Anomaly detection device, anomaly detection system, anomaly detection method, and program

Abstract

To provide an anomaly detection system capable of setting weights for signals used for anomaly determination in anomaly detection.SOLUTION: An anomaly detection system includes: a signal acquisition unit that acquires multiple signals indicating the status of a plant; a setting unit that sets the anomaly level according to the number of signals whose values are outside a permissible range among the multiple signals; and an anomaly determination unit that compares the multiple signals with a permissible range defined for each signal and calculates the number of signals that are outside the permissible range, calculates an anomaly level according to the calculated number of signals based on the calculated number of signals and the anomaly level setting, and determines an anomaly in the plant based on the calculated anomaly level.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to an abnormality detection device, an abnormality detection system, an abnormality detection method, and a program.

Background Art

[0002] Patent Document 1 discloses an abnormality monitoring system that monitors plant abnormalities using a plurality of abnormality determination methods. In this system, for example, detection models for detecting abnormalities are constructed for each method such as the MT method, the k-nearest neighbor method, the neural network method, the generalized linear method, the SVM method, and the random forest method, and abnormality detection is performed by each detection model. Then, weights are assigned to the detection results of each detection model to make a comprehensive determination of normal or abnormal. For example, for detection models 1 to 4, weight a is assigned to detection model 1, weight b to detection model 2, weight c to detection model 3, and weight d to detection model 4. When detection models 1 to 2 determine normal and detection models 3 to 4 determine abnormal, if a + b > c + d, the plant is determined to be normal, and if a + b < c + d, the plant is determined to be abnormal.

[0003] Here, let's assume that the detection model A determines anomalies by the following process. Specifically, detection model A acquires eight types of signals 1 to 8 measured at the plant. It then estimates the value of signal 4 from the measured values ​​of signals 1 to 3, and estimates the value of signal 8 from the measured values ​​of signals 5 to 7. If the deviation between the estimated value and the measured value of signal 4 is greater than or equal to a threshold, or if the deviation between the estimated value and the measured value of signal 8 is greater than or equal to a threshold, it is determined to be an anomaly. Furthermore, let's assume that the measured value of signal 4 tends to have a large variability. In that case, even though the value of signal 4 is actually normal, the large variability may cause the deviation between the estimated value and the measured value of signal 4 to exceed the threshold, resulting in detection model A judging it to be an anomaly. According to the method in Patent Document 1, it can be understood that weighting is applied to detection model A taking such risks into consideration, but it cannot suppress false detections by detection model A itself. For example, if detection model A is given a relatively small weight to account for false positives due to the instability of signal 4, there is a risk that detection model A's correct detection of an anomaly may be overlooked. In contrast, if the anomaly determination can be made by weighting the signals used for anomaly detection, rather than the model used for anomaly detection, it is thought that more accurate anomaly detection can be achieved. For example, if detection model A in the above example can be given different weights for its determination results depending on whether it determines an anomaly based on 1) signal 4, 2) signal 8, or 3) both signal 4 and signal 8 (for example, weighting such that 2) is considered to be more likely to be an anomaly than 1), it is thought that this will lead to more accurate anomaly detection. [Prior art documents] [Patent Documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2019-091113 [Overview of the project] [Problems that the invention aims to solve]

[0005] It is believed that more accurate anomaly detection can be achieved if the anomaly determination is weighted based on the signals used for anomaly detection, rather than on the model used for anomaly detection.

[0006] This disclosure provides an anomaly detection device, an anomaly detection system, an anomaly detection method, and a program that can solve the above-mentioned problems. [Means for solving the problem]

[0007] An anomaly detection device according to this disclosure includes: a signal acquisition unit that acquires a plurality of signals indicating the state of a plant; a setting unit that sets an anomaly level corresponding to the number of signals that fall outside a threshold range among the plurality of signals; and an anomaly determination unit that compares the plurality of signals with a threshold predetermined for each of the signals to calculate the number of signals that fall outside the threshold range, calculates an anomaly level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the anomaly level, and determines an anomaly in the plant based on the calculated anomaly level. The setting unit calculates the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal for each of the plurality of signals, classifies the plurality of signals into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold, and may set a smaller anomaly level for the same number of signals compared to the case where the number of signals greater than or equal to the first threshold is greater than the number of signals less than the first threshold. The setting unit, upon inputting learning data having multiple data points for multiple signals used to construct the estimation model into a predetermined estimation model, determines for each signal whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, calculates the number of signals that exceed the predetermined value, sets the calculated number of signals as the first number of signals which are outside the first acceptable range, divides the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals equally and rounds up the fractional part, and sets the second number of signals which are outside the second acceptable range, a predetermined value determined considering the possibility of false detection of an abnormality in the plant, may be set as the abnormality level when the number of signals which are outside the acceptable range is equal to or greater than the first number of signals and less than the second number of signals. Furthermore, the abnormality detection device of this disclosure includes: a signal acquisition unit that acquires a plurality of signals indicating the state of the plant; a setting unit that sets a correspondence between the range of the number of signals whose values ​​are outside the allowable range and the abnormality level; and an abnormality determination unit that compares the plurality of signals with the allowable range defined for each of the signals to calculate the number of signals that are outside the allowable range, calculates the abnormality level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of the number of signals and the abnormality level, and determines an abnormality in the plant based on the calculated abnormality level. The relationship between the range of the number of signals that fall outside the acceptable range and the abnormality level is set according to how many of the multiple signals have a large variation in value, and the abnormality level set in the relationship is a weighting of how likely it is that the values ​​of the number of signals included in the range fall outside the acceptable range, and when comparing the case in which a predetermined number of the multiple signals have a large variation with the case in which no signals have a large variation, a higher abnormality level is set for the case in which no signals have a large variation than for the case in which a predetermined number of signals have a large variation in value, for the range below the predetermined number, a higher abnormality level is set for the case in which no signals have a large variation than for the case in which a predetermined number of signals have a large variation.

[0008] The anomaly detection system of this disclosure includes the anomaly detection device and a notification device, the notification device comprising: an acquisition unit that acquires information relating to an anomaly detected by the anomaly detection device; a setting unit that accepts the setting of anomalies to be notified; and a notification unit that notifies the anomaly to be notified when the information relating to the anomaly acquired by the acquisition unit includes the anomaly to be notified.

[0009] The abnormality detection method of this disclosure includes the steps of: acquiring a plurality of signals indicating the state of a plant; setting an abnormality level corresponding to the number of signals whose values ​​are outside an acceptable range among the plurality of signals; comparing the plurality of signals with the acceptable range defined for each of the signals to calculate the number of signals that are outside the acceptable range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level. In the setting step, for each of the plurality of signals, the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal is calculated, and the plurality of signals are classified into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold, and if the number of signals whose standard deviation is greater than or equal to the first threshold is greater than or equal to the number of signals whose standard deviation is less than the first threshold, a smaller abnormality level may be set for the same number of signals compared to the case where the number of signals whose standard deviation is greater than or equal to the first threshold is less than or equal to the number of signals whose standard deviation is less than the first threshold. In the setting step, when a predetermined estimation model is input to a predetermined estimation model, learning data having multiple data points for multiple signals used to construct the estimation model is used to determine whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, the number of signals whose deviation exceeds the predetermined value is calculated, and the calculated number of signals is set as the first number of signals which is the number of signals which is outside the first acceptable range. The value obtained by subtracting the first number of signals from the total number of signals of the multiple signals is divided equally and rounded up is set as the second number of signals which is the number of signals which is outside the second acceptable range. When the number of signals which is outside the acceptable range is greater than or equal to the first number of signals and less than the second number of signals, a predetermined value may be set as the abnormality level, taking into consideration the possibility that an abnormality in the plant may be falsely detected. Furthermore, the abnormality detection method of this disclosure includes the steps of: acquiring a plurality of signals indicating the state of the plant; setting a correspondence between the range of the number of signals whose values ​​are outside the acceptable range and the abnormality level; comparing the plurality of signals with the acceptable range defined for each of the signals to calculate the number of signals that are outside the acceptable range; calculating the abnormality level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of the number of signals and the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level. The relationship between the range of the number of signals that fall outside the acceptable range and the abnormality level is set according to how many of the multiple signals have a large variation in value, and the abnormality level set in the relationship is a weighting of how likely it is that the values ​​of the number of signals included in the range fall outside the acceptable range, and when comparing the case in which a predetermined number of the multiple signals have a large variation with the case in which no signals have a large variation, a higher abnormality level is set for the case in which no signals have a large variation than for the case in which a predetermined number of signals have a large variation in value, for the range below the predetermined number, a higher abnormality level is set for the case in which no signals have a large variation than for the case in which a predetermined number of signals have a large variation.

