value by the estimation model) among the plurality of signals, and an abnormality determination unit 16 that compares the plurality of signals with the allowable range determined for each of the signals, calculates the number of signals that are outside the allowable range, calculates an abnormality level according to the calculated number of signals based on the number of signals and the setting of the abnormality level, and determines an abnormality in the plant based on the calculated abnormality level.
This allows for setting an abnormality level based on the number of abnormal signals, and by determining whether a signal is abnormal based on this level, it is possible to suppress false detections, such as when a signal with large fluctuations happens to become abnormal.

(2) The abnormality detection device 10 according to the second embodiment is the abnormality detection device 10 of (1), wherein if the abnormality level is the first abnormality level, the setting unit 14 further sets a first weighting which is a weighting for the first abnormality level and a second weighting which is a weighting for the degree of abnormality of the plant (for example, MT method 40%) calculated by a determination model (unit space of the MT method) that determines the abnormality of the plant based on at least a part of the plurality of signals, and the abnormality determination unit further calculates the second abnormality level based on the determination model, and determines the abnormality of the plant based on the sum of the value obtained by multiplying the first abnormality level by the first weighting and the value obtained by multiplying the second abnormality level by the weighting.
This allows anomaly detection to be performed using multiple models, and by setting weights for each model, it is possible to specify which model's anomaly detection should be given more importance.

(3) The abnormality detection device 10 according to the third embodiment is the abnormality detection device 10 of (2), wherein the setting unit sets whether to determine an abnormality in the plant based on the first abnormality level, or based on the first abnormality level and the second abnormality level, or based on the second abnormality level, and the abnormality determination unit determines an abnormality in the plant based on the first abnormality level if it is set to determine an abnormality in the plant based on the first abnormality level, determines an abnormality in the plant based on the first abnormality level and the second abnormality level if it is set to determine an abnormality in the plant based on the first abnormality level and the second abnormality level, and determines an abnormality in the plant based on the second abnormality level.
This allows for anomaly detection to be performed using, for example, (a) the MT method, (b) an estimation method, or (c) the MT method plus an estimation method.

(4) The anomaly detection device 10 according to the fourth embodiment is the anomaly detection device 10 according to (1) to (3), further comprising a learning unit which constructs an estimation model which uses a part of the plurality of signals as explanatory variables and one of the plurality of signals as an objective variable, and estimates the value of the variable set as the objective variable from the signal set as the explanatory variable, and the setting unit which sets the signal to be used as the explanatory variable and the signal to be used as the objective variable.
This allows you to configure which signals are used to determine anomalies and which signals are used to estimate the signals used for anomaly determination. For example, it can prevent situations where signals with low estimation accuracy are used for estimation.

(5) The abnormality detection device 10 according to the fifth embodiment is the abnormality detection device 10 of (1) to (4), further comprising an abnormality notification unit that notifies the abnormality determination result of the abnormality determination unit of the plant, wherein the abnormality determination unit records the determination result in a storage unit, and the abnormality notification unit reads the determination result from the storage unit and outputs the determination result.
This allows for the retrieval of past anomalies, enabling smoother responses to detected anomalies.

(6) The anomaly detection device 10 according to the sixth embodiment is the anomaly detection device 10 of (2) to (5), wherein the setting unit calculates the threshold of the second anomaly level based on the standard deviation of the second anomaly level calculated by the judgment model when a plurality of learning data used to construct the judgment model are input to the judgment model, and calculates α such that the maximum value of the calculated second anomaly level is included in (the average value of the calculated second anomaly level + α × the standard deviation of the calculated second anomaly level), and calculates the threshold of the second anomaly level by (the calculated α × the standard deviation of the calculated second anomaly level).
This allows the threshold (MD threshold) of the judgment model (MT method) to be set automatically.

