Device, method, and program for selecting a recovery process.

Abstract

To provide a device, method, and program for selecting recovery processing.SOLUTION: A device is provided, including a first recovery processing part for executing first recovery processing for determining recovery operation for normally recovering equipment from abnormality on the basis of a simulation result using a simulator, a second recovery processing part for executing second recovery processing for searching the recovery operation by trial operation using an actual machine, and a recovery processing selection part for selecting recovery processing in the first recovery processing and the second recovery processing according to previously determined rule in the case where abnormality occurs in the equipment.SELECTED DRAWING: Figure 15

Description

Technical Field

[0001] The present invention relates to an apparatus, a method, and a program for selecting a return process.

Background Art

[0002] Patent Document 1 describes that "it is possible to obtain a plant operation device that can identify the cause of an abnormality in a plant and automatically perform a return operation from an abnormal state without the intervention of an operator." [Prior Art Document] [Patent Document] [Patent Document 1] Japanese Unexamined Patent Application Publication No. 2014-229109

Summary of the Invention

[0003] In a first aspect of the present invention, there is provided an apparatus for controlling the execution of a return process. The apparatus includes a first return processing unit that executes a first return process for determining a return operation for returning a facility from an abnormal state to a normal state based on a simulation result using a simulator, a second return processing unit that executes a second return process for searching for the return operation by a trial operation using an actual machine, and a return process selection unit that selects a return process to be executed from the first return process and the second return process according to a predetermined rule when an abnormality occurs in the facility.

[0004] In the apparatus, when the facility does not return from an abnormal state to a normal state within a predetermined condition while the return process selection unit is selecting one of the first return process and the second return process, the return process selection unit may select the other of the first return process and the second return process.

[0005] In any of the apparatuses, when the number of times the control target is controlled exceeds a predetermined threshold while the return process selection unit is selecting one of the return processes, the return process selection unit may select the other return process.

[0006] In any of the above devices, the recovery process selection unit may select the other recovery process if the elapsed time exceeds a predetermined threshold while one of the recovery processes is selected.

[0007] Any of the above devices may further include a priority storage unit that stores a first priority for prioritizing the first recovery process and a second priority for prioritizing the second recovery process, and the recovery process selection unit may select a recovery process to be executed according to the first priority and the second priority.

[0008] In any of the above devices, the recovery process selection unit may increase the priority of the first recovery process if the equipment recovers from an abnormality to normal operation while the first recovery process is selected, and may increase the priority of the second recovery process if the equipment recovers from an abnormality to normal operation while the second recovery process is selected.

[0009] In any of the above devices, the recovery process selection unit may lower the priority of the first recovery process if the equipment does not recover normally from the abnormality while the first recovery process is selected, and may lower the priority of the second recovery process if the equipment does not recover normally from the abnormality while the second recovery process is selected.

[0010] In any of the above devices, the recovery process selection unit may select both the first recovery process and the second recovery process for at least a portion of the period.

[0011] In any of the above-mentioned devices, the second recovery processing unit may execute the second recovery process while the simulation in the first recovery process is being executed.

[0012] Any of the above devices may further include a notification unit that notifies that the equipment cannot be automatically restored if the equipment fails to recover normally from an abnormality by either the first recovery process or the second recovery process.

[0013] Any of the above devices may further include a user input unit that accepts input from the user for the restoration operation when it is notified that the equipment cannot be automatically restored.

[0014] A second aspect of the present invention provides a method for controlling the execution of a recovery process. The method comprises: a computer executing a first recovery process to determine a recovery operation to restore equipment from an abnormality to normal operation based on simulation results using a simulator; a second recovery process to search for the recovery operation through trial operations using the actual equipment; and, when an abnormality occurs in the equipment, selecting a recovery process to execute from the first recovery process and the second recovery process according to predetermined rules.

[0015] A third aspect of the present invention provides a program for controlling the execution of a recovery process. The program is executed by a computer and causes the computer to function as: a first recovery processing unit that executes a first recovery process that determines a recovery operation to restore the equipment from an abnormality to normal based on simulation results using a simulator; a second recovery processing unit that executes a second recovery process that searches for the recovery operation through trial operations using the actual equipment; and a recovery process selection unit that, when an abnormality occurs in the equipment, selects a recovery process to be executed from the first recovery process and the second recovery process according to predetermined rules.

