Monitoring device and monitoring method

Abstract

Provided is a technology for monitoring the behavior of a control system with high accuracy. One embodiment of the present invention pertains to a monitoring device that includes: an acquisition unit that acquires an observation value regarding the behavior of a control system, the observation value being sampled while the system is being operated; and an evaluation unit that determines a fluctuation range of the observation value with respect to the control system behavior, and that evaluates whether the fluctuation range of the observation value satisfies specifications regarding the observation value.

Description

[Technical Field]

[0001] The present disclosure relates to a monitoring device and a monitoring method. [Background technology]

[0002] To verify the operation of control systems such as cyber-physical systems, parameters related to the operation of the control system are sampled and monitored intermittently. When monitoring parameters by intermittent sampling, it is necessary to estimate and interpolate as accurately as possible the changes in parameters that occur between samplings. In particular, in the Internet of Things (IoT), sampling intervals are sometimes extended to reduce power consumption. Accurate operation verification can be performed by identifying operational anomalies that occur between samplings.

[0003] Conventionally, linear interpolation and constant interpolation are used for parameter interpolation between samples. In linear interpolation, sampling points are interpolated using a linear formula, as shown in Figure 1(a), while in constant interpolation, sampling points are interpolated using a constant, as shown in Figure 1(b). Summary of the Invention [Problem to be solved by the invention]

[0004] However, the actual parameter fluctuations between samplings may be as shown in Figure 1(c), and conventional linear or constant interpolation may not accurately capture abnormal operation of the control system.

[0005] In view of the above problems, an object of the present disclosure is to provide a technology for monitoring the behavior of a control system with high accuracy. [Means for solving the problem]

[0006] In order to solve the above problem, one aspect of the present invention relates to a monitoring device having an acquisition unit that acquires observed values ​​sampled during system operation regarding control system behavior, and a determination unit that determines a range of variation of the observed values ​​for the behavior of the control system and determines whether the range of variation of the observed values ​​satisfies specifications regarding the observed values. [Effects of the Invention]

[0007] According to the present disclosure, a technique for monitoring the behavior of a control system with high accuracy can be provided. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a schematic diagram showing a specific example of a sampling method. [Figure 2] FIG. 1 is a schematic diagram illustrating a monitoring device according to an embodiment of the present disclosure. [Figure 3] FIG. 1 is a block diagram illustrating a hardware configuration of a monitoring device according to an embodiment of the present disclosure. [Figure 4] FIG. 1 is a block diagram illustrating a functional configuration of a monitoring device according to an embodiment of the present disclosure. [Figure 5] 10 is a flowchart illustrating a monitoring process according to the first embodiment of the present disclosure. [Figure 6] FIG. 2 is a state transition diagram illustrating a hybrid automaton according to an embodiment of the present disclosure. [Figure 7] FIG. 10 is a diagram illustrating observations according to an embodiment of the present disclosure. [Figure 8] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 9] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 10] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 11] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 12] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 13] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 14] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 15] FIG. 2 is a state transition diagram illustrating a hybrid automaton according to an embodiment of the present disclosure. [Figure 16] FIG. 10 is a diagram illustrating observations according to an embodiment of the present disclosure. [Figure 17] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 18] 10 is a flowchart illustrating a monitoring process according to a second embodiment of the present disclosure. [Figure 19] FIG. 2 is a state transition diagram illustrating a hybrid automaton according to an embodiment of the present disclosure. [Figure 20] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 21] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 22] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 23] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 24] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 25] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 26] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 27] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 28] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 29] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 30] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 31]FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 32] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 33] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 34] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 35] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 36] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 37] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 38] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 39] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 40] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 41] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 42] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 43] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 44] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 45] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 46] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 47] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 48] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 49] FIG. 1 illustrates a monitoring process according to an embodiment of the present disclosure. [Figure 50] FIG. 10 is a state transition diagram illustrating a hybrid automaton according to a modified example of the present disclosure. [Figure 51] FIG. 10 is a state transition diagram illustrating a hybrid automaton according to a modified example of the present disclosure. [Figure 52] FIG. 10 is a diagram illustrating a monitoring process according to a modified example of the present disclosure. [Figure 53] FIG. 10 is a diagram illustrating a monitoring process according to a modified example of the present disclosure. [Figure 54] FIG. 10 is a diagram illustrating a monitoring process according to a modified example of the present disclosure. [Figure 55] FIG. 10 is a diagram illustrating a monitoring process according to a modified example of the present disclosure. [Figure 56] FIG. 10 is a state transition diagram illustrating a hybrid automaton according to a modified example of the present disclosure. [Figure 57] FIG. 10 is a state transition diagram illustrating a hybrid automaton according to a modified example of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0009] In the following embodiments, a monitoring device for a control system such as a physical information system is disclosed. [Summary] 2 , a monitoring device 100 according to an embodiment of the present disclosure acquires a physical information system M, a specification φ, and an observation value w of the physical information system M, and then determines whether the physical information system M satisfies the specification φ. A physical information system (cyber-physical system) M represents a general system constructed by combining physical systems such as automobiles, robots, and buildings with information systems such as computers.

[0010] In the following embodiments, the physical information system M operates in discrete modes such as on mode and off mode, low speed mode and high speed mode. As a result of this operation, parameter values such as, for example, the vehicle speed of a car, the product production volume by a robot, and the air conditioning temperature of a building fluctuate. The fluctuation may be defined by conditions representing the time change of parameter values such as differential equations defined in advance for each discrete mode. Further, the specification φ may be, for example, "v < v0" for the vehicle speed v, "p0 < p" for the product production volume p per hour, "tmp L <tmp < tmp H " etc. for the room temperature tmp.

[0011] These parameter values generally fluctuate continuously, but the observed value w of the parameter is a sampling value collected intermittently at a predetermined sampling rate. Therefore, as described above, the observed value w cannot necessarily explain the actual fluctuation of the parameter value during sampling, and it is not possible to determine whether the physical information system M satisfies the specification φ based on the observed value w.

[0012] Under such constraints regarding sampling, the monitoring device 100 collects the observed value w with respect to the behavior of the physical information system M, determines the possible fluctuation range of the parameter value based on the collected observed value w, and determines whether the physical information system M satisfies the specification φ based on the observed value w and the fluctuation range.