(7) The anomaly detection device 10 according to the seventh embodiment is the anomaly detection device 10 of (1) to (6), wherein the setting unit calculates the magnitude of the tolerance range based on the standard deviation of the difference between the estimated value of the signal estimated by the estimation model and the measured value of the signal when a plurality of learning data used to construct the estimation model are input to a predetermined estimation model, and calculates β such that the maximum value of the deviation is included in (mean value of the deviation + β × standard deviation of the deviation), and calculates it by (calculated β × standard deviation of the deviation).
This allows the threshold signal used for anomaly detection (the deviation threshold in the setting field 102 of the setting screen 100) to be set automatically.

(8) The anomaly detection device 10 according to the eighth aspect is the anomaly detection device 10 of (1) to (7), wherein the setting unit calculates the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal for each of the plurality of signals, classifies the plurality of signals into signals whose standard deviation of the deviation is greater than or equal to a predetermined threshold and signals whose standard deviation is less than the threshold, and sets a smaller anomaly level for the same number of signals when the number of signals greater than or equal to the threshold is greater than the number of signals whose standard deviation is less than the threshold.
This allows the distribution pattern of abnormal signal levels (the values in setting fields 104b to 106b on the setting screen 100) to be set automatically.

(9) The anomaly detection device 10 according to the ninth embodiment is the anomaly detection device 10 according to (1) to (8), wherein the setting unit inputs learning data having multiple data points for multiple signals used to construct the estimation model into a predetermined estimation model, and determines for each signal whether the percentage of data points whose deviation exceeds a predetermined second threshold (3σ) exceeds a predetermined value (0.3%) based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, calculates the number of signals that exceed the predetermined value, sets the calculated number of signals as the first number of signals which is the number of signals which is outside the first acceptable range, divides the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals equally and rounds up the fractional part, sets the second number of signals which is the number of signals which is outside the second acceptable range, and sets the anomaly level when the number of signals which is outside the acceptable range is equal to or greater than the first number of signals and less than the second number of signals, a predetermined value determined considering the possibility that an anomaly in the plant may be falsely detected.
This allows the distribution pattern of abnormal signal levels (the values in setting fields 104a and 104b on the setting screen 100) to be set automatically.

(10) An anomaly detection system 20 according to the tenth embodiment includes an anomaly detection device 10 as described in any of (1) to (9), and a notification device (other device 3), the notification device comprising: an acquisition unit (input/output unit 31) that acquires information relating to an anomaly detected by the anomaly detection device; a setting unit 32 that accepts the setting of an anomaly to be notified; and a notification unit 33 that notifies the anomaly to be notified when the information relating to the anomaly acquired by the acquisition unit includes the anomaly to be notified.
By configuring which types of anomalies should be included in notifications, it is possible to receive notifications when desired anomalies occur.

(11) An abnormality detection method according to the eleventh embodiment includes the steps of: acquiring a plurality of signals indicating the state of the plant; setting an abnormality level corresponding to the number of signals whose values are outside the permissible range; comparing the plurality of signals with the permissible range defined for each of the signals to calculate the number of signals that are outside the permissible range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level.

(12) The anomaly detection method according to the twelfth embodiment is the anomaly detection method of (11), further comprising: a step of determining an anomaly in the plant, a step of acquiring information relating to the anomaly when the plant is determined to be abnormal; a step of accepting the setting of an anomaly to be notified; and a step of notifying the anomaly to be notified when the information relating to the anomaly acquired in the step of acquiring the information relating to the anomaly includes the anomaly to be notified.

(13) The program according to the 13th embodiment causes the computer to perform the following steps: acquire a plurality of signals indicating the status of the plant; set an abnormality level corresponding to the number of signals whose values are outside the acceptable range; compare the plurality of signals with the acceptable range defined for each of the signals to calculate the number of signals that are outside the acceptable range; calculate the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determine an abnormality in the plant based on the calculated abnormality level.

