Anomaly detection device, anomaly detection program, and learning device

Abstract

To improve a technology to detect an abnormality in a plant.SOLUTION: An abnormality detection device 10 comprises: a process value acquiring unit that during operation of a plant 3 equipped with a plurality of devices, acquires a process value of at least one monitoring target device 5 among the plurality of devices; a command value acquisition unit that acquires a command value of a control operation amount for controlling the monitoring target device 5; and an abnormality detection unit that detects an abnormality in the monitoring target device 5 based on a relation between a variation range of the process value acquired by the process value acquisition unit in a predetermined period and a variation range of the command value acquired by the command value acquisition unit.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an anomaly detection device, an anomaly detection program, and a learning device that detect anomalies in a plant. [Background technology]

[0002] Technologies for monitoring changes in the state of a plant have been proposed. For example, Patent Document 1 discloses a technology in which process values ​​inputted from a plant every moment are converted into time-series process data, stored, and a plurality of process data within a predetermined inspection section are statistically processed to detect a change trend of the process values. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2002-278621 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, a plant is usually composed of many control systems, and an abnormality in one control system may affect the other control systems. In this case, it is difficult to detect the abnormality by individually monitoring the process value (PV), target value (SP), or controlled variable (MV) of each control system.

[0005] An object of the present disclosure is to improve techniques for detecting abnormalities in plants. [Means for solving the problem]

[0006] In order to solve the above problems, an abnormality detection device according to one aspect of the present disclosure includes a process value acquisition unit that acquires a process value of at least one of the monitored devices during operation of a plant including the multiple devices, a command value acquisition unit that acquires a command value of a control manipulation variable for controlling the monitored device, and an abnormality detection unit that detects an abnormality in the monitored device based on the relationship between the fluctuation range of the process value acquired by the process value acquisition unit over a specified period and the fluctuation range of the command value acquired by the command value acquisition unit.

[0007] Another aspect of the present disclosure is an anomaly detection program that causes a computer to function as a process value acquisition unit that acquires a process value of at least one of the plurality of devices to be monitored during operation of a plant including the plurality of devices, a command value acquisition unit that acquires a command value of a control manipulated variable for controlling the monitored device, and an anomaly detection unit that detects an anomaly in the monitored device based on a relationship between a fluctuation range of the process value acquired by the process value acquisition unit and a fluctuation range of the command value acquired by the command value acquisition unit during a predetermined period.

[0008] Another aspect of the present disclosure is a learning device comprising: a learning data acquisition unit that acquires, as learning data, a fluctuation range of a process value of at least one of the monitored devices among the plurality of devices, a fluctuation range of a command value of a control manipulated variable for controlling the monitored device, and information indicating a state of the monitored device, which are acquired when a plant including the plurality of devices is operated for a predetermined period of time, and a learning unit that learns, based on the learning data, a detection criterion for detecting an abnormality in the monitored device based on an index relating to a relationship between the fluctuation range of the process value and the fluctuation range of the command value.

[0009] Any combination of the above components, and any transformation of the present invention into a method, device, system, recording medium, computer program, etc., are also effective as aspects of the present invention. Effect of the Invention

[0010] According to the present disclosure, it is possible to improve the technology for detecting anomalies in a plant. [Brief description of the drawings]