[0013] Here, the monitoring device 100 may have a hardware configuration including, for example, a processor 101 such as a CPU (Central Processing Unit), a memory 102 such as a RAM (Random Access Memory) and a flash memory, a storage 103, and an input / output (I / O) interface 104 as shown in FIG. 3.

[0014] The processor 101 executes various processes of the monitoring device 100 described later.

[0015] The memory 102 stores various data and programs in the monitoring device 100, and functions as a working memory, in particular, for working data, programs currently being executed, etc. Specifically, the memory 102 stores programs for executing and controlling various processes, which will be described later, that are loaded from the storage 103, and functions as a working memory while the processor 101 is executing the programs.

[0016] The storage 103 stores various data and programs in the monitoring device 100 .

[0017] The I / O interface 104 is an interface for receiving commands and input data from a user, displaying and reproducing output results, and inputting and outputting data to and from an external device. For example, the I / O interface 104 may be a device for inputting and outputting various types of data, such as a USB (Universal Serial Bus), a communication line, a keyboard, a mouse, a display, a microphone, a speaker, etc.

[0018] However, the monitoring device 100 according to the present disclosure is not limited to the above-described hardware configuration and may have any other appropriate hardware configuration. For example, one or more of the processes performed by the monitoring device 100 may be realized by a processing circuit or electronic circuit that is hardwired to realize the process. [Monitoring equipment] Next, a monitoring device 100 according to an embodiment of the present disclosure will be described with reference to Fig. 4. Fig. 4 is a block diagram showing the functional configuration of the monitoring device 100 according to an embodiment of the present disclosure.

[0019] 4, the monitoring device 100 includes an acquisition unit 110 and a determination unit 120. The acquisition unit 110 and the determination unit 120 are installed in the monitoring device 100 and are realized by one or more processors executing one or more programs stored in one or more memories.

[0020] The acquiring unit 110 acquires sampled observation values ​​relating to the behavior of the control system. Specifically, the acquiring unit 110 acquires, as the observation values ​​w, parameter values ​​intermittently collected during the operation of the physical information system M.

[0021] For example, if the physical information system M is an automobile control system, the parameter values ​​may be vehicle speed, engine RPM, gear number, etc. If the physical information system M is a robot control system, the parameter values ​​may be product production volume, power consumption, etc. If the physical information system M is a building control system, the parameter values ​​may be room temperature, lighting brightness, power consumption, etc. For example, the observed value w is a series of parameter values ​​collected at a predetermined sampling rate. If the observed value w is vehicle speed collected every x seconds during operation of the physical information system M, the observed value w is expressed as w=(w1, w2, . . . , w n ), where w i represents the vehicle speed at the i-th time point. The acquisition unit 110 provides the acquired observation value w to the determination unit 120.

[0022] The determination unit 120 determines the variation range of the observed values ​​for the behavior of the control system and determines whether the variation range of the observed values ​​satisfies the specifications for the observed values. Specifically, when the observed values ​​w are acquired, the determination unit 120 uses a mathematical model to determine whether each observed value w satisfies the specifications for the behavior of the physical information system M. i The determination unit 120 determines the variation range of the observation value w that can be reached from M, and determines whether the determined variation range satisfies the specification φ. Here, if the exact behavior of the physical information system M is known, a mathematical model can be constructed using the behavior of the physical information system M, but if the exact behavior of the physical information system M is unknown, a mathematical model can be used to determine an approximate operating range that includes the actual behavior of the physical information system M. If the variation range does not satisfy the specification φ, the determination unit 120 determines that the physical information system M does not satisfy the specification φ, and determines whether each observation value w i If the reachable variation range for satisfies the specification φ, the determining unit 120 determines that the physical information system M satisfies the specification φ. [Example 1] In one embodiment, the determination unit 120 may determine a first reachable range that is reachable in the forward direction from the observation value at time i to time (i+1) and a second reachable range that is reachable in the backward direction from the observation value at time (i+1) to time i, and determine whether the variation range satisfies the specification based on whether there is an overlapping range between the common range of the first reachable range and the second reachable range and the range that does not satisfy the specification. Specifically, the determination unit 120 may determine, for the observation value at each time point i, a reachable range F that is reachable in the forward direction from the observation value at time i to time (i+1). i and the reachable range B that can be reached in the reverse direction from the observation value at the (i+1)th time point to the ith time point. i and determine the reachable range F i and B i Intersection with I i Determine whether the unsatisfied range N of the specification overlaps with the unsatisfied range I. i is detected, the determination unit 120 determines that the physical information system M does not satisfy the specification φ, and determines that the common range I i and the specification unsatisfied range N do not overlap, the determining unit 120 determines that the physical information system M satisfies the specification φ.

[0023] 5 is a flowchart showing a monitoring process according to the first embodiment of the present disclosure. The monitoring process is executed by the above-described monitoring device 100, and can be realized, for example, by one or more processors executing programs stored in one or more memories of the monitoring device 100.

[0024] As shown in FIG. 5, in step S101, the acquisition unit 110 acquires an observation value w=(w1, w2, . . . , w n ) and initialize the parameter i to i=1.

[0025] In step S102, the determination unit 120 determines the observation value w i The forward reachable range F that can be reached in the forward direction on the time axis from the (i+1)th time pointi For example, when the fluctuation range of the observed value per unit time is known by a differential equation or the like that defines the time change of the parameter value, the determination unit 120 determines the observed value w at the i-th time point. i Based on the range of variation, the forward reachable range F i may be determined.

[0026] In step S103, the determination unit 120 determines the observed value w i+1 Reverse reachable range B that can be reached in the reverse direction from i For example, when the fluctuation range of the observed value per unit time is known by a differential equation or the like that defines the time change of the parameter value, the determination unit 120 determines the observed value w at the (i+1)th time point. i+1 Based on the variation range, the backward reachable range B i may be determined.

[0027] In step S104, the determination unit 120 determines the forward reachable range F i and the backward reachable range B i Intersection with I i Determine the common range I i is the forward reachable range F i and the backward reachable range B i This is the overlapping range.