[0010] The program of this disclosure causes a computer to perform the following steps: acquire a plurality of signals indicating the status of a plant; set an abnormality level corresponding to the number of signals whose values ​​are outside an acceptable range; compare the plurality of signals with the acceptable range defined for each of the signals to calculate the number of signals that are outside the acceptable range; calculate the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determine an abnormality in the plant based on the calculated abnormality level. In the setting step, for each of the plurality of signals, the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal is calculated, and the plurality of signals are classified into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold. If the number of signals whose standard deviation is greater than or equal to the first threshold is greater than the number of signals whose standard deviation is less than the first threshold, a smaller abnormality level may be set for the same number of signals compared to the case where the number of signals whose standard deviation is greater than or equal to the first threshold is less than the number of signals whose standard deviation is less than the first threshold. In the setting step, when a predetermined estimation model is input to a predetermined estimation model, learning data having multiple data points for multiple signals used to construct the estimation model is used to determine whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, the number of signals whose deviation exceeds the predetermined value is calculated, and the calculated number of signals is set as the first number of signals which is the number of signals which is outside the first acceptable range. The value obtained by subtracting the first number of signals from the total number of signals of the multiple signals is divided equally and rounded up is set as the second number of signals which is the number of signals which is outside the second acceptable range. When the number of signals which is outside the acceptable range is greater than or equal to the first number of signals and less than the second number of signals, a predetermined value may be set as the abnormality level, taking into consideration the possibility that an abnormality in the plant may be falsely detected. Furthermore, the program of this disclosure includes the steps of: obtaining a plurality of signals indicating the status of a plant from a computer; setting a correspondence between the range of the number of signals whose values ​​are outside an acceptable range and an abnormal level; comparing the plurality of signals with the acceptable range defined for each of the signals to calculate the number of signals that are outside the acceptable range; calculating the abnormal level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of the number of signals and the abnormal level; and determining an abnormality in the plant based on the calculated abnormal level. The correspondence between the range of the number of signals that fall outside the allowable range and the abnormality level is set according to how many of the plurality of signals have large value variations, and the abnormality level set in the correspondence is a weighting of how likely it is that the values ​​of the number of signals included in the range fall outside the allowable range, and when comparing the case in which a predetermined number of the plurality of signals have large variations with the case in which no signals have large variations among the plurality of signals, a higher abnormality level is set for the case in which no signals have large variations than for the case in which a predetermined number of signals have large variations. Make it run. [Effects of the Invention]

[0011] According to the anomaly detection device, anomaly detection system, anomaly detection method, and program of this disclosure, it is possible to set weights (anomaly levels) for signals that are to be judged as anomalies in anomaly detection. [Brief explanation of the drawing]

[0012] [Figure 1] Block diagram is an example of an anomaly detection system according to each embodiment. [Figure 2] This is a flowchart showing an example of the modeling process according to the first embodiment. [Figure 3] This figure shows an example of an anomaly detection method according to the first embodiment. [Figure 4] This figure shows an example of setting the execution conditions for the anomaly detection method according to the first embodiment. [Figure 5] This figure shows an example of setting up training data according to the first embodiment. [Figure 6] This figure shows an example of a screen for setting anomaly detection conditions according to the first embodiment. [Figure 7] An example of an anomaly detection condition file according to the first embodiment is shown. [Figure 8] This is a flowchart showing an example of an anomaly detection process according to the first embodiment. [Figure 9]It is a diagram showing an example of a list screen of abnormality detection results according to the first embodiment. [Figure 10] It is a flowchart showing an example of modeling processing according to the second embodiment. [Figure 11] It is a diagram showing an example of a proposed screen of a distribution pattern according to the second embodiment. [Figure 12] It is a diagram showing an example of the hardware configuration of an abnormality detection system according to each embodiment.

MODE FOR CARRYING OUT THE INVENTION

[0013] Hereinafter, the setting of abnormality detection conditions according to the embodiments and the abnormality detection based on the abnormality detection conditions will be described in detail with reference to the drawings. (System Configuration) FIG. 1 is a block diagram showing an example of an abnormality detection system according to each embodiment. The abnormality detection system 20 includes an abnormality detection device 10, a display device 2, and other devices 3. The abnormality detection device acquires various signals representing the state of the plant 1 from sensors installed in each device constituting the plant 1 during operation, and performs abnormality detection based on the acquired signals. In performing abnormality detection, a learned model for abnormality detection is used. When this model determines whether there is an abnormality based on a plurality of signals acquired from the plant 1, weight is assigned to those signals for abnormality determination.

[0014] As shown in the figure, the abnormality detection device 10 has a signal acquisition unit 11, an input reception unit 12, a control unit 13, and a storage unit 18. The signal acquisition unit 11 acquires signals such as temperature, pressure, rotation speed, and vibration from sensors installed in each device constituting the plant 1. The plant 1 and the abnormality detection device 10 are connected by a communication line 4, and various signals can be acquired in real time from the operating plant 1. Further, the signal acquisition unit 11 acquires signals (learning data) measured in the past, which are used for constructing the model used for abnormality detection.

[0015] The input receiving unit 12 is configured using input devices such as a keyboard, mouse, touch panel, and buttons. The input receiving unit 12 receives input from the user to the anomaly detection device 10 using the input device and outputs the input information to the control unit 13.

[0016] The control unit 13 controls the operation of the anomaly detection device 10. The control unit 13 includes a setting unit 14, a learning unit 15, an anomaly determination unit 16, and an anomaly notification unit 17.

[0017] The setting unit 14 performs various settings necessary for building the model used for anomaly detection, as well as various settings necessary for anomaly detection. The specific settings will be described later, but for example, the setting unit 14 sets the weighting for signals, which signals to use for anomaly detection determination, and which signals to use as explanatory variables for estimating the values ​​of the signals used for anomaly determination. The setting unit 14 has a function to acquire setting information entered by the user and perform various settings (first embodiment) and a function to perform settings automatically (second embodiment). In addition, the setting unit 14 creates a setting screen for the user to input setting information and outputs it to the display device 2.

[0018] The learning unit 15 learns from the signals (learning data) acquired by the signal acquisition unit 11 based on the settings set by the setting unit 14 and constructs a model. For example, the learning unit 15 may construct a normal model (e.g., a unit space in the MT method) by learning from signals collected when plant 1 is in a normal state, or it may construct an estimation model that estimates the value of a signal used for anomaly detection from one or more signals.

[0019] The abnormality determination unit 16 determines an abnormality in plant 1 based on the model constructed by the learning unit 15 and the signals acquired by the signal acquisition unit 11. When determining an abnormality using the normal model, the abnormality determination unit 16 compares the monitored signal with the normal model. If the monitored signal falls within the range considered normal based on the normal model, plant 1 is determined to be normal; otherwise, plant 1 is determined to be abnormal. When using the estimation model, the abnormality determination unit 16 inputs the signal set as an explanatory variable into the estimation model to estimate the value of the signal used for abnormality determination. If the deviation between the estimated value and the measured value of the signal used for abnormality determination is greater than or equal to a threshold, plant 1 is determined to be abnormal; otherwise, plant 1 is determined to be normal. The abnormality determination unit 16 performs abnormality determination using either the normal model or the estimation model, or both. When both are used, the abnormality determination unit 16 weights the determination result from the normal model and the determination result from the estimation model to make the final abnormality determination. Furthermore, when the anomaly detection unit 16 performs anomaly detection using an estimation model, it considers the weighting of the signals used for anomaly detection. Details of the anomaly detection that considers the weighting of the signals will be described later. The anomaly detection unit 16 also records the result of the anomaly detection in the storage unit 18.

[0020] The abnormality notification unit 17 outputs information related to the abnormality detected by the abnormality determination unit 16 to the display device 2 or transmits it to other devices 3 via the communication line 5. For example, the abnormality notification unit 17 may generate a list screen of abnormality detection results and output this list screen to the display device 2. The information related to the abnormality includes, for example, the determination result by the abnormality determination unit 16, the time when the abnormality was determined, identification information of the signal that was determined to be abnormal, and the abnormality level.

[0021] The memory unit 18 stores various information, such as signals acquired by the signal acquisition unit 11 and the results of the abnormality determination unit 16.

[0022] Display device 2 is a device that displays the abnormality detected by the abnormality detection device 10 and its details, such as an LCD (Liquid Crystal Display) or an organic EL (Electro Luminescence) display device. Other device 3 comprises an input / output unit 31, a setting unit 32, a notification unit 33, and a storage unit 34. The input / output unit 31 inputs or outputs various types of data to and from other devices. For example, the input / output unit 31 is composed of input devices such as a keyboard, mouse, touch panel, and buttons, as well as input / output interfaces with other devices. The input / output unit 31 receives input from the user using an input device, acquires information related to an anomaly detected by the anomaly detection device 10, and outputs data to the notification unit 33. The settings unit 32 configures the abnormalities to be notified, for example, what kind of abnormalities should trigger a notification, and what kind of information should be notified. The notification unit 33 is comprised of notification means such as a display device, a patrol lamp, and a buzzer. Based on the settings made by the setting unit 32, the notification unit 33 uses the notification means to notify the abnormality to be notified when the abnormality to be notified is included in the abnormality information acquired by the input / output unit 31. For example, if the notification means is a display device, the notification unit 33 displays the plant name of the plant where the abnormality occurred, the time of the abnormality occurrence, the abnormality level, etc. The memory unit 34 stores setting information set by the setting unit 32, information related to abnormalities obtained from the abnormality detection device 10, and the like.

[0023] <First Embodiment> (Modeling process) Next, the modeling process according to the first embodiment will be described with reference to Figures 2 to 7. Figure 2 is a flowchart showing an example of the modeling process according to the first embodiment. The signal acquisition unit 11 acquires time-series signals measured in the past, which serve as training data, and these signals are stored in the storage unit 18. These signals are those measured when plant 1 is operating normally. First, the user selects the signals to build the model (step S1). For example, if 10 types of signals are needed for anomaly detection, the user selects 10 types of signals from the training data, and then, for the signals that need to be estimated by the estimation model, selects the types of signals necessary for estimating those signals (signals that will be explanatory variables). The user inputs the selected signal types into the anomaly detection device 10. The setting unit 14 records the signal types input by the user into the storage unit 18 via the input reception unit 12.