[0011] [Figure 1] 1 is a diagram showing an overall configuration of an anomaly detection system according to an embodiment; [Diagram 2] 1 is a diagram illustrating an example of a monitored device monitored by an anomaly detection device according to an embodiment; [Diagram 3] FIG. 2 is a diagram showing an example of time changes of a process value (PV) and a command value (OP). [Figure 4] FIG. 13 is a diagram showing an example of a scatter diagram in which PV and OP values ​​are plotted for a predetermined period. [Diagram 5] FIG. 13 is a diagram showing an example of time-dependent changes in PV, OP, and indices. [Figure 6] 3 is a diagram showing an example of time-dependent changes in PV, OP, and index values ​​of the monitored device shown in FIG. 2. [Figure 7] 3 is a diagram showing an example of time-dependent changes in PV, OP, and index values ​​of the monitored device shown in FIG. 2. [Figure 8] 3 is a diagram showing an example of time-dependent changes in PV, OP, and index values ​​of the monitored device shown in FIG. 2. [Figure 9] FIG. 11 is a diagram illustrating another example of a monitored device monitored by the anomaly detection device according to the embodiment. [Figure 10] 10 is a diagram showing an example of time variations in PV, OP, and index values ​​of the monitored device shown in FIG. 9. [Figure 11] 10 is a diagram showing an example of time variations in PV, OP, and index values ​​of the monitored device shown in FIG. 9. [Figure 12] 10 is a diagram showing an example of time variations in PV, OP, and index values ​​of the monitored device shown in FIG. 9. [Figure 13] FIG. 13 is a diagram showing an example of time changes in PV, OP, and index values ​​when control becomes unstable due to another control system, disturbance, etc. [Figure 14] FIG. 13 is a diagram showing an example of clustering of indexes calculated when a plant is operated. [Figure 15] 11 is a diagram illustrating an example of a change over time in the probability that a monitored device transitions from a normal state to an abnormal state. [Figure 16] FIG. 1 is a diagram showing an example of time changes in indices in a process including multiple control systems. [Figure 17] FIG. 1 is a diagram illustrating a configuration of a learning device according to an embodiment. [Figure 18] 1 is a diagram illustrating a configuration of an anomaly detection device according to an embodiment. [Figure 19] 19(a), (b), and (c) are diagrams showing examples of changes over time in the indices calculated by the anomaly detection device 10. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] 1 shows the overall configuration of an anomaly detection system according to an embodiment. The anomaly detection system 1 includes a plant 3 that executes a process composed of multiple devices, a monitored device 5 that is a monitoring target among the multiple devices provided in the plant 3, a control device 4 that controls the monitored device 5, an anomaly detection device 10 that detects anomalies in the monitored device 5, and a learning device 40 that learns detection criteria used to detect anomalies in the anomaly detection device 10. These devices are connected by the Internet 2, which is an example of a communication means. The communication means may be any communication means other than the Internet 2.

[0013] In a process consisting of a plurality of devices each of which is automatically feedback-controlled independently by a plurality of control devices 4, if the effects of the respective automatic feedback controls can interfere with each other, the effect of an abnormality occurring in one device may propagate to other devices, and the behavior of the entire process may become unstable. The anomaly detection system 1 of this embodiment monitors the monitored device 5 by the anomaly detection device 10 and detects a sign of an abnormality in the monitored device 5, so that it is possible to deal with the abnormality appropriately before it spreads to other devices. All of the plurality of devices may be the monitored device 5, or some of the devices may be the monitored device 5. In the latter case, among the plurality of devices, a specific important device that may cause serious damage or danger if an abnormality occurs may be the monitored device 5. In addition, a device that may induce an abnormality in an important device may be the monitored device 5. The device that may induce an abnormality in an important device may be extracted by a fault tree analysis (FTA) in which an abnormality in an important device is a higher-level event.

[0014] The learning device 40 acquires from the plant 3 operation history data acquired when the plant 3 has been operated for a predetermined period, and learns the detection criteria using the operation history data. The learning device 40 may learn the detection criteria using operation history data acquired from a plurality of plants 3 equipped with the same type of monitored target devices 5. This can improve the efficiency of learning, and therefore the accuracy of the detection criteria can be further improved.

[0015] 2 shows an example of a monitored device 5 monitored by an anomaly detection device 10 according to an embodiment. A valve 6, which is an example of the monitored device 5, is opened and closed to control the flow rate of a fluid flowing through a pipe 7. The opening of the valve 6 is controlled by a flow controller FC, which is an example of a control device 4. The flow controller FC acquires the flow rate of the fluid flowing through the pipe 7 as a process value (PV), calculates a command value (OP) for the opening of the valve 6 by PID control or the like so that the flow rate becomes a set target value (SV), and transmits the command value (OP) to the valve 6.

[0016] FIG. 3 shows an example of the time change of the process value (PV) and the command value (OP). In FIG. 3, the solid line indicates the PV, and the dashed line indicates the OP. In the period up to t1, the PV is maintained almost constant, because the flow controller FC continues to change the OP by feedback control. When the opening of the valve 6 reaches 100% at t1, the opening of the valve 6 cannot be changed any further, and the PV begins to take an abnormal value. In this example, the PV abnormality is detected after t1, but if the fluctuation of the OP as well as the PV is taken into consideration, the signs of the abnormality can be seen before t1. In other words, even before t1, a situation occurred in which the PV could not be maintained constant unless the opening of the valve 6 was continuously changed, and it is considered that some abnormality occurred before the PV actually took an abnormal value. However, if only the PV is monitored as in the past, the abnormality cannot be detected until after t1.