[0028] In step S105, the determination unit 120 determines the common range I i Determine whether overlaps with the unsatisfied range N of the specification φ. i If the common range I overlaps with the unsatisfied range N (S105: YES), the determination unit 120 determines that the physical information system M does not satisfy the specification φ, and ends the process. i If does not overlap with the unsatisfied range N (S105: NO), the determination unit 120 increments the parameter i in step S106, and repeats steps S102 to S105. [Monitoring process for thermostatic chamber control system according to embodiment 1] As an example, consider a monitoring process for determining whether a thermostatic chamber control system that controls a thermostatic chamber by turning a heater on and off satisfies the specification φ: "Temperature T is within the range of 70 to 80 degrees (70≦T≦80)." In this embodiment, when the heater is turned on, the temperature T increases by 2 to 4 degrees per unit time. When the heater is turned off, the temperature T decreases by 0 to 2 degrees per unit time. For example, as shown in FIG. 6, such a thermostatic chamber control system can be represented by a hybrid automaton capable of representing discrete mode changes of differential equations. Assume that the acquisition unit 110 acquires four observation values ​​T1=75 (t=0), T2=75 (t=2), T3=71 (t=4), and T4=72 (t=6) sampled every two seconds for the thermostatic chamber controlled by the thermostatic chamber control system, as shown in FIG. 7.

[0029] First, for the first time point (i=1), the determination unit 120 derives a reachable range F1 that can be reached in the forward direction on the time axis from the observation value T1 at the first time point to the second time point. Because the starting point is T1=75, it can be determined that the temperature T will be within a fluctuation range of 83 to 71 degrees until the second time point two seconds later, and the determination unit 120 determines a triangular reachable range F1 as shown in FIG.

[0030] Meanwhile, the determination unit 120 also derives a reachable range B1 that can be reached in the reverse direction on the time axis from the observation value T2 at the second time point to the first time point. Because the starting point is T2=75, it can be determined that the temperature T is within a fluctuation range of 67 to 79 degrees up to the first time point two seconds ago, and the determination unit 120 determines the triangular reachable range B1 as shown in FIG.

[0031] Then, the determination unit 120 derives the common range I1 of the reachable range F1 and the reachable range B1 for the first time point. For example, a common range I1 as shown by the shaded portion in FIG. 10 is derived. The determination unit 120 determines whether there is an overlapping range between the common range I1 and the insufficient range N of the specification φ, "T < 70 degrees or 80 degrees < T". As understood from the positional relationship between the common range I1 and the insufficient range N shown in FIG. 10, since there is no overlapping range between the common range I1 and the insufficient range N, the determination unit 120 determines that the variation range of the temperature T from the first time point to the second time point satisfies the specification φ.

[0032] Next, for the second time point (i = 2), the determination unit 120 similarly derives a reachable range F2 that can be reached in the forward direction with respect to the time axis from the observed value T2 at the second time point to the third time point, and a reachable range B2 that can be reached in the reverse direction with respect to the time axis from the observed value T3 at the third time point to the second time point. The reachable range F2 and the reachable range B2 are in the range of a triangle as shown in FIG. 11.

[0033] Then, the determination unit 120 derives the common range I2 of the reachable range F2 and the reachable range B2 for the second time point. For example, a common range I2 as shown by the line segment portion where the two triangles in FIG. 12 touch is derived. The determination unit 120 determines that since there is no overlapping range between the common range I2 and the insufficient range N as understood from the positional relationship between the common range I2 and the insufficient range N shown in FIG. 12, the determination unit 120 determines that the variation range of the temperature T from the second time point to the third time point satisfies the specification φ.

[0034] Next, for the third time point (i = 3), the determination unit 120 similarly derives a reachable range F3 that can be reached in the forward direction with respect to the time axis from the observed value T3 at the third time point to the fourth time point, and a reachable range B3 that can be reached in the reverse direction with respect to the time axis from the observed value T4 at the fourth time point to the third time point. The reachable range F3 and the reachable range B3 are in the range of a triangle as shown in FIG. 13.

[0035] The determination unit 120 then derives a common range I3 between the reachable range F3 and the reachable range B3 for the third time point. For example, the common range I3 shown as the shaded area in Fig. 14 is derived. As can be seen from the positional relationship between the common range I3 and the unsatisfied range N shown in Fig. 14, there is an overlapping range between the common range I3 and the unsatisfied range N. Therefore, the determination unit 120 determines that the range of variation of the temperature T from the third time point to the fourth time point does not satisfy the specification φ, and therefore determines that the thermostatic chamber control system does not satisfy the specification φ. [Monitoring process for automobile control system according to embodiment 1] As another example, consider a monitoring process for determining whether a vehicle control system for controlling a vehicle satisfies the specification φ: "vehicle speed v is always 120 km / h or less (v≦120)." The vehicle control system according to this embodiment operates the vehicle in a low-speed mode (LOW) and a high-speed mode (HIGH). A minimum interval of 2 seconds is required for switching between modes. The low-speed mode operates when the vehicle speed v is between 0 and 90 km / h (v∈[0,90]), and in the low-speed mode, the vehicle speed v fluctuates within a range of -6 to 15 km / h per unit time (dv / dt∈[-6,15]). On the other hand, the high-speed mode operates when the vehicle speed v is 30 km / h or more (v≧30), and in the high-speed mode, the vehicle speed v fluctuates within a range of -6 to 7 km / h per unit time (dv / dt∈[-6,7]). Furthermore, a transition from low-speed mode to high-speed mode is possible only when v≧45, and a transition from high-speed mode to low-speed mode is possible only when v≦50. The duration of time spent in each mode is indicated by a parameter c. In this case, the automobile control system according to this embodiment can be represented by a hybrid automaton capable of expressing discrete mode changes of differential equations, as shown in FIG. 15. For example, as shown in FIG. 16, assume that the acquisition unit 110 acquires three sampled observation values ​​v1=30 (t=1), v2=90 (t=6), and v3=100 (t=15) for an automobile controlled by the automobile control system.