[0024] Next, the user sets the anomaly detection method (step S2). For example, the user selects one of three patterns: (a) MT method (Mahalanovistaguchi method), (b) estimation method, or (c) MT method + estimation method, and inputs it into the anomaly detection device 10. Figure 3 shows an example of an anomaly detection method. For example, anomaly detection methods include the MT method, multiple regression, ridge regression, kernel ridge regression, and random forest. Of these, all except the MT method are estimation methods. An estimation method is a method in which, for example, an estimation model constructed by multiple regression is input with a signal that will be an explanatory variable, and the estimated value of the signal output by the estimation model is compared with the measured value of the same signal obtained from plant 1, and anomalies are detected by the difference. The MT method can be set simultaneously with other methods, but multiple regression to random forest estimation methods cannot be used together. If the user selects (b) or (c), they select one from multiple regression to random forest and input it into the anomaly detection device 10. The setting unit 14 records the anomaly detection method entered by the user in the storage unit 18 via the input reception unit 12. For example, the storage unit 18 stores an anomaly detection method file as illustrated in Figure 3. In the anomaly detection method file in Figure 3, "1" is set for methods used for anomaly detection, and "0" is set for methods not used.

[0025] Next, the user selects the signals to be used in the estimation method (step S3). If the user selected (b) or (c) in step S2, the user sets the signals to be used as explanatory variables and the signals to be used as the target variable (signals used for anomaly detection) in the estimation method from among the signals selected in step S1. The setting unit 14 records the settings of the signals to be used as explanatory variables and the signals to be used as the target variable, which the user has entered, in the storage unit 18 via the input reception unit 12. If the user selected (a) or (c) in step S2, the user may select the signals to be used in the MT method from among the signals selected in step S1 if not all of them are used in the MT method.

[0026] Next, the user sets the execution conditions for the anomaly detection method (step S4). The user inputs the conditions for performing anomaly detection during the actual anomaly detection period (operation phase) after the model has been built. An example of the execution conditions is shown in Figure 4. For example, if Plant 1 is a power plant, the user sets "Power Plant Monitoring Model" as the model name, "Power Generation Amount" as the signal used for execution decision, and the range of power generation amount "X1~X2 (kW)" as the execution condition for anomaly detection. The setting unit 14 records the execution conditions for anomaly detection entered by the user in the storage unit 18 via the input reception unit 12. This setting makes it possible to suppress unnecessary anomaly detection, for example, when Plant 1 is in an operating state that is not subject to monitoring.

[0027] Next, the user sets the data to be used to build the model (step S5). An example of setting the training data is shown in Figure 5. For example, the user sets the data measured from 2021 / 10 / 1 to 2021 / 10 / 10 for signals A, B, C, ... set in steps S1 and S3 to be used as training data. The setting unit 14 records the range of data entered by the user in the storage unit 18 through the input reception unit 12.

[0028] Next, the user sets the upper and lower limits of the signals to be used to build the model (step S6). For example, if plant 1 is a power plant, the user sets a lower limit X3 and an upper limit X4 for the signal "power generation amount". The setting unit 14 records the range of data (upper and lower limits) entered by the user in the storage unit 18 via the input reception unit 12. With this setting and the setting in step S5, only signals measured within the range of 2021 / 10 / 1 to 2021 / 10 / 10 (set in step S5) and where the value of the signal "power generation amount" measured at that time is within the range of X3 to X4 will be used as training data.

[0029] Next, the user sets whether or not to sample the training data (step S7). For example, if each signal in the training data is measured every second, the user can set whether to sample values ​​every minute or to exclude outliers. The setting unit 14 records the sampling setting information entered by the user in the storage unit 18 via the input reception unit 12.

[0030] Next, the setting unit 14 draws histograms and correlation diagrams (step S8). The setting unit 14 extracts signals from the training data to be used to build the model according to the settings up to step S7, creates histograms for each signal and correlation diagrams between signals, and outputs the created histograms, etc. to the display device 2. The user checks whether the signals used as training data are appropriate by referring to the histograms and correlation diagrams displayed on the display device 2. If inappropriate signals are included, the user selects appropriate training data by readjusting the settings from steps S5 to S7.

[0031] Next, the user sets the abnormality determination conditions for the MT method (step S9). Specifically, the user sets abnormality determination information related to the MT method (i.e., a threshold for the MD value) as the abnormality determination conditions for the MT method. In the MT method, if the MD value is greater than or equal to the threshold set here, it is determined to be abnormal. Figure 6 shows an example of the abnormality detection condition setting screen 100. For example, the user enters the MD value threshold in setting field 101a and the threshold for the duration of the state in which the MD value is greater than or equal to the threshold, which is another condition for determining an abnormality, in setting field 101b. The setting unit 14 records the MD value threshold and other information entered by the user in the storage unit 18 through the input reception unit 12.

[0032] Next, the user sets the anomaly detection conditions for the estimation method (step S10). Specifically, the user sets the anomaly detection information related to the estimation method (i.e., the threshold for the deviation between the estimated value and the measured value of the signal: the deviation threshold) as the anomaly detection conditions for the estimation method. For example, the user sets this deviation threshold to 3σ. This deviation threshold can be set for each signal. For example, the user enters the deviation threshold for each signal in the setting field 102 of the setting screen 100. The setting unit 14 records the deviation threshold for the estimation method entered by the user in the storage unit 18 via the input reception unit 12.

[0033] Next, the user sets the distribution of anomaly levels to be added for the set anomaly detection method (step S11). For example, if there is only one type of anomaly estimation method, that is, (a) MT method or (b) estimation method, the user sets 100% for (a) MT method and 100% for (b) estimation method. For example, in the case of (a), the user enters "100" in the setting field 103, and in the case of (b), the user enters "0" in the setting field 103. Also, in the case of (c) MT method + estimation method, if the user sets 40% for the MT method and 60% for the estimation method, the user enters "40" in the setting field 103. Setting 40% for the MT method and 60% for the estimation method means that the judgment result of anomaly detection by the MT method is given a 40% weight, and the judgment result of anomaly detection by the estimation method is given a 60% weight. The setting unit 14 records the distribution of anomaly levels entered by the user in the storage unit 18 through the input reception unit 12. The memory unit 18 may also have default settings registered, such as (a) 100% for the MT method, (b) 100% for the estimation method, and (c) 40% for the MT method and 60% for the estimation method.

[0034] Next, the user sets anomaly judgment information related to the signal for the estimation method settings (for example, setting three patterns of anomaly levels to be added according to the number of signals that exceed the deviation threshold) (step S12). In the case of (b) and (c) where the estimation method is set, the user sets three patterns of anomaly levels to be added according to the number of signals that exceed the deviation threshold. For example, in the case of estimation method (b), if the user sets (1) 40% when there is one signal that exceeds the deviation threshold, (2) 80% when there are three signals, and (3) 100% when there are five signals, the user enters "1" and "40" in setting fields 104a and 104b respectively on the anomaly detection condition setting screen 100 in Figure 6, enters "3" and "40" in setting fields 105a and 105b, and enters "5" and "20" in setting fields 106a and 106b (the settings should be made so that the sum of setting fields 104b to 106b is 100). For example, when performing anomaly detection on six signals based on this setting, the anomaly detection unit 16 determines that (1) if one or more but less than three of the six signals exceed the deviation threshold, plant 1 is abnormal with a 40% probability; (2) if three or more but less than five signals exceed the deviation threshold, plant 1 is abnormal with an 80% (40 + 40) probability; and (3) if five or more of the six signals exceed the deviation threshold, plant 1 is abnormal with a 100% (40 + 40 + 20) probability. In this embodiment, weighting can be applied according to the number of signals. This allows for setting weights based on the variability in the behavior of the six signals, thereby suppressing false detections. For example, if many of the six signals exhibit unstable behavior but can be considered normal, the abnormality level can be adjusted by (1) lowering it to 20% for one signal and (2) lowering it to 50% for three signals, or by changing the number of signals to (1) lower the abnormality level to 40% for two signals and (2) lower it to 80% for four signals. This allows the system to adjust the system so that even if the deviation between the estimated and measured values ​​of some signals with high variability exceeds a threshold, it is likely not abnormal if the number of such signals is limited.Conversely, if the variation among the six signals is small (i.e., each of the six signals can be considered to match the state of Plant 1 and reflect the state of Plant 1), the system can be adjusted so that if the deviation between the estimated and measured values ​​of a relatively small number of the six signals exceeds the threshold, it is determined with a high probability that an anomaly has occurred. For example, (1) if one signal exceeds the deviation threshold, the probability is 50%, (2) if three signals exceed the threshold, the probability is 80%, and (3) if four signals exceed the threshold, the probability is 100%. Thus, in this embodiment, when anomaly detection is performed using the estimation method, the anomaly level is set in correspondence with the number of signals according to the properties (magnitude of variation) of the signals used for anomaly detection. This improves the accuracy of anomaly detection by the estimation method. (b) As an example of default settings in the estimation method, the levels may be set to (1) 40% if one signal exceeds the deviation threshold, (2) 40% if half of all signals exceed the deviation threshold, and (3) 20% if 80% of all signals exceed the deviation threshold.

[0035] In the case of (c) MT method + estimation method, set the sum of setting fields 103 and 104b to 106b to be 100. For example, if the MT method is set to 40%, set 104b to 106b to 10%, 25%, and 25% respectively (the sum of 104b to 106b will be 60%).