10... Anomaly detection device 11... Signal acquisition unit 12... Input reception unit 13... Control unit 14... Setting unit 15... Learning unit 16... Anomaly determination unit 17... Anomaly notification unit 18... Storage unit 20... Anomaly detection system 2... Display device 3... Other device 31... Input/output unit 32... Setting unit 33... Notification unit 34... Storage unit 900... Computer 901... CPU
902... Main memory 903... Auxiliary memory 904... Input/output interface 905... Communication interface

Claims (17)

A signal acquisition unit that acquires multiple signals indicating the status of the plant,
A setting unit sets an abnormality level corresponding to the number of signals whose values are outside the acceptable range among the aforementioned plurality of signals,
An abnormality determination unit that compares the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range, calculates the abnormality level corresponding to the calculated number of signals based on the number of signals and the setting of the abnormality level, and determines an abnormality in the plant based on the calculated abnormality level,
It has,
The setting unit calculates the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal for each of the plurality of signals, classifies the plurality of signals into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold, and sets a smaller abnormality level for the same number of signals compared to the case where the number of signals greater than or equal to the first threshold is less than the number of signals whose standard deviation is less than the first threshold.
Anomaly detection device. A signal acquisition unit that acquires multiple signals indicating the status of the plant,
A setting unit sets an abnormality level corresponding to the number of signals whose values are outside the acceptable range among the aforementioned plurality of signals,
An abnormality determination unit that compares the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range, calculates the abnormality level corresponding to the calculated number of signals based on the number of signals and the setting of the abnormality level, and determines an abnormality in the plant based on the calculated abnormality level,
It has,
The setting unit, upon inputting learning data having multiple data points for multiple signals used to construct the estimation model into a predetermined estimation model, determines for each signal whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, calculates the number of signals that exceed the predetermined value, sets the calculated number of signals as the first number of signals which is outside the first acceptable range, divides the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals equally and rounds up the fractional part, sets the second number of signals which is outside the second acceptable range, and sets the abnormality level, which is determined considering the possibility of false detection of an abnormality in the plant, when the number of signals which is outside the acceptable range is equal to or greater than the first number of signals and less than the second number of signals, to a predetermined value.
Anomaly detection device. A signal acquisition unit that acquires multiple signals indicating the status of the plant,
A setting unit sets the correspondence between the range of the number of signals whose values are outside the acceptable range and the abnormal level among the aforementioned plurality of signals,
An abnormality determination unit that compares the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range, calculates the abnormality level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of signals that fall outside the tolerance range and the abnormality level, and determines an abnormality in the plant based on the calculated abnormality level,
It has,
The correspondence between the range of the number of signals that fall outside the acceptable range and the abnormality level is set according to how many of the multiple signals have a large variation in value, and the abnormality level set in the correspondence is a weighting of how likely it is that the values of the number of signals included in the range fall outside the acceptable range, indicating that the plant is in an abnormal state.
In the case where a predetermined number of the aforementioned multiple signals have a large variation,
When comparing the case in which no signal with a large variation is included among the aforementioned multiple signals,
For the range of the aforementioned predetermined number or less,
A higher abnormality level is set when there are no signals with large variations than when there are a predetermined number of signals with large variations.
Anomaly detection device. If the aforementioned abnormality level is referred to as the first abnormality level,
The setting unit further sets a first weighting, which is a weighting for the first abnormality level, and a second weighting, which is a weighting for the second abnormality level, which indicates the degree of abnormality in the plant calculated by a determination model that determines the abnormality of the plant based on at least a portion of the plurality of signals.
The abnormality determination unit further calculates the second abnormality level based on the determination model, and determines an abnormality in the plant based on the sum of the value obtained by multiplying the first abnormality level by the first weighting and the value obtained by multiplying the second abnormality level by the second weighting.
An anomaly detection device according to any one of claims 1 to 3 . The setting unit sets whether to determine an abnormality in the plant based on the first abnormality level, based on the first abnormality level and the second abnormality level, or based on the second abnormality level.
The abnormality determination unit,
If it is set to determine an abnormality in the plant based on the first abnormality level, then the abnormality in the plant is determined based on the first abnormality level.