[0036] First, for a first time point (i=1), the determination unit 120 derives a reachable range F1, which is reachable in the forward direction on the time axis from the observed value v1 at the first time point (t=1) to the second time point (t=6), and a reachable range B1, which is reachable in the reverse direction on the time axis from the observed value v2 at the second time point to the first time point. The determination unit 120 then derives a common range I1 between the reachable range F1 and the reachable range B1 for the first time point. For example, the common range I1 shown as the shaded area in FIG. 17 is derived. The determination unit 120 determines whether there is an overlapping range between the common range I1 and the non-satisfaction range N "v>120" of the specification φ. As can be seen from the positional relationship between the common range I1 and the non-satisfaction range N shown in FIG. 17, there is no overlapping range between the common range I1 and the non-satisfaction range N. Therefore, the determination unit 120 determines that the fluctuation range of the vehicle speed v from the first time point to the second time point satisfies the specification φ.

[0037] Next, for the second time point (i=2), the determination unit 120 derives a reachable range F2, which is reachable in the forward direction on the time axis from the observation value v2 at the second time point (t=6) to the third time point (t=15), and a reachable range B2, which is reachable in the reverse direction on the time axis from the observation value v3 at the third time point to the second time point, and derives a common range I2 between the reachable range F2 and the reachable range B2 for the second time point. For example, the common range I2 shown as the shaded area in FIG. 17 is derived. The determination unit 120 determines whether there is an overlapping range between the common range I2 and the non-satisfaction range N of the specification φ (v>120). As can be seen from the positional relationship between the common range I2 and the non-satisfaction range N shown in FIG. 17, there is an overlapping range between the common range I2 and the non-satisfaction range N. Therefore, the determination unit 120 determines that the fluctuation range of the vehicle speed v from the second time point to the third time point does not satisfy the specification φ. [Example 2] In another embodiment, the determination unit 120 may determine a forward reachable range that is reachable in the forward direction on the time axis from the observation value at the i-th time point, determine an overlap range between the forward reachable range and the unsatisfied range of the specification φ, and determine whether the variation range satisfies the specification based on whether the observation value at the (i+1)-th time point is included in the reachable range that is reachable in the forward direction on the time axis from the overlap range. Specifically, the determination unit 120 may determine, for the observation value at each time point i, a forward reachable range F1 that is reachable in the forward direction on the time axis from the observation value at the i-th time point. i and the forward reachable range F1 i overlapping range O between and unsatisfied range N i Determine the overlapping range i Reachable range F2 that can be reached in the forward direction on the time axis from i Determine whether the observed value at the (i+1)th time point is included in the reachable range F2. i If the observed value at the (i+1)th time point is included in the specification φ, the determination unit 120 determines that the physical information system M does not satisfy the specification φ, and determines that the reachable range F2 i does not include the observed value at the (i+1)th time point, the determining unit 120 determines that the physical information system M satisfies the specification φ.

[0038] 18 is a flowchart showing a monitoring process according to Example 2 of the present disclosure. The monitoring process is executed by the above-described monitoring device 100, and can be realized, for example, by one or more processors executing programs stored in one or more memories of the monitoring device 100.

[0039] As shown in FIG. 18, in step S201, the acquisition unit 110 acquires the observed values ​​w=(w1, w2, . . . , w n ) and initialize the parameter i to i=1.

[0040] In step S202, the determination unit 120 determines the observation value w i The forward reachable range F1 that can be reached in the forward direction on the time axis from iThe forward reachable range F i is the observed value w at time i i The range that can be reached from the (i+1)th time point to the forward reachable range F1 i is the observed value w at time i i It should be noted that this is a range that can be reached from the i-th time point to the n-th time point. For example, when the fluctuation range of the observation value per unit time is known by a differential equation or the like, the determination unit 120 determines the observation value w at the i-th time point as i Based on the range of variation, the forward reachable range F1 i may be determined.

[0041] In step S203, the determination unit 120 determines the forward reachable range F1 i and the overlap range O with the non-satisfiable range N of the specification φ i Determine.

[0042] In step S204, the determination unit 120 determines whether the overlapping range O i Reachable range F2 that can be reached in the forward direction on the time axis from i Determine.

[0043] In step S205, the determination unit 120 determines the observed value w i+1 is the reachable range F2 i That is, the determination unit 120 determines whether the observed value w i After entering the unsatisfied range N from i+1 By determining whether it is possible to reach the observed value w i from the unsatisfied range N to the observed value w i+1 Determine whether the is reachable.

[0044] Observed value w i+1 is the reachable range F2 i If the observation value w is included in the i From w i+1, the physical information system M determines that the parameter value may be in the unsatisfied range N, and the physical information system M determines that the specification φ is not satisfied, and terminates the monitoring process. i+1 is the reachable range F2 i If not included in (S205: NO), the determination unit 120 determines whether the observed value w i From w i+1 It is determined that there is no possibility that the parameter value falls within the unsatisfied range N between the above values, and in step S206, the parameter i is incremented, and the above steps S202 to S205 are repeated. [Monitoring process for thermostatic chamber control system according to embodiment 2] As an example, similar to the first embodiment, consider a monitoring process for determining whether a thermostatic chamber control system that controls a thermostatic chamber by turning a heater on and off satisfies the specification φ: "Temperature T is within a range of 70 to 80 degrees (70≦T≦80)." When the thermostatic chamber control system of this embodiment turns the heater on (ON), the temperature T rises within a range of 2 to 4 degrees per unit time, and when the heater is turned off (OFF), the temperature T falls within a range of 0 to 2 degrees per unit time. That is, as described in relation to the first embodiment, the thermostatic chamber control system can be represented by a hybrid automaton capable of expressing discrete mode changes of differential equations, as shown in FIG. 6. As in the first embodiment, assume that the acquisition unit 110 acquires four observation values ​​T1=75 (t=0), T2=75 (t=2), T3=71 (t=4), and T4=72 (t=6) sampled every two seconds for the thermostatic chamber controlled by the thermostatic chamber control system, as shown in FIG. 7.

[0045] According to Example 2, the hybrid automaton in Fig. 6 is extended to a hybrid automaton including a transition to the unsatisfiable range "T<70 or T>80" as shown in Fig. 19. The upper half of the extended hybrid automaton represents the transitions from the initial state (start) to the OFF and ON states of the heater within the satisfying range of the specification φ, and the lower half is a copy of the hybrid automaton of the upper half, and represents the transitions from the OFF and ON states within the satisfying range of the upper half to the UNSATIRABLE range.