[0036] Next, the user sets an anomaly level threshold that triggers the model to issue a warning (step S13). The anomaly level threshold is the threshold for the anomaly level detected when an anomaly is detected using any of the methods set above: (a) MT method, (b) estimation method, or (c) MT method + estimation method. For example, in the case of (a) the MT method, the calculated anomaly level is either 0% or 100%. Specifically, if the MD value is above the threshold, it is an anomaly (anomaly level of 100%), and if it is below the threshold, it is normal (anomaly level of 0%). In the case of (b) the estimation method, the calculated anomaly level is either the value in setting field 104b in Figure 6, the sum of the values ​​in setting fields 104b and 105b, or the sum of the values ​​in setting fields 104b to 106b, depending on the number of signals where the deviation between the estimated value and the measured value exceeds the deviation threshold set in step S10. For example, if (1) the deviation threshold is set to 40% when there is one signal exceeding the deviation threshold, (2) the deviation threshold is set to 80% when there are three signals exceeding the deviation threshold, and (3) the deviation threshold is set to 100% when there are five signals exceeding the deviation threshold, then when there are two signals exceeding the deviation threshold, the anomaly level will be 40%. (c) In the case of the MT method + estimation method, this is the sum of the anomaly levels calculated by each method. For example, in the MT method + estimation method, if the MT method is weighted at 40% (in this case, the anomaly level of the MT method is 0% or 100%, and multiplying it by a weight of 40% results in possible values ​​of 0% or 40%), and the estimation method is weighted at 60%, and the anomaly level calculated by the MT method is 40%, then the overall anomaly level will be 40% + 40% = 80%. In step S13, a threshold is set for the final anomaly level calculated by any of (a) to (c). For example, to set the threshold at 60%, the user enters 60 in the setting field 107. The setting unit 14 records the threshold value for the final abnormality level entered by the user in the storage unit 18 via the input reception unit 12.

[0037] The settings configured in steps S9 to S13 (such as each anomaly detection information) are registered in the storage unit 18 as an anomaly detection condition file, for example, as shown in Figure 7.

[0038] Next, based on user instructions, the learning unit 15 learns from the training data and constructs a model (step S14). For example, in the case of the MT method, the learning unit 15 constructs a unit space from the training data selected by the processing in steps S1 to S8. In the case of estimation methods such as multiple regression, the learning unit 15 performs regression analysis on the relationship between the explanatory variables and the dependent variable set in step S3 and constructs an estimation model.

[0039] Next, the validity of the configured anomaly detection method, training data, and anomaly detection conditions is verified (step S15). For example, anomaly detection is performed on data for an arbitrary period using the constructed model to confirm whether the results intended by the user are obtained. The anomaly detection method will be explained next with reference to Figure 8. If it is not valid, the processing from step S1 onwards is performed as appropriate to adjust the training data and anomaly detection conditions.

[0040] Once validity is confirmed in step S15, the validated model is deployed to the actual monitoring environment (step S16). For example, the learning unit 15 outputs the model (unit space or estimation model) to the anomaly detection unit 16. The anomaly detection unit 16 records the validated model in the storage unit 18.

[0041] (Anomaly detection processing) Next, the anomaly detection process according to the first embodiment will be described with reference to Figure 8. Figure 8 is a flowchart showing an example of an anomaly detection process according to the first embodiment. As a prerequisite, the signal acquisition unit 11 acquires multiple signals from plant 1 moment by moment and outputs the signals acquired from plant 1 to the abnormality detection unit 16. The anomaly determination unit 16 acquires information related to the set anomaly detection method (step S21). For example, the anomaly determination unit 16 reads and acquires an anomaly detection method file, as exemplified in Figure 3, from the storage unit 18. Next, the anomaly determination unit 16 determines whether the anomaly detection method is the MT method only or not based on the settings in the anomaly detection method file (step S22). If it is the MT method only (step S22; Yes), the anomaly determination unit 16 acquires the signal to be used for anomaly determination (step S23). For example, the anomaly determination unit 16 acquires the signal selected in step S1. Next, the anomaly determination unit 16 acquires anomaly determination information related to the MT method (step S24). The anomaly determination unit 16 reads the anomaly detection condition file, as exemplified in Figure 7, from the storage unit 18 and acquires the MD threshold. Next, the anomaly determination unit 16 performs anomaly determination using the MT method (step S25). The abnormality determination unit 16 calculates an MD value based on the unit space (model) constructed in the process shown in Figure 2 and the signal acquired in step S23, and makes an abnormality determination by comparing it with the MD threshold of the MT method (abnormality determination information related to the MT method) recorded in the abnormality detection condition file. Specifically, if the calculated MD value is greater than or equal to the MD threshold, the abnormality determination unit 16 determines that plant 1 is abnormal (abnormality level is 100%), and otherwise determines that plant 1 is normal (abnormality level is 0%). If an abnormality is determined (step S26; Yes), the abnormality notification unit 17 notifies an alarm related to the abnormality (step S27). For example, the abnormality notification unit 17 may transmit information such as the plant name, unit name, model name, type of signal used for determination, abnormality level of the signal (0% or 100%), and threshold (MD threshold) to another device 3. Alternatively, for example, the abnormality notification unit 17 may output a list screen of abnormality detection results displaying the plant name, unit name, model name, abnormality level (0% or 100%), and threshold (MD threshold) to the display device 2. Figure 9 shows an example of the list screen 200. The list screen 200 displays a list of information including the abnormal status, the time (timestamp) when it was determined to be normal or abnormal, the plant name, the unit name, the model name used for the determination, the abnormal level calculated in the abnormal determination, and the threshold. Selecting checkbox 201 on the list screen 200 enables the automatic screen update function, allowing for real-time monitoring of the plant status.Furthermore, selecting checkbox 202 displays only the data that has been determined to be abnormal. By monitoring the list screen 200, the user can determine whether or not there are any abnormalities in Plant 1. The abnormality notification unit 17 also sends information related to the abnormality to other devices 3 as an alarm notification related to the abnormality, including the time the abnormality was determined, the plant name, the unit name, the model name used for the determination, the abnormality level calculated in the abnormality determination, various thresholds, and identification information of the signal that was determined to be abnormal based on the deviation threshold. The transmission of information related to the abnormality to other devices 3 is the same in steps S35 and S44.

[0042] Furthermore, the abnormality detection unit 16 records the abnormality detection result in the storage unit 18 (step S45). The abnormality detection unit 16 may record data related to the abnormality detection only when an abnormality is detected (for example, the values ​​of each signal and items displayed on the list screen 200 in Figure 9), or it may record data including when the abnormality is determined to be normal. In addition, it may be possible to record the actions taken at that time (such as inquiries to the design department or contact with the plant operating company) along with the abnormality detection result. Based on this record, the list screen 200 shown in Figure 9 not only allows for real-time abnormality detection, but also allows users to retrieve and view information on previously detected abnormalities by setting the extraction start time and extraction time range in the setting fields 203 and 204, respectively. In this way, by collecting and accumulating the abnormality detection result in the database, past abnormality detection results can be viewed, enabling smooth responses to detected abnormalities. It also becomes possible to analyze currently detected abnormalities and past detected abnormalities, improving the quality of responses.

[0043] Furthermore, if the determination in step S22 determines that the MT method is not the only method (step S22; No), the anomaly determination unit 16 determines whether the anomaly detection method is the estimation method only, based on the settings in the anomaly detection method file in Figure 3 (step S28). If the estimation method is the only method (step S28; Yes), the anomaly determination unit 16 acquires the signal to be used for anomaly determination (step S29). For example, the anomaly determination unit 16 acquires the signal selected in step S3. Next, the anomaly determination unit 16 acquires anomaly determination information related to the estimation method (step S30). The anomaly determination unit 16 reads and acquires deviation thresholds 1 to N from the anomaly detection condition file (Figure 7) in the storage unit 18. Next, the anomaly determination unit 16 performs anomaly determination using the estimation method (step S31). For each signal, the anomaly determination unit 16 calculates the deviation between the estimated value by the estimation model and the measured value transmitted in real time from plant 1, and compares that value with the deviation threshold. The anomaly detection unit 16 determines that a signal is anomaly if the deviation between the estimated value and the measured value exceeds the deviation threshold. The range of the deviation threshold (e.g., 3σ) centered on the estimated value by the estimation model is an example of an acceptable range. The value of the deviation threshold (e.g., 3σ) for each signal may be calculated by the anomaly detection unit 16 based on training data, for example, or the estimation model may be constructed to output the value of the deviation threshold along with the estimated value. Next, the anomaly detection unit 16 acquires anomaly detection information related to the signal (step S32). The anomaly detection unit 16 reads and acquires the weights (1) to (3) of the estimation method, the number of signals for (1) to (3), and the signal deviation thresholds 1 to N from the anomaly detection condition file (Figure 7) in the storage unit 18. Next, the anomaly detection unit 16 weights the anomaly detection result from step S31 using the anomaly detection information related to the signal (step S33). The anomaly detection unit 16 counts the number of signals in which the deviation between the estimated value and the measured value exceeds the deviation threshold, and calculates the anomaly level based on the number of signals for the estimation method weights (1) to (3) and (1) to (3). The anomaly detection unit 16 compares the calculated anomaly level with the anomaly level threshold in the anomaly detection condition file (Figure 7), and determines that plant 1 is abnormal if the calculated anomaly level is greater than or equal to the threshold, and normal if it is less than the threshold. If an anomaly is determined (step S34; Yes), the anomaly notification unit 17 notifies an alarm related to the anomaly (step S35).For example, the abnormality notification unit 17 may output a list screen of abnormality detection results to the display device 2, displaying the plant name, unit name, model name, abnormality level (a value corresponding to the number of signals judged as abnormal), and threshold (a threshold for the abnormality level). The abnormality determination unit 16 records the abnormality determination result in the storage unit 18 (step S45).