[0017] The anomaly detection system 1 of this embodiment detects a sign of an anomaly before the PV becomes an abnormal value by monitoring not only the PV but also the OP. For example, as shown in the example of FIG. 3, if the OP fluctuates greatly while trying to keep the PV constant, this may be a sign of an anomaly. Also, if the PV fluctuates greatly even though the OP is almost constant, this may be a sign of an anomaly. In contrast, when trying to change the PV under normal control, both the PV and the OP may fluctuate at the same time. Therefore, the anomaly detection system 1 of this embodiment detects an anomaly based on the relationship between the fluctuation range of the PV and the fluctuation range of the OP.

[0018] FIG. 4 shows an example of a scatter diagram in which values ​​of PV and OP in a predetermined period are plotted. In FIG. 4, OP is normalized so that the range is 0 to 100, and PV is normalized so that the minimum value of the set range of the distributed control system (DCS) is 0 and the maximum value is 100 and plotted. In the anomaly detection system 1 of the present embodiment, the length L of the diagonal of the smallest rectangle (plot area) that covers each point plotted in the scatter diagram and the angle θ between the diagonal and the horizontal axis are used as indices for detecting anomalies. This index corresponds to the magnitude and inclination of a vector whose components are the fluctuation range of PV and the fluctuation range of OP in a predetermined period. The index used by the anomaly detection device 10 to detect anomalies may be one or both of the length L of the diagonal and the angle θ, or may be a value calculated based on one or both of the length L of the diagonal and the angle θ. The index may also be the area or shape of the plot area, or a statistical value calculated by a statistical method from the values ​​of PV and OP.

[0019] Fig. 5 shows an example of time changes of PV, OP, and indexes. The index at time t is calculated from the fluctuation range of PV and OP in a predetermined period immediately before time t. Similarly, the index at time t-1 is calculated from the fluctuation range of PV and OP in a predetermined period immediately before time t-1. In this way, by calculating the index periodically at a predetermined timing, for example at a predetermined time interval, and monitoring the value, an abnormality can be detected quickly.

[0020] FIG. 6 shows an example of time variations in the PV, OP, and index value of the monitored device 5 shown in FIG. 2. In the period T1-T2, the process state is stable, and the fluctuation range of the PV and the fluctuation range of the OP are small. Therefore, the plot area is shaped like a small square, so the length L of the diagonal is short and the angle θ is close to 45°. In the period T3-T4, for example, a blockage occurs downstream and the flow rate is lower than normal. When such an abnormality occurs, it is necessary to increase the opening of the valve 6 in order to maintain the flow rate constant, so the fluctuation range of the PV remains small, but the fluctuation range of the OP becomes large. Therefore, the plot area is shaped like a horizontally long rectangle, so the length L of the diagonal is long and the angle θ is close to 0°.

[0021] FIG. 7 shows an example of time changes in the PV, OP, and index value of the monitored device 5 shown in FIG. 2. Periods T1 to T2 are the same as in FIG. 6. In period T3 to T4, for example, the flow rate increases due to a sudden change in the upstream pressure. When such an abnormality occurs, the control of the flow controller FC cannot keep up and only the PV fluctuates, so the fluctuation range of the OP is small but the fluctuation range of the PV is large. Therefore, the plot area is a vertically long rectangle, so the length L of the diagonal is long and the angle θ is close to 90°.

[0022] FIG. 8 shows an example of time changes in the PV, OP, and index value of the monitored device 5 shown in FIG. 2. Periods T1 to T2 are the same as in FIG. 6. In periods T3 to T4, for example, the target value is changed. At this time, as normal control, OP rises to raise the flow rate to the target value, and PV also rises accordingly, so that the fluctuation ranges of PV and OP become large. Therefore, the plot area has a shape close to a large square, so the length L of the diagonal is long and the angle θ is close to 45°.

[0023] 9 shows another example of a monitored device 5 monitored by an anomaly detection device 10 according to an embodiment. A valve 8, which is an example of a monitored device 5, is opened and closed to control the level of the liquid in a container 9. The opening degree of the valve 8 is controlled by a liquid level controller LC, which is an example of a control device 4. The liquid level controller LC acquires the level of the liquid in the container 9 as a process value (PV), calculates a command value (OP) for the opening degree of the valve 6 by PID control or the like so that the flow rate becomes a set target value (SV), and transmits it to the valve 6.