[0046] First, for the observation value T1, at time t=0, the decision unit 120 sets the OFF state of the upper half of the hybrid automaton as the initial state, as shown in FIG.

[0047] Next, at time t>0, the determination unit 120 determines a forward reachable range F1OFF1 of the temperature T that can be reached in the forward direction on the time axis from the observation value T1 while the current state is the OFF state of the upper half of the hybrid automaton. At this time, the temperature T can vary within the range of T∈[75-2t, 75], and the forward reachable range F1OFF1 is within a triangle starting from the observation value T1, as shown in FIG.

[0048] Next, at time t=t1 (>0), the determination unit 120 transitions the current state to the ON state of the upper half of the hybrid automaton, as shown in Fig. 22. At this time, the temperature T is within the range Tε[75-2t, 75].

[0049] Next, at time t>t1, the determination unit 120 determines a forward reachable range F1ON1 of the temperature T that is reachable in the forward direction on the time axis from the forward reachable range F1OFF1 while the current state is the ON state of the upper half of the hybrid automaton. At this time, the temperature T can vary within the range of T∈[75-2t1+2(t-t1), 75+4(t-t1)], and the forward reachable range F1ON1 is within the range of each triangle starting from each point of the forward reachable range F1OFF1, as shown in FIG. 23. Then, the determination unit 120 superimposes the forward reachable range F1OFF1 with each triangle (i.e., F1OFF1+F1ON1) to obtain a forward reachable range F11 as shown in FIG. 24. Then, the determination unit 120 deletes t1, and the temperature T falls within the range of T∈[75-2t, 75+4t].

[0050] Next, at time t=t2 (>t1), the determination unit 120 transitions the current state to the OFF state of the upper half of the hybrid automaton, as shown in FIG. 25. At this time, the temperature T is within the range of T∈[75-2t2, 75+4t2]. The determination unit 120 determines each triangle starting from each point in the forward reachable range F11, and confirms that these triangles are included in the forward reachable range F11. Then, the determination unit 120 deletes t2, and the temperature T is within the range of T∈[75-2t, 75+4t], as shown in FIG. 26.

[0051] Then, the determination unit 120 transitions the current state from the OFF state of the upper half of the hybrid automaton to the OFF state of the lower half of the hybrid automaton to determine the overlapping range O1 between the forward reachable range F11 and the unsatisfied range N "T<70 or T>80" of the specification φ. As shown in FIG. 27 , the overlapping range O1 becomes the common range I1 between the forward reachable range F1 and the unsatisfied range N.

[0052] Next, the determination unit 120 determines a reachable range F2OFF1 that is reachable in the forward direction along the time axis from the overlap range O1 while the current state is the OFF state of the lower half of the hybrid automaton. Specifically, similar to the method of calculating the forward reachable range F11 described above, the determination unit 120 determines the range of each triangle that is reachable in the forward direction along the time axis from each point in the overlap range O1, and by superimposing the ranges of each triangle, it is possible to determine the reachable range F2OFF1 as shown in FIG.

[0053] Next, the determination unit 120 transitions the current state to the ON state of the lower half of the hybrid automaton, and determines a reachable range F2ON1 that is reachable in the forward direction on the time axis from the overlap range O1 while the current state is the ON state of the lower half of the hybrid automaton. As shown in Fig. 29, the reachable range F2OFF1 and the reachable range F2ON21 are the same, so they are defined as the reachable range F21.

[0054] Then, the determination unit 120 determines whether T2=75 is included in the reachable range F21. As shown in Fig. 30, T2=75 is not included in the reachable range F21, so the determination unit 120 determines that it is impossible to reach T2=75 from T1=75 via the unsatisfied range N, and determines that the thermostatic chamber control system satisfies the specification φ within the range of time 0≦t≦2.

[0055] The determination unit 120 may check whether it is possible to reach T2 from T1 in the forward direction on the time axis. As shown in Fig. 31, the forward reachable range F21 starting from T1 includes T2=75, so it is clear that it is possible to reach T2 from T1 in the forward direction on the time axis. If it is not possible to reach T2 from T1 in the forward direction on the time axis, it can be determined that there was a problem with the observation of the observed value T2.

[0056] Next, the above-described process is repeated for the observation value T2. At time t>2, T∈[79−2t, 67+4t], and the determination unit 120 determines a forward reachable range F12 that is reachable in the forward direction on the time axis while the current state is the OFF state or the ON state of the upper half of the hybrid automaton, as shown in FIG.

[0057] Next, the determination unit 120 determines an overlapping range O2 between the forward reachable range F12 and the unsatisfied range N, and determines a reachable range F22 that is reachable in the forward direction on the time axis from the overlapping range O2 while the current state is in the OFF state or the ON state of the lower half of the hybrid automaton. The reachable range F22 is, for example, the range shown in FIG.

[0058] Then, the determination unit 120 determines whether T3=71 is included in the reachable range F22. As shown in Fig. 34, T3=71 is not included in the reachable range F22, so the determination unit 120 determines that it is impossible to reach T3=71 from T2=75 via the unsatisfied range N, and determines that the thermostatic chamber control system satisfies the specification φ within the range of time 2≦t≦4.

[0059] The determination unit 120 may check whether it is possible to reach T3 from T2 in the forward direction on the time axis. As shown in Fig. 35, the forward reachable range F22 starting from T2 includes T3=71, so it is clear that it is possible to reach T3 from T2 in the forward direction on the time axis. If it is not possible to reach T3 from T2 in the forward direction on the time axis, it can be determined that there was a problem with the observation of the observed value T3.

[0060] Next, the above-described process is repeated for the observation value T3. At time t>4, T∈[79−2t,55+4t], and the determination unit 120 determines a forward reachable range F13 that is reachable in the forward direction on the time axis while the current state is the OFF state or the ON state of the upper half of the hybrid automaton, as shown in FIG.