[0016] It should be noted that the above summary of the invention does not enumerate all of its features. Furthermore, subcombinations of these features may also constitute an invention. [Brief explanation of the drawing]

[0017] [Figure 1] An example of a block diagram of a control system 1 which may include the device 100 according to the first embodiment is shown. [Figure 2] Here is the first example of determining target data. [Figure 3] Here is a second example of determining target data. [Figure 4] Shows an example in a flowchart of a method that the device 100 according to the first embodiment may execute. [Figure 5] Shows another example in a block diagram of the control system 1 that may include the device 100 according to the first embodiment. [Figure 6] Shows an example in a block diagram of the control system 1 that may include the device 100 according to a modification of the first embodiment. [Figure 7] Shows an example in a flowchart of a method that the device 100 according to a modification of the first embodiment may execute. [Figure 8] Shows another example in a block diagram of the control system 1 that may include the device 100 according to a modification of the first embodiment. [Figure 9] Shows an example in a block diagram of the control system 1 that may include the device 1000 according to the second embodiment. [Figure 10] Shows an example in a flowchart of a method that the device 1000 according to the second embodiment may execute. [Figure 11] Shows another example in a block diagram of the control system 1 that may include the device 1000 according to the second embodiment. [Figure 12] Shows an example in a block diagram of the control system 1 that may include the device 1000 according to a modification of the second embodiment. [Figure 13] Shows an example in a flowchart of a method that the device 1000 according to a modification of the second embodiment may execute. [Figure 14] Shows another example in a block diagram of the control system 1 that may include the device 1000 according to a modification of the second embodiment. [Figure 15] Shows an example in a block diagram of the device 1500 according to the third embodiment. [Figure 16] Shows an example in a flowchart of a method that the device 1500 according to the third embodiment may execute. [Figure 17] Shows an example of a computer 9900 in which multiple aspects of the present invention may be embodied in whole or in part.

Best Mode for Carrying Out the Invention

[0018] Hereinafter, the present invention will be described through embodiments of the invention. However, the following embodiments do not limit the invention according to the claims. Also, not all combinations of features described in the embodiments are essential for the solution of the invention.

[0019] FIG. 1 shows an example in a block diagram of a control system 1 in which an apparatus 100 according to a first embodiment may be included. Note that these blocks are functionally separated functional blocks and do not necessarily coincide with an actual device configuration. That is, in this figure, just because it is shown as one block, it does not necessarily have to be constituted by one device. Also, in this figure, just because they are shown as separate blocks, they do not necessarily have to be constituted by separate devices. The same applies to the block diagrams hereinafter. The control system 1 may include a facility 10, a control device 20, a simulator 30, and an apparatus 100.

[0020] The facility 10 is a device for manufacturing a product from raw materials. The facility 10 may be one device or a composite device in which a plurality of devices are combined. The facility 10 may be, for example, the entire plant or the entire factory, or a group of devices in a segment of a part of the plant or factory. Examples of the plant include industrial plants such as chemical and bio plants, plants for managing and controlling wells and their surroundings in gas fields and oil fields, plants for managing and controlling power generation such as hydraulic, thermal, and nuclear power, plants for managing and controlling environmental power generation such as solar and wind power, plants for managing and controlling water and sewage and dams, and the like.

[0021] Equipment 10 may be equipped with one or more sensors (not shown) capable of measuring various conditions (physical quantities) inside and outside Equipment 10. The sensors may output measured values ​​PV (Process Variable) such as temperature, pressure, or flow rate at various points in Equipment 10. State data indicating the state of Equipment 10 may include such measured values ​​PV. The state data may further include manipulated variables MV (Manipulated Variable) indicating the degree of opening or closing of valves. The state data may further include consumption data indicating the amount of energy consumed or raw materials consumed in Equipment 10. The state data may further include environmental data indicating physical quantities that may act as disturbances in Equipment 10.

[0022] Equipment 10 may be provided with a control object 15. In this figure, for the sake of explanation, only one control object 15 is shown, but equipment 10 may be provided with one or more control objects 15.

[0023] The controlled object 15 is the equipment to be controlled. The controlled object 15 may be an actuator such as a valve, heater, motor, fan, or switch, i.e., an operating end, that controls at least one physical quantity of an object related to the process of the equipment 10, such as the quantity, temperature, pressure, flow rate, speed, or pH, and may perform a given operation according to the operating quantity. However, it is not limited to this. The controlled object 15 may also be a controller that controls the operating end. In other words, the term "control" as used herein may be interpreted broadly to include not only direct control of the operating end but also indirect control of the operating end via a controller.