If it is set to determine the abnormality of the plant based on the first abnormality level and the second abnormality level, the abnormality of the plant is determined based on the first abnormality level and the second abnormality level,
If it is set to determine the abnormality of the plant based on the second abnormality level, then the abnormality of the plant is determined based on the second abnormality level.
An anomaly detection device according to claim 4 . The system further includes a learning unit that constructs an estimation model in which some of the aforementioned multiple signals are used as explanatory variables and one of the aforementioned multiple signals is used as the objective variable, and estimates the value of the signal set as the objective variable from the signals set as the explanatory variables,
The setting unit sets the signal to be used as the explanatory variable and the signal to be used as the objective variable.
An anomaly detection device according to any one of claims 1 to 5 . An abnormality notification unit outputs the abnormality determination result of the abnormality determination unit for the plant.
It further possesses,
The abnormality determination unit records the determination result in the storage unit.
The abnormality notification unit reads the determination result from the storage unit and displays the determination result in chronological order.
An anomaly detection device according to any one of claims 1 to 6 . The setting unit calculates the threshold of the second abnormal level based on the standard deviation of the second abnormal level calculated by the judgment model when a plurality of training data used to construct the judgment model are input to the judgment model. The setting unit calculates α such that the maximum value of the calculated second abnormal level is included in (the average value of the calculated second abnormal level + α × the standard deviation of the calculated second abnormal level), and calculates the threshold by (the calculated α × the standard deviation of the calculated second abnormal level).
An anomaly detection device according to claim 4 . The setting unit calculates the magnitude of the tolerance range based on the standard deviation of the difference between the estimated value of the signal estimated by the estimation model and the measured value of the signal when a plurality of training data used to construct the estimation model are input to a predetermined estimation model. The setting unit calculates β such that the maximum value of the deviation is included in (mean value of the deviation + β × standard deviation of the deviation), and calculates the magnitude of the tolerance range by (calculated β × standard deviation of the deviation).
An anomaly detection device according to any one of claims 1 to 8 . An anomaly detection device according to any one of claims 1 to 9 ,
Includes a notification device,
The notification device is
An acquisition unit that acquires information related to the abnormality detected by the abnormality detection device,
A setting unit that accepts settings for abnormalities to be notified,
If the information relating to the abnormality acquired by the acquisition unit includes the abnormality to be notified, the notification unit notifies the abnormality to be notified,
An anomaly detection system equipped with the following features. The steps include acquiring multiple signals that indicate the status of the plant,
The steps include setting an abnormality level corresponding to the number of signals whose values are outside the acceptable range among the aforementioned plurality of signals,
The steps include: comparing the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level.
It has,
In the setting step, for each of the plurality of signals, the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal is calculated, and the plurality of signals are classified into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold, and if the number of signals whose standard deviation is greater than or equal to the first threshold is greater than or equal to the first threshold is greater than or equal to the first threshold is greater than or equal to the first threshold is less than or equal to the first threshold, a smaller abnormality level is set for the same number of signals.
Anomaly detection method. The steps include acquiring multiple signals that indicate the status of the plant,
The steps include setting an abnormality level corresponding to the number of signals whose values are outside the acceptable range among the aforementioned plurality of signals,
The steps include: comparing the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level.
It has,
In the setting step, when a predetermined estimation model is input to a predetermined estimation model, learning data having multiple data points for multiple signals used to construct the estimation model is used to determine whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, for each signal, the number of signals that exceed the predetermined value is calculated, and the calculated number of signals is set as the first number of signals which is the number of signals outside the first acceptable range, and the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals is divided equally and rounded up is set as the second number of signals which is the number of signals outside the second acceptable range, and when the number of signals outside the acceptable range is equal to or greater than the first number of signals and less than the second number of signals, a predetermined value is set as the abnormality level, taking into consideration the possibility that an abnormality in the plant may be being falsely detected.
Anomaly detection method. The steps include acquiring multiple signals that indicate the status of the plant,
The steps include setting a correspondence between the number of signals whose values are outside the acceptable range and the abnormality level among the aforementioned plurality of signals,