[0061] Next, the determination unit 120 determines an overlapping range O3 between the forward reachable range F13 and the unsatisfied range N, and determines a reachable range F23 that is reachable in the forward direction on the time axis from the overlapping range O3 while the current state is in the OFF state or the ON state of the lower half of the hybrid automaton. The reachable range F23 is, for example, the range shown in FIG.

[0062] Then, the determination unit 120 determines whether T4=72 is included in the reachable range F23. As shown in Fig. 38, since T4=72 is included in the reachable range F23, the determination unit 120 determines that it is possible to reach T4=72 from T3=71 via the unsatisfied range N, and determines that the thermostatic chamber control system does not satisfy the specification φ within the range of time 4≦t≦6.

[0063] As a result, the determining unit 120 determines that the thermostatic chamber control system does not satisfy the specification φ, similarly to the monitoring process in the first embodiment.

[0064] In the above-described embodiment, the forward reachable range F1 i is the range that can be reached in the forward direction from the i-th time point to any time point on the time axis, but the present disclosure is not limited to this and may also be the range that can be reached in the forward direction from the i-th time point to the (i+1)-th time point. [Monitoring process for automobile control system according to embodiment 2] As another example, similar to the first embodiment, consider a monitoring process for determining whether a vehicle control system for controlling a vehicle satisfies the specification φ, "vehicle speed v is always 120 km / h or less (v≦120)." The vehicle control system operates the vehicle in a low-speed mode (LOW) and a high-speed mode (HIGH). A minimum interval of 2 seconds is required for switching between modes. The low-speed mode operates when the vehicle speed v is 0 to 90 km / h (v∈[0,90]), and in the low-speed mode, the vehicle speed v fluctuates within a range of -6 to 15 km / h per unit time (dv / dt∈[-6,15]). On the other hand, the high-speed mode operates when the vehicle speed v is 30 km / h or more (v≧30), and in the high-speed mode, the vehicle speed v fluctuates within a range of -6 to 7 km / h per unit time (dv / dt∈[-6,7]). Furthermore, a transition from low-speed mode to high-speed mode is possible only when v≧45, and a transition from high-speed mode to low-speed mode is possible only when v≦50. The duration of time in each mode is indicated by a timer parameter c. In this case, the automobile control system according to this embodiment can be represented by a hybrid automaton capable of expressing discrete mode changes of differential equations, as shown in FIG. 15. For example, assume that the acquisition unit 110 acquires three sampled observation values ​​v1=30 (t=1), v2=90 (t=6), and v3=100 (t=15) for an automobile controlled by the automobile control system, as shown in FIG. 16.

[0065] According to Example 2, the hybrid automaton of Fig. 15 is extended to a hybrid automaton including a transition to the unsatisfiable range N "v>120" as shown in Fig. 39. The upper half of the extended hybrid automaton represents the transition from the initial state (start) to the low-speed and high-speed states of the vehicle within the satisfyable range of the specification φ, and the lower half is a copy of the hybrid automaton of the upper half, representing the transition from the low-speed and high-speed states within the satisfyable range of the upper half to the low-speed and high-speed states of the vehicle after transitioning to the unsatisfiable range from the low-speed and high-speed states within the satisfyable range of the upper half. The reachable range of the hybrid automaton of the lower half corresponds to the reachable range after entering the dangerous range in the behavior shown in the hybrid automaton of the upper half.

[0066] Because the specific example of the thermostatic chamber control system described above was relatively simple, the monitoring process could be explained by calculating various ranges and illustrating the inclusion relationships. However, the control system to be monitored is not necessarily simple enough to be illustrated. In the automotive control system of this embodiment, the monitoring process using a hybrid automaton will be explained, rather than illustrating the inclusion relationships. The conditional expressions of the illustrated hybrid automaton can be calculated based on differential equations and set conditions, and may be calculated using any known library for polyhedron calculations, such as the Parma Polyhedra Library (PPL) (for details, see https: / / www.bugseng.com / parma-polyhedra-librar, etc.). In the following examples, for simplicity of explanation, only the calculation results of the conditional expressions, etc., using polyhedron calculations will be shown.

[0067] First, for the first time point (i=1), the judgment unit 120 sets the slow state of the upper half of the hybrid automaton corresponding to the observation value v1=30(t=1) at the first time point (t=1) as the initial state, as shown in FIG. 39.

[0068] If time passes in this initial state, the range of vehicle speed v that can be achieved in the forward direction by the second time point (t=6) is -(6t-1)+30≦v≦15(t-1)+30, that is, -6t+36≦v≦15t+15, as shown in Figure 40.

[0069] Next, assuming that the process transitions from the initial slow state to the fast state of the upper half of the hybrid automaton, the determination unit 120 derives t∈[3,6], v∈[45,90], v≦15t+15 from the source slow state and the transition constraints v≧45, c≧2, as shown in FIG. 41, and the timer parameter c is reset to 0.

[0070] Assuming that time has passed in this high-speed state, the determination unit 120 can derive the reachable range v+8c≦15t+15,3≦c+3≦t≦6,30≦v,v∈[45-6c,90+7c] by eliminating t and v from the derived t∈[3,6],v∈[45,90],v≦15t+15, the high-speed state differential equation t'=t+c,v'∈[v-6c,v+7c] (where t' is the time after the high-speed state transition and v is the speed at the time of the high-speed state transition) and the time constraints t'≦6,0≦c, as shown in Figure 42.

[0071] Next, the determination unit 120 can determine that the unsatisfied range N "v>120" is unreachable from the derived reachable range t=c+1∈[1,6],v∈[0,90],-6t+36≦v≦15t+15 and the reachable range v+8c≦15t+15,3≦c+3≦t≦6,30≦v,v∈[45-6c,90+7c]. That is, the upper limit of the vehicle speed v at t=6 after transition to the high-speed state is v=90+7×3=111, which is less than 120.

[0072] Then, the determination unit 120 determines whether the reachable range in the upper half of the hybrid automaton includes v2=90(t=6). As shown in Fig. 43, the upper limit of the vehicle speed v at t=6 in the low speed state is 15×6+15=105, and the upper limit of the vehicle speed v at t=6 in the high speed state is 111, so the determination unit 120 determines that v2=90(t=6) is reachable.