[0044] Furthermore, if the determination in step S28 determines that it is not solely an estimation method (step S28; No), the anomaly determination unit 16 acquires a signal to be used for anomaly determination (step S36). For example, the anomaly determination unit 16 acquires the signal selected in step S1 or step S3. Next, the anomaly determination unit 16 acquires anomaly determination information related to the MT method and anomaly determination information related to the estimation method (step S37). The anomaly determination unit 16 reads and acquires the MD threshold and deviation thresholds 1 to N from the anomaly detection condition file (Figure 7) in the storage unit 18. Next, the anomaly determination unit 16 performs anomaly determination using the estimation method (step S38). This process is the same as in step S31. Next, the anomaly determination unit 16 performs anomaly determination using the MT method (step S39). This process is the same as in step S25. Next, the anomaly determination unit 16 acquires weights for the MT method and weights for the estimation method for each anomaly determination result (step S40). The anomaly detection unit 16 obtains the weights of the MT method from the anomaly detection condition file (Figure 7) in the storage unit 18 and calculates the weights for the estimation method. For example, if the weight of the MT method is 40, the anomaly detection unit 16 calculates the weight of the MT method as 40 and the weight for the estimation method as 60. Next, the anomaly detection unit 16 obtains anomaly detection information related to the signal and calculates the anomaly level (step S41). This process is the same as in steps S32 to S33. Next, the anomaly detection unit 16 weights the anomaly detection result using the MT method and the anomaly level using the estimation method (step S42). The anomaly detection unit 16 multiplies the anomaly level (0% or 100%) calculated in the anomaly detection using the MT method in step S39 by the weight of the MT method obtained in step S40 (for example, 40%). Furthermore, the anomaly detection unit 16 calculates the final anomaly level by summing the anomaly level calculated in step S41 in the same manner as in step S33 (in the case of (c) MT method + estimation method, a value is set that considers a weight of 60% for the estimation method in the weighting according to the number of signals) with the anomaly level of the MT method calculated by multiplying the anomaly detection result using the MT method in step S39 (i.e., anomaly level of 0% or 100%) by a weight.Next, the abnormality determination unit 16 compares the calculated abnormality level with the abnormality level threshold in the abnormality detection condition file (Figure 7). If the calculated abnormality level is greater than or equal to the threshold, plant 1 is determined to be abnormal; otherwise, plant 1 is determined to be normal. If an abnormality is determined (Step S43; Yes), the abnormality notification unit 17 notifies an alarm related to the abnormality (Step S44). The abnormality determination unit 16 records the abnormality determination result in the storage unit 18 (Step S45).

[0045] (effect) As explained above, according to this embodiment, when detecting anomalies in Plant 1 using the estimation method, the anomaly level is calculated according to the number of signals determined to be abnormal, and this anomaly level is compared with a threshold to determine if Plant 1 is abnormal. For example, if the monitored signals include many signals with large variability, the anomaly level can be set to a high value when most signals show abnormalities, and to a low value when only a few signals show abnormalities, thereby suppressing false detections caused by the magnitude of signal variability. Also, when the signal variability is small, even when a relatively small number of signals show abnormalities, the anomaly level can be set to, for example, a medium or higher, to expect rapid (highly sensitive) anomaly detection. Furthermore, according to this embodiment, the MT method and the estimation method can be combined, so an improvement in anomaly detection capability can be expected by detecting anomalies using different methods. In addition, weights can be set for each method, so the sensitivity of anomaly detection can be optimized by appropriately setting the weights. Furthermore, in step S3 of Figure 2, the signals used for anomaly determination in the estimation method can be narrowed down. This function provides the following effects. For example, in a model consisting of three signals, signal A, signal B, and signal C, it is known that signals B and C are necessary to estimate the value of signal A. However, signals B and C may not be able to be estimated using this model due to the equipment's mechanism or other factors. In such cases, by setting only signal A in step S3, signals B and C can be excluded from the anomaly detection target by the estimation method, thereby preventing false positives. Furthermore, according to this embodiment, the results detected as anomalies are collected and stored in a database. This allows for smooth handling of anomalies while preventing false positives.

[0046] (c) Regarding the MT method + estimation method, in the explanation of step S42 above, the example given was that the user considers the remaining weighting amount, when the whole is considered as 100%, as the weighting for the estimation method, based on the weighting for the MT method (40% in the above example), and sets the values ​​in setting fields 104b to 106b so that the sum of the values ​​entered in setting fields 104b to 106b equals the considered amount (60% in the above example). However, the embodiments are not limited to this. For example, (b) Similar to the estimation method, the user sets values ​​in each of the setting fields 104b to 106b so that the sum of the values ​​entered in each setting field 104b to 106b equals 100%. The anomaly determination unit 16 calculates the anomaly level of the estimation method based on the number of signals exceeding the deviation threshold and the anomaly determination information related to the signals (values ​​in setting fields 104a to 106a and setting fields 104b to 106b), multiplies this by a weight of 60% for the estimation method to calculate the final anomaly level of the estimation method. The final anomaly level is then calculated by adding this value to the anomaly level of the MT method, which is calculated by multiplying this value by the weight. Furthermore, if a weight of 40% is set for the MT method, a value other than 60% may be set for the weight of the estimation method, and a threshold for the final anomaly level may be set in setting field 107 corresponding to the weight of the MT method being 40% and the weight of the estimation method being other than 60%.

[0047] In addition, in the other device 3, the user may have previously entered setting information via the input / output unit 31, specifying the types of abnormalities to be notified (for example, the type of abnormality and the abnormality level) and what kind of information to notify regarding the abnormalities to be notified. In this case, the setting unit 32 records the entered setting information in the storage unit 34. For example, the storage unit 34 may store setting information such as "Notify if signals A and B are included in the signal determined to be abnormal (example of setting the type of abnormality)", "Notify if the abnormality level is XX or higher (example of setting the abnormality level)", and "Display the plant name, the time of abnormality occurrence, and the abnormality level (example of setting what kind of information to notify)". When an alarm related to an abnormality is output from the abnormality notification unit 17 (steps S27, S35, S44), the input / output unit 31 of the other device 3 acquires the information related to that abnormality, and the notification unit 33 determines whether the acquired information related to the abnormality includes an abnormality to be notified based on the setting information recorded in the storage unit 34. If it includes an abnormality to be notified, the notification unit 33 notifies that an abnormality to be notified has occurred. For example, the notification unit 33 displays the time of the anomaly, the type of signal determined to be an anomaly, the anomaly level, etc., on the display device.

[0048] <Second Embodiment> Next, as a second embodiment, a function that automates the setting of thresholds and abnormality levels added according to the number of signals in the MT method and estimation method will be explained with reference to Figures 10 to 11. Figure 10 is a flowchart showing an example of the modeling process according to the second embodiment. The processes other than steps S9A, S10A, and S12A are the same as in the first embodiment, so they will be briefly explained. First, the user selects the signals to build the model (step S1) and sets the anomaly detection method (step S2). Next, the user selects the signals to be used for the estimation method (step S3) and sets the execution conditions for the anomaly detection method (step S4). Furthermore, the user sets the data to be used to build the model (step S5) and sets the upper and lower limits of the signals (step S6). Next, the user samples the training data (step S7) and checks the histogram and correlation diagram drawn by the setting unit 14 in step S8. The user repeats the processes in steps S5 to S8 as needed to select appropriate training data. Next, the learning unit 15 learns the training data and builds the model (step S14). For example, the learning unit 15 builds a unit space with respect to the MT method. Regarding the estimation method, the learning unit 15 builds an estimation model based on the estimation method set in step S2 and the explanatory and dependent variables set in step S3.

[0049] Next, the setting unit 14 automatically sets the anomaly detection conditions for the MT method (step S9A). The setting unit 14 also automatically sets the MD threshold for the MT method. For example, the setting unit 14 applies the training data (training data used to build the model) to the model (unit space) constructed in step S14 and calculates the MD value. This provides time-series data of MD values ​​for the time-series data of the signal. The setting unit 14 calculates the mean and standard deviation of the time-series MD values ​​and calculates x such that the highest MD value falls within the threshold xσ. Here, σ is the standard deviation of the time-series data. For example, when x=1, 68% of the data falls within the 1σ interval; when x=2, 95% of the data falls within the 2σ interval; and when x=3, 99.7% of the data falls within the 3σ interval. For example, if the largest value in the time-series data of MD values ​​is greater than (MD mean + 2 × MD standard deviation) and less than (MD mean + 3 × MD standard deviation), the setting unit 14 sets 3σ as the threshold for the MD value. Furthermore, when inputting training data into the model, it is also possible to input other normal data instead of the training data used to construct the unit space. This also applies to steps S10A and S12A.

[0050] Next, the setting unit 14 automatically sets the anomaly detection conditions for the estimation method (step S10A). The setting unit 14 automatically sets the deviation threshold for each signal. For example, the setting unit 14 applies the training data (training data used to build the model) to the estimation model constructed in step S14 and calculates the deviation between the time series data of the estimated values ​​by the estimation model and the time series data of the measured values ​​included in the training data at the same time. This gives time series data of the deviation between the estimated values ​​and the measured values. The setting unit 14 sets the deviation threshold by xσ (mean value of deviations + x × standard deviation of deviations) so that the largest deviation fluctuation is kept within the threshold. For example, if the largest deviation in the time series data of deviations is greater than (mean value of deviations + 2 × standard deviation of deviations) and less than (mean value of deviations + 3 × standard deviation of deviations), the setting unit 14 sets the deviation threshold to 3σ.