The steps include: comparing the plurality of signals with the tolerance range defined for each signal to calculate the number of signals that fall outside the tolerance range; calculating the abnormal level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of signals that fall outside the tolerance range and the abnormal level; and determining an abnormality in the plant based on the calculated abnormal level.
It has,
The correspondence between the range of the number of signals that fall outside the acceptable range and the abnormality level is set according to how many of the multiple signals have a large variation in value, and the abnormality level set in the correspondence is a weighting of how likely it is that the values of the number of signals included in the range fall outside the acceptable range, indicating that the plant is in an abnormal state.
In the case where a predetermined number of the aforementioned multiple signals have a large variation,
When comparing the case in which no signal with a large variation is included among the aforementioned multiple signals,
For the range of the aforementioned predetermined number or less,
A higher abnormality level is set when there are no signals with large variations than when there are a predetermined number of signals with large variations.
Anomaly detection method. In the step of determining an abnormality in the plant, if the plant is determined to be abnormal, the step of obtaining information related to the abnormality,
A step to accept the setting of anomalies to be notified,
If the information relating to the abnormality obtained in the step of obtaining the information relating to the abnormality includes the abnormality to be notified, the step of notifying the abnormality to be notified,
An anomaly detection method according to any one of claims 11 to 13 , further comprising the above. On the computer,
The steps include acquiring multiple signals that indicate the status of the plant,
The steps include setting an abnormality level corresponding to the number of signals whose values are outside the acceptable range among the aforementioned plurality of signals,
The steps include: comparing the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level.
It has,
In the setting step, for each of the multiple signals, the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal is calculated, and the multiple signals are classified into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold, and when the number of signals whose standard deviation is greater than or equal to the first threshold is greater than or equal to the number of signals whose standard deviation is less than the first threshold, a process is performed to set a smaller abnormality level for the same number of signals compared to when the number of signals whose standard deviation is greater than or equal to the first threshold is less than or equal to the first threshold.
A program that executes the command. On the computer,
The steps include acquiring multiple signals that indicate the status of the plant,
The steps include setting an abnormality level corresponding to the number of signals whose values are outside the acceptable range among the aforementioned plurality of signals,
The steps include: comparing the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level.
It has,
In the setting step, when learning data having multiple data points for multiple signals used to construct the estimation model is input to a predetermined estimation model, it is determined for each signal whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, the number of signals that exceed the predetermined value is calculated, the calculated number of signals is set as the first number of signals which is outside the first acceptable range, the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals is divided equally and rounded up is set as the second number of signals which is outside the second acceptable range, and when the number of signals which is outside the acceptable range is equal to or greater than the first number of signals and less than the second number of signals, a predetermined value is set for the abnormality level, taking into consideration the possibility that the abnormality of the plant may be being falsely detected.
A program that executes the command. On the computer,
The steps include acquiring multiple signals that indicate the status of the plant,
The steps include setting a correspondence between the number of signals whose values are outside the acceptable range and the abnormality level among the aforementioned plurality of signals,
The steps include: comparing the plurality of signals with the tolerance range defined for each signal to calculate the number of signals that fall outside the tolerance range; calculating the abnormal level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of signals that fall outside the tolerance range and the abnormal level; and determining an abnormality in the plant based on the calculated abnormal level.
It has,
The correspondence between the range of the number of signals that fall outside the acceptable range and the abnormality level is set according to how many of the multiple signals have a large variation in value, and the abnormality level set in the correspondence is a weighting of how likely it is that the values of the number of signals included in the range fall outside the acceptable range, indicating that the plant is in an abnormal state.
In the case where a predetermined number of the aforementioned multiple signals have a large variation,
When comparing the case in which no signal with a large variation is included among the aforementioned multiple signals,
For the range of the aforementioned predetermined number or less,
A process in which a higher abnormality level is set when there are no signals with large variations than when there are a predetermined number of signals with large variations.
A program that executes the command.