[0073] Next, for the second time point (i=2), the determination unit 120 sets the slow state and fast state of the upper half of the hybrid automaton corresponding to the observation value v2=00 (t=6) at the second time point (t=6) as the initial states, as shown in Fig. 44. In the slow state, t=6, c=5, v=90, and in the fast state, t=6, 0≦c≦15 / 8, v=90.

[0074] As time passes in each state, the range of vehicle speed v that can be reached in the forward direction by the third point in time (t=15) is 90-6(t-6)≦v≦90 in the low-speed state, and 90-6(t-6)≦v≦90+7(t-6) in the high-speed state, as shown in Figure 45.

[0075] Then, assuming a transition from a low-speed state to a high-speed state, the judgment unit 120 derives t∈[6,15], v∈[45,90], 90-6(t-6)≦v from the source low-speed state and the transition constraints v≧45, c≧2, as shown in FIG. 46, and the timer parameter c is reset to 0.

[0076] Assuming that time has passed in this high-speed state, the determination unit 120 can derive the reachable ranges t∈[6,15], 0≦c≦15 / 8+(t−6), 90-6(t−6)≦v≦90+7(t−6), v≦90+7c, 45≦v+6c from the derived t∈[6,15], v∈[45,90], 90-6(t−6)≦v, c=0, the differential equation for the high-speed state, and the time constraints, as shown in Fig. 47. Here, the upper limit of the vehicle speed v is 90+7(15−6)=153, which may belong to the unsatisfied range "v>120."

[0077] 48, the determination unit 120 determines that the current state has transitioned from the fast state of the upper half hybrid automaton to the lower half hybrid automaton due to the unsatisfied range, and copies the constraints of the fast state of the upper half hybrid automaton to the constraints of the lower half hybrid automaton, with the addition of v≧120.

[0078] If time passes while the lower half of the hybrid automaton is in a high-speed state, the range of vehicle speed v that can be reached in the forward direction by the third time point (t=15) is v≦7t+48, v−90≦7c, 33≦8(tc), t≦15, 1272≦7v+42t, 1020≦7v+42c, as shown in FIG. 49.

[0079] The derived range of vehicle speed v includes v3=100 at t=15, c=10, so the judgment unit 120 can determine that the derived range can reach the unsatisfied range N "v>120", and determines that the automobile control system does not satisfy the specification φ. [Variations] In the above-described embodiment, the observation values ​​were one-dimensional values ​​such as temperature and vehicle speed, but the observation values ​​according to the present disclosure are not limited to this and may be vector values ​​of two or more dimensions, such as a pair of temperature and humidity, or the positions of N vehicles.

[0080] As an example of application of such two-dimensional or more observation vectors, monitoring of the distance between two vehicles when two vehicles are traveling in a convoy is considered. i is the position of vehicle i) is always greater than or equal to 1. The specification is monitored based on the observed vector of the traveling position of each vehicle sampled every 10 seconds.

[0081] The vehicle control system according to this embodiment switches between the normal mode (NORMAL) and the vehicle distance ensuring mode (WIDEN) to maintain the vehicle distance between two vehicles. The switch to the vehicle distance ensuring mode is possible only when x1 - x2 ≤ 4, and the switch to the normal mode is possible only when x1 - x2 ≥ 4. The vehicle speed in the normal mode is dx1 / dt ∈ [7.5, 8.5], dx2 / dt ∈ [8.0, 9.0], and the vehicle speed in the vehicle distance ensuring mode is dx1 / dt ∈ [11.0, 13.0], dx2 / dt ∈ [9.0, 11.0]. In this case, the hybrid automaton can be described by a state transition diagram as shown in FIG. 50.

[0082] For example, assume that at the first time point (t = 0), x1 = 40 and x2 = 25, at the second time point (t = 10), x1 = 123 and x2 = 25, and at the third time point (t = 20), x1 = 203 and x2 = 201. At this time, the hybrid automaton shown in FIG. 50 is extended to include the hybrid automaton regarding the non-satisfaction range as shown in FIG. 51.

[0083] First, regarding the first time point (i = 1), the determination unit 120 sets the normal mode of the upper half hybrid automaton corresponding to the observation vector x1 = 40, x2 = 25 at the first time point (t = 0) as the initial state as shown in FIG. 52.

[0084] Assuming that time has passed in this initial state, the range of the observable vectors that can be reached in the forward direction by the second time point (t = 10) is x1 ∈ [40 + 7.5t, 40 + 8.5t], x2 ∈ [25 + 8.0t, 25 + 9.0t] as shown in FIG. 53.

[0085] Next, assuming a transition from the normal mode of the initial state to the vehicle distance ensuring mode of the upper half hybrid automaton, the determination unit 120 derives 0 < t ≤ 10, x1 - x2 ≤ 4, x1 ∈ [40 + 7.5t, 40 + 8.5t], x2 ∈ [25 + 8.0t, 25 + 9.0t] from the normal mode of the transition source and the constraints of the transition as shown in FIG. 54.

[0086] Assuming that time has elapsed in this inter-vehicle distance ensuring mode, as shown in FIG. 55, the determination unit 120 can derive the reachable range: 0 < t ≦ 10, x1 ≦ 13t - 1 / 3, -x1 + 11 / 3x2 - 20t ≧ 92, x2 ≦ 11t + 31 / 3, 4x1 - 7x2 + 33t ≧ -15, x1 ≧ 7.5t + 40.

[0087] The determination unit 120 determines whether the specification "x1 - x2 is always 1 or more" is satisfied from the reachable ranges of the normal mode and the inter-vehicle distance ensuring mode derived in this way. If the specification is satisfied, the determination unit 120 derives the reachable range for the observation vector at the second time point in the same way and determines whether the specification is satisfied. On the other hand, if the specification is not satisfied, the determination unit 120 determines that the vehicle control system does not satisfy the specification.

[0088] Also, the above calculation of the reachable range may be applied to a linear hybrid automaton. Here, a linear hybrid automaton is one in which the derivative of each observed value is a1dx1 / dt + ··· + a n dx n / dt ≦ c given in the form of. In the case of a hybrid automaton that exceeds the range of a linear hybrid automaton, the exact reachable range cannot be calculated. For example, there are hybrid automata including differential equations such as dx / dt = 1 / x. However, even such a hybrid automaton can be handled by approximation.