[0051] Next, the user sets the distribution of anomaly levels to be added for the configured anomaly detection method (step S11).

[0052] Next, the setting unit 14 automatically sets three patterns of abnormality levels to be added to the estimation method settings according to the number of signals that exceed the deviation threshold (step S12A). For example, the setting unit 14 calculates the standard deviation for the time series data of the deviation between the measured value and the estimated value of each signal. Based on a predetermined threshold, the setting unit 14 classifies the standard deviation calculated for each signal into two groups: one group with a large variation where the standard deviation value is greater than the threshold, and another group with a standard deviation value less than the threshold. If there are more signals classified into the group with a large standard deviation, the setting unit 14 automatically sets three patterns of abnormality levels, for example, as follows: That is, the setting unit 14 sets (1) 20% of all signals exceed the deviation threshold, (2) 40% of all signals exceed the deviation threshold, and (3) 40% of all signals exceed the deviation threshold. Also, if there are more signals in the group with a small standard deviation, the setting unit 14 automatically sets three patterns of abnormality levels, for example, as follows. Specifically, the setting unit 14 sets the following: (1) 40% when there is one signal exceeding the deviation threshold, (2) 40% when 30% of all signals exceed the deviation threshold, and (3) 20% when 60% of all signals exceed the deviation threshold.

[0053] Furthermore, the setting unit 14 may perform three patterns of automatic setting as follows. First, the automatic setting of the number of signals will be explained. With a deviation threshold of 3σ, the setting unit 14 applies the training data to the estimation model and calculates the deviation between the estimated value obtained by inputting the training data into the estimation model and the actual value included in the training data for each signal and for each data point (each point in the time series). For each signal, the setting unit 14 determines whether the number of data points whose calculated deviation exceeds the deviation threshold exceeds 0.3% of the total number of points. If the percentage of data points whose deviation exceeds the deviation threshold exceeds 0.3%, the setting unit 14 sets the number of signals that exceeds 0.3% in (1) and sets the remaining number of signals to values ​​that are equally distributed in (2) and (3). If the number of signals is odd, (2) is allocated one more signal (rounding up the fraction). For example, if the total number of signals is 10, and for 5 of those signals, the deviation threshold is set to 3σ, and the number of data points where the deviation between the estimated value and the measured value exceeds the deviation threshold exceeds 0.3% of the total number of data points, then the setting unit 14 sets the number of signals in (1) to 5, the number of signals in (2) to 3, and the number of signals in (3) to 2.

[0054] The basis for the 0.3% figure is the concept of 3σ. When ±3σ is used as a threshold for normally distributed data, 99.7% of all data falls within the threshold, and the remaining 0.3% of data falls outside the threshold. Therefore, signals where the number of data points exceeding the threshold exceeds 0.3% of the total data can be considered signals with many outliers (signals with large fluctuations in value) even in normal training data. Since such signals can lead to an increase in false positives in actual operation, setting it as (1) suppresses false positives.

[0055] Next, we will explain the abnormality levels to be set for (1) to (3). For the weights to be automatically allocated, for example, the setting unit 14 sets (b) estimation method to (1) 40%, (2) 40%, and (3) 20%. For (c) MT method + estimation method to (1) 10%, (2) 25%, and (3) 25%. In all cases, for the weighting of (1), the abnormality level when the number of signals whose deviation between the estimated value and the measured value exceeds the deviation threshold is greater than or equal to the number of signals in (1) and less than the number of signals in (2) is set to a value that takes into account the possibility that it is a false detection.

[0056] For example, in estimation method (b), if two out of five signals exceed 0.3%, then the number of signals in (1) is 2 and the anomaly level is 40%, the number of signals in (2) is 2 and the anomaly level is 40%, and the number of signals in (3) is 1 and the anomaly level is 20%.

[0057] For example, in (c) the MT method + estimation method, if 40% is allocated to the MT method and the remaining 60% to the estimation method, and 3 out of 9 signals exceed 0.3%, then the number of signals in (1) will be 3 and 10%, the number of signals in (2) will be 3 and 25%, and the number of signals in (3) will be 3 and 25%.

[0058] The setting unit 14 may also generate a suggested distribution pattern screen as illustrated in Figure 11 and output it to the display device 2. For example, by default, the abnormality levels are set as follows: Pattern A: (1) 40%, (2) 40%, (3) 20%; Pattern B: (1) 20%, (2) 20%, (3) 60%; Pattern C: (1) 60%, (2) 20%, (3) 20%. Then, the setting unit 14, after applying the training data to the model, if the total signal exceeds 0.3%, arranges the above distribution patterns in the recommended order (Pattern B being the most recommended distribution pattern) in the order of Pattern B → Pattern A → Pattern C. If the total signal is less than 0.3%, arranges the above distribution patterns in the recommended order (Pattern C being the most recommended distribution pattern) in the order of Pattern C → Pattern A → Pattern B, generates a suggested distribution screen 300 as illustrated in Figure 11, and displays it on the display device 2. Then, when the user selects a distribution pattern from the three distribution patterns listed in order of recommendation from top to bottom and clicks the OK button, the percentages specified by the selected distribution pattern are automatically entered into the settings fields 104b to 1016b on the settings screen.

[0059] Next, the user sets an anomaly level threshold that triggers the model to issue a warning (step S13). Then, the user validates the configured anomaly detection method, training data, and anomaly detection conditions (step S15). Once validated in step S15, the validated model is deployed to the actual monitoring environment (step S16).

[0060] (effect) As explained above, according to the second embodiment, in addition to the effects of the first embodiment, the threshold in the MT method and estimation method, the number of signals to be added according to the number of signals, and the abnormality level can be set automatically.

[0061] Figure 12 shows an example of the hardware configuration of an anomaly detection system according to each embodiment. The computer 900 includes a CPU 901, main memory 902, auxiliary memory 903, input / output interface 904, and communication interface 905. The anomaly detection device 10 and other devices 3 described above are implemented in the computer 900. The functions described above are stored in the auxiliary memory 903 in the form of a program. The CPU 901 reads the program from the auxiliary memory 903, expands it into the main memory 902, and executes the above processing according to the program. The CPU 901 also allocates a storage area in the main memory 902 according to the program. The CPU 901 also allocates a storage area in the auxiliary memory 903 to store the data being processed according to the program.

[0062] A program to implement all or part of the functions of the anomaly detection device 10 and other devices 3 may be recorded on a computer-readable recording medium, and the program recorded on this recording medium may be loaded into a computer system and executed to perform processing by each functional unit. Here, "computer system" includes hardware such as the OS and peripheral devices. Furthermore, if a WWW system is used, "computer system" also includes the homepage provisioning environment (or display environment). Furthermore, "computer-readable recording medium" refers to portable media such as CDs, DVDs, USBs, and storage devices such as hard disks built into the computer system. Furthermore, if this program is distributed to computer 900 via a communication line, computer 900 that receives the program may load it into main memory 902 and execute the above processing. Furthermore, the above program may be for implementing only a part of the functions described above, and may also be able to implement the above functions in combination with programs already recorded in the computer system.

[0063] As described above, several embodiments relating to this disclosure have been explained, but all of these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be carried out in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims and their equivalents.

[0064] <Note> The anomaly detection device, anomaly detection system, anomaly detection method, and program described in the embodiment can be understood, for example, as follows:

[0065] (1) The abnormality detection device 10 according to the first embodiment includes a signal acquisition unit 11 that acquires a plurality of signals indicating the state of the plant, a setting unit 14 that sets an abnormality level (weighting) according to the number of signals whose values ​​are outside the allowable range (the range of a deviation threshold (e.g., 3σ) centered on the estimated value by the estimation model), and an abnormality determination unit 16 that compares the plurality of signals with the allowable range determined for each of the signals, calculates the number of signals that are outside the allowable range, calculates an abnormality level according to the calculated number of signals based on the number of signals and the setting of the abnormality level, and determines an abnormality in the plant based on the calculated abnormality level. This allows for setting an abnormality level based on the number of abnormal signals, and by determining whether a signal is abnormal based on this level, it is possible to suppress false detections, such as when a signal with large fluctuations happens to become abnormal.

[0066] (2) The abnormality detection device 10 according to the second embodiment is the abnormality detection device 10 of (1), wherein if the abnormality level is the first abnormality level, the setting unit 14 further sets a first weighting which is a weighting for the first abnormality level and a second weighting which is a weighting for the second abnormality level (for example, 40% by the MT method) which indicates the degree of abnormality of the plant calculated by a determination model (unit space of the MT method) that determines the abnormality of the plant based on at least a part of the plurality of signals, and the abnormality determination unit further calculates the second abnormality level based on the determination model, and determines the abnormality of the plant based on the sum of the value obtained by multiplying the first abnormality level by the first weighting and the value obtained by multiplying the second abnormality level by the weighting. This allows anomaly detection to be performed using multiple models, and by setting weights for each model, it is possible to specify which model's anomaly detection should be given more importance.