[0024] FIG. 10 shows an example of time changes in the PV, OP, and index value of the monitored device 5 shown in FIG. 9. In the period T1 to T2, the process state is stable, and the fluctuation range of the PV and the fluctuation range of the OP are small. Therefore, the plot area is shaped like a small square, so the length L of the diagonal is short and the angle θ is close to 45°. In the period T3 to T4, for example, a blockage occurs downstream and the amount of liquid flowing out of the container 9 is less than normal. When such an abnormality occurs, it is necessary to increase the opening of the valve 8 in order to maintain the height of the liquid level constant, so the fluctuation range of the PV remains small, but the fluctuation range of the OP becomes large. Therefore, the plot area is a horizontally long rectangle, so the length L of the diagonal is long and the angle θ is close to 0°.

[0025] FIG. 11 shows an example of time changes in PV, OP, and index values ​​of the monitored device 5 shown in FIG. 9. Periods T1 to T2 are the same as those in FIG. 10. In period T3 to T4, for example, the liquid level rises due to a sudden increase in the inflow rate from upstream. When such an abnormality occurs, the control of the liquid level controller LC cannot keep up and only the PV fluctuates, so the fluctuation range of OP is small but the fluctuation range of PV is large. Therefore, the plot area is a vertically long rectangle, so the length L of the diagonal is long and the angle θ is close to 90°.

[0026] FIG. 12 shows an example of time changes in the PV, OP, and index value of the monitored device 5 shown in FIG. 9. Periods T1 to T2 are the same as in FIG. 10. In periods T3 to T4, for example, the target value is changed. At this time, as normal control, the OP rises to raise the liquid level to the target value, and the PV also rises accordingly, so the fluctuation ranges of the PV and the OP also become large. Therefore, the plot area has a shape close to a large square, so the length L of the diagonal is long and the angle θ is close to 45°.

[0027] FIG. 13 shows an example of time changes in PV, OP, and index values ​​when control becomes unstable due to other control systems, disturbances, etc. In the period T1 to T2, the process state is stable, and the fluctuation ranges of PV and OP are small. Therefore, the plot area is shaped like a small square, so the length L of the diagonal is short and the angle θ is close to 45°. In the period T3 to T4, the control cannot keep up with the effects of other control systems, disturbances, etc., and the fluctuation ranges of PV and OP are large. Therefore, the plot area is shaped like a large square, so the length L of the diagonal is long and the angle θ is close to 45°.

[0028] In this way, the length L of the diagonal line of the plot area and the angle θ are correlated with a sign of an abnormality in the monitored device 5, and therefore can be used as an index for detecting an abnormality in each control system. For example, the abnormality detection device 10 may detect an abnormality in the monitored device 5 when the relationship between the normalized PV fluctuation range and the normalized OP fluctuation range is out of the normal range. The relationship between the PV fluctuation range and the OP fluctuation range may be, for example, the ratio between the PV fluctuation range and the OP fluctuation range. The abnormality detection device 10 may determine an abnormality based on the tendency of the shape of a vector having the PV fluctuation range and the OP fluctuation range as components to become horizontally or vertically elongated from the shape during stable operation, or to become larger while maintaining the same shape.

[0029] The abnormality detection device 10 may detect an abnormality in the monitored device 5 based on a target value of a control manipulated variable for a predetermined period. By further considering the target value, it is possible to determine a case where normal control is performed due to a change in the target value as shown in Fig. 8 and Fig. 12, and therefore it is possible to improve the detection accuracy.

[0030] FIG. 14 shows an example of clustering the indexes calculated when the plant 3 is operated. The learning device 40 classifies the indexes for each state of the monitored device 5 by clustering the indexes calculated from the PV and OP when the plant 3 was operated in the past. The learning device 40 may perform clustering using the length L of the diagonal line of the plot area and the angle θ as the index, or may perform clustering by reducing the dimension of three or more indexes. The area 80 corresponds to a cluster of indexes in a normal state, the area 81 corresponds to a cluster in a state in which the normal state is in transition to an abnormal state, and the area 82 corresponds to a cluster in an abnormal state. The anomaly detection device 10 calculates the indexes during the operation of the plant 3 and determines the cluster to which the calculated index belongs, thereby being able to grasp the current state of the monitored device 5. In addition, the future state of the monitored device 5 can be predicted by monitoring the time change of the indexes.