[0089] For example, for dx / dt = -0.01x + 0.005y + 2, x ∈ [0, 100], y ∈ [0, 100], etc., a1dx1 / dt + ··· + a n dx n / dt ≦ c Since it is not a linear hybrid automaton given in the form of, exact reachability analysis of a hybrid automaton including such a differential equation is impossible. However, using y ∈ [0, 100], dx / dt∈[-0.01x+2,-0.01x+100*0.005+2]=[-0.01x+2,-0.01x+2.5] and using x∈[0,100], dx / dt∈[1,2.5] The present disclosure can be applied by eliminating unnecessary variables as shown in the figure. Eliminating such variables can be achieved by, for example, the Fourier-Motzkin elimination method (for details, see Frehse, Goran. "An introduction to hybrid automata, numerical simulation and reachability analysis." Formal Modeling and Verification of Cyber-Physical Systems. Springer Vieweg, Wiesbaden, 2015. pp. 50-81).

[0090] The specification may also be related to the passage of time. In the above-described embodiments, the specification is fixed and independent of time, but the present disclosure is also applicable to specifications that depend on the passage of time. For example, with respect to an automobile control system, the specification φ may be, "It is not good to satisfy v<30 at a certain time point a, and then always satisfy v>90 from a subsequent time point b onwards." Such a specification φ can be described, for example, by a hybrid automaton as shown in FIG. 56. For example, in an automobile control system that controls an automobile in two operating states, a hybrid automaton that takes the specification φ into consideration can be described by a state transition diagram as shown in FIG. 57. That is, in the hybrid automaton in the top layer including the initial state, when the vehicle speed v becomes less than 30 at time point a, the state transitions to the hybrid automaton in the middle layer. Then, when the vehicle speed v becomes higher than 90 at time point b, the state transitions to the hybrid automaton in the lowest layer. In this way, a specification φ that depends on the passage of time can be described by a hybrid automaton.

[0091] Although the examples of the present invention have been described in detail above, the present invention is not limited to the specific embodiments described above, and various modifications and variations are possible within the scope of the gist of the present invention as set forth in the claims.

[0092] This international application claims priority based on Japanese Patent Application No. 2020-215603, filed on December 24, 2020, the entire contents of which are hereby incorporated by reference into this international application. [Explanation of symbols]

[0093] 100 Monitoring Device 110 Acquisition Department 120 Judgment section

Claims

1. an acquisition unit that acquires sampled observations of control system behavior during system operation; a determination unit that determines an attainable range of the observed value in the time axis direction based on the observed value using a mathematical model constructed based on the control system behavior, and determines whether the fluctuation range of the observed value satisfies the specification based on an overlap range between the attainable range of the observed value and a non-satisfying range of the specification; and The determination unit determines a first reachable range that is reachable in the forward direction from the observation value at the i-th time point to the (i+1)-th time point, and a second reachable range that is reachable in the reverse direction from the observation value at the (i+1)-th time point to the i-th time point, and determines whether the variation range satisfies the specification based on whether a first overlapping range exists between the common range of the first reachable range and the second reachable range and the non-satisfying range of the specification.

2. An acquisition unit that acquires sampled observation values ​​regarding control system behavior during system operation; a determination unit that determines an attainable range of the observed value in the time axis direction based on the observed value using a mathematical model constructed based on the control system behavior, and determines whether the fluctuation range of the observed value satisfies the specification based on an overlap range between the attainable range of the observed value and a non-satisfying range of the specification; and The determination unit determines a third reachable range that is reachable in the forward direction on the time axis from the observation value at the i-th time point, determines a second overlapping range between the third reachable range and a range in which the specification is not satisfied, and determines whether the variation range satisfies the specification based on whether the observation value at the (i+1)-th time point is included in a fourth reachable range that is reachable in the forward direction on the time axis from the second overlapping range.

3. 3. The monitoring device according to claim 1, wherein the control system is described by a first hybrid automaton.

4. 4. The monitoring device according to claim 3, wherein each state of the first hybrid automaton is defined by a corresponding operation mode and a differential equation that indicates the fluctuation of the observed value with respect to a small change in time.

5. The monitoring device according to claim 2 , wherein the determination unit uses a second hybrid automaton derived by adding unsatisfied states of the specification to states of a first hybrid automaton describing the control system.

6. obtaining sampled observations of control system behavior during system operation; determining an attainable range of the observed value in the time axis direction based on the observed value using a mathematical model constructed based on the control system behavior, and determining whether the fluctuation range of the observed value satisfies the specification based on the overlap range between the attainable range of the observed value and a range where the specification is not satisfied; The computer executes The determining step determines a first reachable range that is reachable in the forward direction from the observation value at time i to time (i+1) and a second reachable range that is reachable in the reverse direction from the observation value at time (i+1) to time i, and determines whether the variation range satisfies the specification based on whether there is a first overlapping range between the common range of the first reachable range and the second reachable range and the non-satisfying range of the specification.

7. A step of obtaining sampled observations of control system behavior during system operation; determining an attainable range of the observed value in the time axis direction based on the observed value using a mathematical model constructed based on the control system behavior, and determining whether the fluctuation range of the observed value satisfies the specification based on the overlap range between the attainable range of the observed value and a range where the specification is not satisfied; The computer executes A monitoring method in which the determining step determines a third reachable range that is reachable in a forward direction on the time axis from the observed value at time i, determines a second overlapping range between the third reachable range and a range in which the specification is not satisfied, and determines whether the variation range satisfies the specification based on whether the observed value at time (i+1) is included in a fourth reachable range that is reachable in a forward direction on the time axis from the second overlapping range.

8. 8. The monitoring method according to claim 6 or 7, wherein the control system is described by a first hybrid automaton.

9. 9. The monitoring method according to claim 8, wherein each state of the first hybrid automaton is defined by a corresponding operation mode and a differential equation that indicates the fluctuation of the observed value with respect to a small change in time.

10. 8. The monitoring method of claim 7, wherein the determining step utilizes a second hybrid automaton derived by adding unsatisfied states of the specification to states of a first hybrid automaton describing the control system.

Images