[0067] (3) The abnormality detection device 10 according to the third embodiment is the abnormality detection device 10 of (2), wherein the setting unit sets whether to determine an abnormality in the plant based on the first abnormality level, or based on the first abnormality level and the second abnormality level, or based on the second abnormality level, and the abnormality determination unit determines an abnormality in the plant based on the first abnormality level if it is set to determine an abnormality in the plant based on the first abnormality level, determines an abnormality in the plant based on the first abnormality level and the second abnormality level if it is set to determine an abnormality in the plant based on the first abnormality level and the second abnormality level, and determines an abnormality in the plant based on the second abnormality level. This allows for anomaly detection to be performed using, for example, (a) the MT method, (b) an estimation method, or (c) the MT method plus the estimation method.

[0068] (4) The anomaly detection device 10 according to the fourth embodiment is the anomaly detection device 10 according to (1) to (3), further comprising a learning unit which constructs an estimation model which uses some of the plurality of signals as explanatory variables and one of the plurality of signals as an objective variable, and estimates the value of the variable set as the objective variable from the signal set as the explanatory variable, and the setting unit which sets the signal to be used as the explanatory variable and the signal to be used as the objective variable. This allows you to configure which signals are used to determine anomalies and which signals are used to estimate the signals used for anomaly determination. For example, it can prevent situations where signals with low estimation accuracy are used for estimation.

[0069] (5) The abnormality detection device 10 according to the fifth embodiment is the abnormality detection device 10 according to (1) to (4), further comprising an abnormality notification unit that notifies the abnormality determination result of the abnormality determination unit of the plant, wherein the abnormality determination unit records the determination result in a storage unit, and the abnormality notification unit reads the determination result from the storage unit and outputs the determination result. This allows for the retrieval of past anomalies, enabling smoother responses to detected anomalies.

[0070] (6) The anomaly detection device 10 according to the sixth embodiment is the anomaly detection device 10 of (2) to (5), wherein the setting unit calculates the threshold of the second anomaly level based on the standard deviation of the second anomaly level calculated by the judgment model when a plurality of training data used to construct the judgment model are input to the judgment model, by calculating α such that the maximum value of the calculated second anomaly level is included in (the average value of the calculated second anomaly level + α × the standard deviation of the calculated second anomaly level), and calculates the threshold of the second anomaly level by (the calculated α × the standard deviation of the calculated second anomaly level). This allows the threshold (MD threshold) of the judgment model (MT method) to be set automatically.

[0071] (7) The anomaly detection device 10 according to the seventh embodiment is the anomaly detection device 10 of (1) to (6), wherein the setting unit calculates the magnitude of the tolerance range based on the standard deviation of the difference between the estimated value of the signal estimated by the estimation model and the measured value of the signal when a plurality of learning data used to construct the estimation model are input to a predetermined estimation model, and calculates β such that the maximum value of the deviation is included in (mean value of the deviation + β × standard deviation of the deviation), and calculates it by (calculated β × standard deviation of the deviation). This allows you to automatically set the threshold for the signal used for anomaly detection (the deviation threshold in setting field 102 of setting screen 100).

[0072] (8) The anomaly detection device 10 according to the eighth aspect is the anomaly detection device 10 of (1) to (7), wherein the setting unit calculates the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal for each of the plurality of signals, classifies the plurality of signals into signals whose standard deviation of the deviation is greater than or equal to a predetermined threshold and signals whose standard deviation is less than the threshold, and sets a smaller anomaly level for the same number of signals when the number of signals greater than or equal to the threshold is greater than the number of signals whose standard deviation is less than the threshold. This allows the distribution pattern of abnormal signal levels (values ​​in setting fields 104b to 106b on setting screen 100) to be set automatically.

[0073] (9) The anomaly detection device 10 according to the ninth embodiment is the anomaly detection device 10 according to (1) to (8), wherein the setting unit inputs learning data having multiple data points for multiple signals used to construct the estimation model into a predetermined estimation model, and determines for each signal whether the percentage of data points whose deviation exceeds a predetermined second threshold (3σ) exceeds a predetermined value (0.3%) based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, calculates the number of signals that exceed the predetermined value, sets the calculated number of signals as the first number of signals which is the number of signals which is outside the first acceptable range, divides the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals equally and rounds up the fractional part, sets the second number of signals which is the number of signals which is outside the second acceptable range, and sets the anomaly level when the number of signals which is outside the acceptable range is equal to or greater than the first number of signals and less than the second number of signals, a predetermined value determined considering the possibility that an anomaly in the plant may be falsely detected. This allows the distribution pattern of abnormal signal levels (the values ​​in settings 104a and 104b on setting screen 100) to be set automatically.

[0074] (10) An anomaly detection system 20 according to the tenth embodiment includes an anomaly detection device 10 as described in any of (1) to (9), and a notification device (other device 3), the notification device comprising: an acquisition unit (input / output unit 31) that acquires information relating to an anomaly detected by the anomaly detection device; a setting unit 32 that accepts the setting of an anomaly to be notified; and a notification unit 33 that notifies the anomaly to be notified when the information relating to the anomaly acquired by the acquisition unit includes the anomaly to be notified. By configuring which types of anomalies should be included in notifications, it is possible to receive notifications when desired anomalies occur.

[0075] (11) An abnormality detection method according to the eleventh embodiment includes the steps of: acquiring a plurality of signals indicating the state of the plant; setting an abnormality level corresponding to the number of signals whose values ​​are outside the permissible range among the plurality of signals; comparing the plurality of signals with the permissible range determined for each of the signals to calculate the number of signals that are outside the permissible range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level.

[0076] (12) An anomaly detection method according to the 12th embodiment is the anomaly detection method of (11), further comprising: a step of determining an anomaly in the plant, a step of acquiring information relating to the anomaly when the plant is determined to be an anomaly; a step of accepting the setting of an anomaly to be notified; and a step of notifying the anomaly to be notified when the information relating to the anomaly acquired in the step of acquiring information relating to the anomaly includes the anomaly to be notified.

[0077] (13) A program according to the 13th embodiment causes a computer to perform the following steps: acquire a plurality of signals indicating the status of a plant; set an abnormality level corresponding to the number of signals whose values ​​are outside the acceptable range among the plurality of signals; compare the plurality of signals with the acceptable range defined for each of the signals to calculate the number of signals that are outside the acceptable range; calculate the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determine an abnormality in the plant based on the calculated abnormality level. [Explanation of symbols]

[0078] 10. Anomaly detection device 11. Signal acquisition unit 12. Input reception section 13. Control Unit 14. Settings section 15. Learning Department 16...Abnormality determination section 17... Abnormality notification section 18...Storage section 20. Anomaly detection system 2...Display device 3...Other devices 31...Input / output section 32...Settings section 33...Notification section 34...Storage section 900... Computer 901···CPU 902...Main memory 903...Auxiliary storage device 904... Input / Output Interface 905...Communication Interface

Claims

1. A signal acquisition unit that acquires multiple signals indicating the status of the plant, A setting unit sets an abnormality level corresponding to the number of signals whose values ​​are outside the acceptable range among the aforementioned plurality of signals, An abnormality determination unit that compares the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range, calculates the abnormality level corresponding to the calculated number of signals based on the number of signals and the setting of the abnormality level, and determines an abnormality in the plant based on the calculated abnormality level, It has, The setting unit calculates the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal for each of the plurality of signals, classifies the plurality of signals into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold, and sets a smaller abnormality level for the same number of signals compared to the case where the number of signals greater than or equal to the first threshold is less than the number of signals whose standard deviation is less than the first threshold. Anomaly detection device.

2. A signal acquisition unit that acquires multiple signals indicating the status of the plant, A setting unit sets an abnormality level corresponding to the number of signals whose values ​​are outside the acceptable range among the aforementioned plurality of signals, An abnormality determination unit that compares the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range, calculates the abnormality level corresponding to the calculated number of signals based on the number of signals and the setting of the abnormality level, and determines an abnormality in the plant based on the calculated abnormality level, It has, The setting unit, upon inputting learning data having multiple data points for multiple signals used to construct the estimation model into a predetermined estimation model, determines for each signal whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, calculates the number of signals that exceed the predetermined value, sets the calculated number of signals as the first number of signals which is outside the first acceptable range, divides the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals equally and rounds up the fractional part, sets the second number of signals which is outside the second acceptable range, and sets the abnormality level, which is determined considering the possibility of false detection of an abnormality in the plant, when the number of signals which is outside the acceptable range is equal to or greater than the first number of signals and less than the second number of signals, to a predetermined value. Anomaly detection device.

3. A signal acquisition unit that acquires multiple signals indicating the status of the plant, A setting unit sets the correspondence between the range of the number of signals whose values ​​are outside the acceptable range and the abnormal level among the aforementioned plurality of signals, An abnormality determination unit that compares the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range, calculates the abnormality level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of signals that fall outside the tolerance range and the abnormality level, and determines an abnormality in the plant based on the calculated abnormality level, It has, The correspondence between the range of the number of signals that fall outside the acceptable range and the abnormality level is set according to how many of the multiple signals have a large variation in value, and the abnormality level set in the correspondence is a weighting of how likely it is that the values ​​of the number of signals included in the range fall outside the acceptable range, indicating that the plant is in an abnormal state. In the case where a predetermined number of the aforementioned multiple signals have a large variation, When comparing the case in which no signal with a large variation is included among the aforementioned multiple signals, For the range of the aforementioned predetermined number or less, A higher abnormality level is set when there are no signals with large variations than when there are a predetermined number of signals with large variations. Anomaly detection device.