[0031] FIG. 15 shows an example of a time change in the probability that the monitored device 5 transitions from a normal state to an abnormal state. The transition probability may be calculated based on an index calculated from PV and OP. An algorithm for calculating the transition probability may be learned by the learning device 40. The transition probability calculation algorithm may be a neural network that inputs an index and outputs a transition probability. The learning device 40 may learn the transition probability calculation algorithm using the index calculated from PV and OP when the plant 3 was operated in the past and data representing the state of the monitored device 5 at that time as learning data. The state of the monitored device 5 may be defined by a specific process value range or the like. The anomaly detection device 10 calculates an index during the operation of the plant 3 and inputs the calculated index into the transition probability calculation algorithm, thereby being able to grasp the current transition probability. This makes it possible to predict the future state of the monitored device 5.

[0032] FIG. 16 shows an example of time change of indexes in a process including a plurality of control systems. The first to fifth rows show time change of indexes calculated in a plurality of control systems controlled by a plurality of control devices 4, respectively. The sixth row shows time change of risk of emergency stop of the entire process calculated based on these indexes. An algorithm for calculating the risk of emergency stop may be learned by the learning device 40. In the emergency stop risk calculation algorithm, the indexes calculated in each control system may be weighted according to the risk that an abnormality in each control system will cause an emergency stop of the entire process. The emergency stop risk calculation algorithm may be a neural network that inputs the indexes in each control system and outputs the emergency stop risk. The learning device 40 may learn the emergency stop risk calculation algorithm using the indexes calculated from the PV and OP when the plant 3 was operated in the past, the risk of emergency stop at that time, the time until emergency stop, and the like as learning data. The anomaly detection device 10 calculates the indexes in each control system during operation of the plant 3, and inputs the calculated indexes into the emergency stop risk calculation algorithm, thereby being able to grasp the current emergency stop risk. This allows the future state of the entire process to be predicted, so that appropriate measures can be taken, if necessary, to avoid emergency shutdowns of the process.

[0033] 17 shows the configuration of a learning device 40 according to an embodiment. The learning device 40 includes a communication device 41, a processing device 50, and a storage device 60.

[0034] The communication device 41 controls wireless or wired communication and transmits and receives data to and from other devices via the Internet 2.

[0035] The storage device 60 stores data and computer programs used by the processing device 50. The storage device 60 stores an achievement data holding unit 61, an index clustering model 62, a transition probability calculation algorithm 63, and an emergency shutdown risk calculation algorithm 64. The index clustering model 62, the transition probability calculation algorithm 63, and the emergency shutdown risk calculation algorithm 64 function as detection standards used by the anomaly detection device 10 to detect an anomaly in the plant 3.

[0036] The performance data storage unit 61 stores performance data such as PV, OP, the state of the monitored device 5, the state of the process, etc., acquired when the plant 3 is operated.

[0037] The processing device 50 includes a performance data acquisition unit 51, a learning data generation unit 52, a detection criterion provision unit 53, an index clustering unit 54, a transition probability calculation algorithm learning unit 55, and an emergency stop risk calculation algorithm learning unit 56. In terms of hardware components, these configurations are realized by the CPU, memory, and programs loaded into the memory of any computer, but here, functional blocks realized by cooperation between them are depicted. Therefore, it will be understood by those skilled in the art that these functional blocks can be realized in various forms by only hardware, only software, or a combination thereof.

[0038] The performance data acquisition unit 51 acquires performance data such as PV, OP, the state of the monitored device 5, the state of the process, etc. acquired when the plant 3 is operated, and stores the data in the performance data storage unit 61.

[0039] The learning data generating unit 52 generates learning data from the performance data stored in the performance data storage unit 61. The learning data generating unit 52 calculates an index from the PV and the OP. The learning data generating unit 52 calculates a numerical value representing the state of the monitored target device 5 based on a specific PV or the like.

[0040] The index clustering unit 54 clusters the indices calculated by the training data generating unit 52, thereby training the index clustering model 62.

[0041] The transition probability calculation algorithm learning unit 55 learns the transition probability calculation algorithm 63 by using the learning data generated by the learning data generating unit 52. The transition probability calculation algorithm learning unit 55 may learn the transition probability calculation algorithm 63 by adjusting the intermediate layer of the neural network so that when an index is input to the input layer, the transition probability at that time is output from the output layer.