4. If the aforementioned abnormality level is referred to as the first abnormality level, The setting unit further sets a first weighting, which is a weighting for the first abnormality level, and a second weighting, which is a weighting for the second abnormality level, which indicates the degree of abnormality in the plant calculated by a determination model that determines the abnormality of the plant based on at least a portion of the plurality of signals. The abnormality determination unit further calculates the second abnormality level based on the determination model, and determines an abnormality in the plant based on the sum of the value obtained by multiplying the first abnormality level by the first weighting and the value obtained by multiplying the second abnormality level by the second weighting. An anomaly detection device according to any one of claims 1 to 3.

5. The setting unit sets whether to determine an abnormality in the plant based on the first abnormality level, based on the first abnormality level and the second abnormality level, or based on the second abnormality level. The abnormality determination unit, If it is set to determine an abnormality in the plant based on the first abnormality level, then the abnormality in the plant is determined based on the first abnormality level. If it is set to determine the abnormality of the plant based on the first abnormality level and the second abnormality level, the abnormality of the plant is determined based on the first abnormality level and the second abnormality level, If it is set to determine the abnormality of the plant based on the second abnormality level, then the abnormality of the plant is determined based on the second abnormality level. An anomaly detection device according to claim 4.

6. The system further includes a learning unit that constructs an estimation model in which some of the aforementioned multiple signals are used as explanatory variables and one of the aforementioned multiple signals is used as the objective variable, and estimates the value of the signal set as the objective variable from the signals set as the explanatory variables, The setting unit sets the signal to be used as the explanatory variable and the signal to be used as the objective variable. An anomaly detection device according to any one of claims 1 to 5.

7. An abnormality notification unit outputs the abnormality determination result of the abnormality determination unit for the plant. It further possesses, The abnormality determination unit records the determination result in the storage unit. The abnormality notification unit reads the determination result from the storage unit and displays the determination result in chronological order. An anomaly detection device according to any one of claims 1 to 6.

8. The setting unit calculates the threshold of the second abnormal level based on the standard deviation of the second abnormal level calculated by the judgment model when a plurality of training data used to construct the judgment model are input to the judgment model. The setting unit calculates α such that the maximum value of the calculated second abnormal level is included in (the average value of the calculated second abnormal level + α × the standard deviation of the calculated second abnormal level), and calculates the threshold by (the calculated α × the standard deviation of the calculated second abnormal level). An anomaly detection device according to claim 4.

9. The setting unit calculates the magnitude of the tolerance range based on the standard deviation of the difference between the estimated value of the signal estimated by the estimation model and the measured value of the signal when a plurality of training data used to construct the estimation model are input to a predetermined estimation model. The setting unit calculates β such that the maximum value of the deviation is included in (mean value of the deviation + β × standard deviation of the deviation), and calculates the magnitude of the tolerance range by (calculated β × standard deviation of the deviation). An anomaly detection device according to any one of claims 1 to 8.

10. An anomaly detection device according to any one of claims 1 to 9, Includes a notification device, The notification device is An acquisition unit that acquires information related to the abnormality detected by the abnormality detection device, A setting unit that accepts settings for abnormalities to be notified, If the information relating to the abnormality acquired by the acquisition unit includes the abnormality to be notified, the notification unit notifies the abnormality to be notified, An anomaly detection system equipped with the following features.

11. The steps include acquiring multiple signals that indicate the status of the plant, The steps include setting an abnormality level corresponding to the number of signals whose values ​​are outside the acceptable range among the aforementioned plurality of signals, The steps include: comparing the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level. It has, In the setting step, for each of the plurality of signals, the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal is calculated, and the plurality of signals are classified into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold, and if the number of signals whose standard deviation is greater than or equal to the first threshold is greater than or equal to the first threshold is greater than or equal to the first threshold is greater than or equal to the first threshold is less than or equal to the first threshold, a smaller abnormality level is set for the same number of signals. Anomaly detection method.

12. The steps include acquiring multiple signals that indicate the status of the plant, The steps include setting an abnormality level corresponding to the number of signals whose values ​​are outside the acceptable range among the aforementioned plurality of signals, The steps include: comparing the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level. It has, In the setting step, when a predetermined estimation model is input to a predetermined estimation model, learning data having multiple data points for multiple signals used to construct the estimation model is used to determine whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, for each signal, the number of signals that exceed the predetermined value is calculated, and the calculated number of signals is set as the first number of signals which is the number of signals outside the first acceptable range, and the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals is divided equally and rounded up is set as the second number of signals which is the number of signals outside the second acceptable range, and when the number of signals outside the acceptable range is equal to or greater than the first number of signals and less than the second number of signals, a predetermined value is set as the abnormality level, taking into consideration the possibility that an abnormality in the plant may be being falsely detected. Anomaly detection method.

13. The steps include acquiring multiple signals that indicate the status of the plant, The steps include setting a correspondence between the number of signals whose values ​​are outside the acceptable range and the abnormality level among the aforementioned plurality of signals, The steps include: comparing the plurality of signals with the tolerance range defined for each signal to calculate the number of signals that fall outside the tolerance range; calculating the abnormal level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of signals that fall outside the tolerance range and the abnormal level; and determining an abnormality in the plant based on the calculated abnormal level. It has, The correspondence between the range of the number of signals that fall outside the acceptable range and the abnormality level is set according to how many of the multiple signals have a large variation in value, and the abnormality level set in the correspondence is a weighting of how likely it is that the values ​​of the number of signals included in the range fall outside the acceptable range, indicating that the plant is in an abnormal state. In the case where a predetermined number of the aforementioned multiple signals have a large variation, When comparing the case in which no signal with a large variation is included among the aforementioned multiple signals, For the range of the aforementioned predetermined number or less, A higher abnormality level is set when there are no signals with large variations than when there are a predetermined number of signals with large variations. Anomaly detection method.

14. In the step of determining an abnormality in the plant, if the plant is determined to be abnormal, the step of obtaining information related to the abnormality, A step to accept the setting of anomalies to be notified, If the information relating to the abnormality obtained in the step of obtaining the information relating to the abnormality includes the abnormality to be notified, the step of notifying the abnormality to be notified, An anomaly detection method according to any one of claims 11 to 13, further comprising the above.

15. On the computer, The steps include acquiring multiple signals that indicate the status of the plant, The steps include setting an abnormality level corresponding to the number of signals whose values ​​are outside the acceptable range among the aforementioned plurality of signals, The steps include: comparing the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level. It has, In the setting step, for each of the multiple signals, the deviation between the estimated value of the signal estimated by a predetermined estimation model and the measured value of the signal is calculated, and the multiple signals are classified into signals whose standard deviation of the deviation is greater than or equal to a predetermined first threshold and signals whose standard deviation is less than the first threshold, and when the number of signals whose standard deviation is greater than or equal to the first threshold is greater than or equal to the number of signals whose standard deviation is less than the first threshold, a process is performed to set a smaller abnormality level for the same number of signals compared to when the number of signals whose standard deviation is greater than or equal to the first threshold is less than or equal to the first threshold. A program that executes the command.

16. On the computer, The steps include acquiring multiple signals that indicate the status of the plant, The steps include setting an abnormality level corresponding to the number of signals whose values ​​are outside the acceptable range among the aforementioned plurality of signals, The steps include: comparing the plurality of signals with the tolerance range defined for each of the signals to calculate the number of signals that fall outside the tolerance range; calculating the abnormality level corresponding to the calculated number of signals based on the calculated number of signals and the setting of the abnormality level; and determining an abnormality in the plant based on the calculated abnormality level. It has, In the setting step, when learning data having multiple data points for multiple signals used to construct the estimation model is input to a predetermined estimation model, it is determined for each signal whether the percentage of data points whose deviation exceeds a predetermined second threshold exceeds a predetermined value, based on the deviation between the estimated value for each signal estimated by the estimation model and the measured value of the signal included in the learning data, the number of signals that exceed the predetermined value is calculated, the calculated number of signals is set as the first number of signals which is outside the first acceptable range, the value obtained by subtracting the first number of signals from the total number of signals of the multiple signals is divided equally and rounded up is set as the second number of signals which is outside the second acceptable range, and when the number of signals which is outside the acceptable range is equal to or greater than the first number of signals and less than the second number of signals, a predetermined value is set for the abnormality level, taking into consideration the possibility that the abnormality of the plant may be being falsely detected. A program that executes the command.

17. On the computer, The steps include acquiring multiple signals that indicate the status of the plant, The steps include setting a correspondence between the number of signals whose values ​​are outside the acceptable range and the abnormality level among the aforementioned plurality of signals, The steps include: comparing the plurality of signals with the tolerance range defined for each signal to calculate the number of signals that fall outside the tolerance range; calculating the abnormal level corresponding to the range that includes the calculated number of signals based on the calculated number of signals and the setting of the correspondence between the range of signals that fall outside the tolerance range and the abnormal level; and determining an abnormality in the plant based on the calculated abnormal level. It has, The correspondence between the range of the number of signals that fall outside the acceptable range and the abnormality level is set according to how many of the multiple signals have a large variation in value, and the abnormality level set in the correspondence is a weighting of how likely it is that the values ​​of the number of signals included in the range fall outside the acceptable range, indicating that the plant is in an abnormal state. In the case where a predetermined number of the aforementioned multiple signals have a large variation, When comparing the case in which no signal with a large variation is included among the aforementioned multiple signals, For the range of the aforementioned predetermined number or less, A process in which a higher abnormality level is set when there are no signals with large variations than when there are a predetermined number of signals with large variations. A program that executes the command.

Images