[0042] The emergency stop risk calculation algorithm learning unit 56 learns the emergency stop risk calculation algorithm 64 by using the learning data generated by the learning data generating unit 52. The emergency stop risk calculation algorithm learning unit 56 may learn the emergency stop risk calculation algorithm 64 by adjusting the intermediate layer of the neural network so that when an index in each control system is input to the input layer, the risk of an emergency stop at that time is output from the output layer.

[0043] The detection criterion providing unit 53 provides the learned index clustering model 62, the transition probability calculation algorithm 63, and the emergency stop risk calculation algorithm 64 to the anomaly detection device 10.

[0044] 18 shows the configuration of an anomaly detection device 10 according to an embodiment. The anomaly detection device 10 includes a communication device 11, a display device 12, an input device 13, a processing device 20, and a storage device 30.

[0045] The communication device 11 controls wireless or wired communication. The communication device 11 transmits and receives data to and from other devices via the Internet 2. The display device 12 displays a display image generated by the processing device 20. The input device 13 inputs instructions to the processing device 20.

[0046] The storage device 30 stores data and computer programs used by the processing device 20. The storage device 30 stores a process value storage unit 31, a command value storage unit 32, a target value storage unit 33, an index clustering model 34, a transition probability calculation algorithm 35, and an emergency stop risk calculation algorithm 36.

[0047] The processing device 20 includes a process value acquiring unit 21, a command value acquiring unit 22, a target value acquiring unit 23, an index calculating unit 24, a state detecting unit 25, a transition probability calculating unit 26, an emergency stop risk calculating unit 27, a presenting unit 28, and a detection criterion updating unit 29. These configurations can also be realized in various forms using only hardware, only software, or a combination of these.

[0048] The process value acquisition unit 21 acquires process values ​​from the control device 4, the monitored device 5, a sensor that detects the process values, etc., and stores them in the process value storage unit 31. The command value acquisition unit 22 acquires a command value from the control device 4 and stores it in the command value storage unit 32. The target value acquisition unit 23 acquires a target value from the control device 4 and stores it in the target value storage unit 33.

[0049] The index calculation unit 24 calculates an index based on the process values ​​for a predetermined period stored in the process value storage unit 31 and the command values ​​for a predetermined period stored in the command value storage unit 32 .

[0050] The state detection unit 25 detects the state of the monitored device 5 by inputting the index calculated by the index calculation unit 24 to the index clustering model .

[0051] The transition probability calculation unit 26 inputs the index calculated by the index calculation unit 24 to a transition probability calculation algorithm 35 to calculate the transition probability.

[0052] The emergency stop risk calculation unit 27 inputs the indexes for each control system calculated by the index calculation unit 24 to an emergency stop risk calculation algorithm 36, thereby calculating the risk of an emergency stop.

[0053] The presentation unit 28 displays the detection result by the state detection unit 25, the transition probability calculated by the transition probability calculation unit 26, and the risk of emergency stop calculated by the emergency stop risk calculation unit 27 on the display device 12. The presentation unit 28 also displays the change over time in the shape of a vector whose components are the fluctuation range of the process value and the fluctuation range of the command value on the display device 12. This allows the operator to accurately predict the future state of the entire process and take appropriate measures as necessary to avoid an emergency stop of the process.

[0054] The detection standard update unit 29 acquires the index clustering model 62, the transition probability calculation algorithm 63, or the emergency stop risk calculation algorithm 64 that have been tracked by the learning device 40 from the learning device 40, and updates the index clustering model 34, the transition probability calculation algorithm 35, or the emergency stop risk calculation algorithm 36.

[0055] 19(a), (b), and (c) show examples of time changes in indices calculated by the anomaly detection device 10. FIG. 19(a) shows time changes in PV and OP, and time changes in calculated indices (diagonal length L and angle θ). FIG. 19(b) is a scatter plot of PV and OP at a predetermined time before time T11, and FIG. 19(c) is a scatter plot of PV and OP at a predetermined time before time T12. Just before time T12, OP begins to take on abnormal values, and similarly, the indices begin to take on abnormal values ​​that are significantly different from normal values. Therefore, based on these indices, it is possible to accurately detect signs of anomalies in the control system.

[0056] The present invention has been described above based on the embodiments. These embodiments are merely illustrative, and it will be understood by those skilled in the art that various modifications are possible in the combination of each component and each treatment process, and that such modifications are also within the scope of the present invention. [Explanation of symbols]

[0057] 1 Anomaly detection system, 3 Plant, 4 Control device, 5 Monitored device, 6 Valve, 7 Pipe, 8 Valve, 9 Container, 10 Anomaly detection device, 21 Process value acquisition unit, 22 Command value acquisition unit, 23 Target value acquisition unit, 24 Index calculation unit, 25 State detection unit, 26 Transition probability calculation unit, 27 Emergency stop risk calculation unit, 28 Presentation unit, 29 Detection criterion update unit, 31 Process value storage unit, 32 Command value storage unit, 33 Target value storage unit, 34 Index clustering model, 35 Transition probability calculation algorithm, 36 Emergency stop risk calculation algorithm, 40 Learning device, 51 Performance data acquisition unit, 52 Learning data generation unit, 53 Detection criterion provision unit, 54 Index clustering unit, 55 Transition probability calculation algorithm learning unit, 56 Emergency stop risk calculation algorithm learning unit, 61 Performance data storage unit, 62 Index clustering model, 63 Transition probability calculation algorithm, 64 Emergency stop risk calculation algorithm.

Claims

1. a process value acquiring unit that acquires a process value of at least one of the plurality of devices to be monitored during operation of the plant including the plurality of devices; a command value acquisition unit that acquires a command value of a control operation amount for controlling the monitored device; an anomaly detection unit that detects an anomaly in the monitored device based on a relationship between a fluctuation range of the process value acquired by the process value acquisition unit during a predetermined period and a fluctuation range of the command value acquired by the command value acquisition unit; Equipped with the abnormality detection unit detects an abnormality in the monitored device using a detection criterion for detecting an abnormality in the monitored device based on an index relating to a relationship between a fluctuation range of the process value and a fluctuation range of the command value; The index is the magnitude or gradient of a vector whose components are the fluctuation range of the process value and the fluctuation range of the command value. Anomaly detection device.

2. The detection criteria are learned by machine learning based on the fluctuation range of the process value, the fluctuation range of the command value, and the state of the monitored device during a predetermined period in the past. The anomaly detection device according to claim 1 .

3. The abnormality detection unit detects an abnormality in the monitored device when a relationship between a fluctuation range of the process value and a fluctuation range of the command value falls outside a normal range. The anomaly detection device according to claim 1 or 2.

4. Abnormality is judged when the shape of the vector, whose components are the fluctuation range of the process value and the fluctuation range of the command value, becomes horizontally or vertically elongated from the shape during stable operation, or when the shape tends to grow larger. The abnormality detection device according to claim 1 .

5. The change in shape of the vector over time is displayed on a display device. The anomaly detection device according to claim 1 .

6. The abnormality detection unit detects an abnormality in the monitored device further based on the target value of the control manipulated variable during the predetermined period. The abnormality detection device according to claim 1 .

7. Computer, a process value acquiring unit that acquires a process value of at least one of the plurality of devices to be monitored during operation of the plant including the plurality of devices; a command value acquisition unit that acquires a command value of a control operation amount for controlling the monitored device; an anomaly detection unit that detects an anomaly in the monitored device based on a relationship between a fluctuation range of the process value acquired by the process value acquisition unit during a predetermined period and a fluctuation range of the command value acquired by the command value acquisition unit; Function as a the abnormality detection unit detects an abnormality in the monitored device using a detection criterion for detecting an abnormality in the monitored device based on an index relating to a relationship between a fluctuation range of the process value and a fluctuation range of the command value; The index is the magnitude or gradient of a vector whose components are the fluctuation range of the process value and the fluctuation range of the command value. Anomaly detection program.

8. a learning data acquiring unit that acquires, as learning data, a fluctuation range of a process value of at least one of the plurality of devices that is a monitored device, a fluctuation range of a command value of a control manipulated variable for controlling the monitored device, and information indicating a state of the monitored device, the fluctuation range of a process value of at least one of the plurality of devices that is a monitored device, the fluctuation range of a command value of a control manipulated variable for controlling the monitored device, the information being acquired when a plant including the plurality of devices is operated for a predetermined period of time; a learning unit that learns a detection criterion for detecting an abnormality in the monitored device based on an index relating to a relationship between a fluctuation range of the process value and a fluctuation range of the command value based on the learning data; Equipped with The index is the magnitude or gradient of a vector whose components are the fluctuation range of the process value and the fluctuation range of the command value. Learning device.

Images