[0024] The control device 20 is a device that controls the controlled object 15. The control device 20 may acquire state data indicating the state of the equipment 10 and control the controlled object 15 based on the state data. In this case, the control device 20 may control the controlled object 15 by PID (Proportional Integral Differential) control or by AI (Artificial Intelligence) control.

[0025] AI control refers to control using an operational model generated by machine learning. Such an operational model may be generated, for example, by reinforcement learning, in which an evaluation index that assesses the state of equipment 10 is used as at least part of the reward. Furthermore, the evaluation index used in such reinforcement learning may be output from an evaluation model that has been trained by machine learning to output an evaluation index in response to state data being input.

[0026] An abnormality may occur in the equipment 10 while the control target 15 is under the control of the control device 20. In such cases, it is desirable to automatically restore the equipment 10 by controlling the control target 15 according to the recovery operation. However, the equipment 10 can take on various abnormal states depending on various conditions. To address such cases, it is conceivable to define a recovery operation for each abnormal state in a database or the like. However, it is practically impossible to consider all abnormal states in advance, and this problem is particularly pronounced in complex equipment such as plants where various conditions interact with each other.

[0027] Therefore, the device 100 according to the first embodiment determines a recovery operation to restore the equipment 10 from an abnormal state to normal based on the simulation results using the simulator 30. As a result, the device 100 according to the first embodiment can determine the optimal recovery operation for each abnormal state, even when the equipment 10 is in various abnormal states. This will be explained in detail.

[0028] The simulator 30 is hardware or software that simulates the operation of the equipment 10. The simulator 30 may be designed based on the design information of the equipment 10. In response to state data indicating the state of the equipment 10 being input, the simulator 30 may simulate how the state of the equipment 10 would stabilize or change if the control target 15 were actually controlled according to a plurality of candidate operations. The simulator 30 may then output the simulated state data as simulated data for each of the plurality of candidate operations.

[0029] The device 100 works in cooperation with the simulator 30 to determine a recovery operation to return the equipment 10 from an abnormal state to a normal state. The device 100 may include a state data acquisition unit 110, a detection unit 120, a target data determination unit 130, a simulated data acquisition unit 140, a recovery operation determination unit 150, and a warning unit 190.

[0030] The status data acquisition unit 110 acquires status data indicating the status of the equipment 10. The status data acquisition unit 110 may be provided mainly by a communication interface and may acquire status data from the equipment 10 via a network in a time series. However, it is not limited to this. The status data acquisition unit 110 may acquire status data from a device other than the equipment 10, or via means other than a network (various memory devices, or user input, etc.). The status data acquisition unit 110 supplies the acquired status data to the detection unit 120.

[0031] The detection unit 120 detects abnormalities in the equipment 10 based on status data. The detection unit 120 may be provided mainly by executing a program using a CPU or other processor, and may detect abnormalities in the equipment 10 based on status data acquired by the status data acquisition unit 110. In this case, the detection unit 120 may use a machine learning model that classifies the equipment 10 into a normal state and an abnormal state based on the status data. If it determines that no abnormality has been detected in the equipment 10, the detection unit 120 labels the status data as normal and supplies it to the target data determination unit 130. If it determines that an abnormality has been detected in the equipment 10, the detection unit 120 labels the status data as abnormal and supplies it to the target data determination unit 130 and the simulated data acquisition unit 140. The detection unit 120 also notifies the warning unit 190 that an abnormality has been detected in the equipment 10.

[0032] The target data determination unit 130 determines target data that indicates the target state of the equipment 10 in order to restore the equipment 10 from abnormal to normal. The target data determination unit 130 may mainly determine the target data based on a plurality of state data that are provided by the CPU and labeled as normal by the detection unit 120, that is, a plurality of normal data that indicate the state data when normal. Details of this will be described later. The target data determination unit 130 supplies the determined target data to the recovery operation determination unit 150.

[0033] The simulated data acquisition unit 140 acquires multiple simulated data sets that simulate the state of the equipment 10 when the control target 15 is controlled according to a plurality of candidate operations, in response to abnormal data indicating state data in an abnormal situation being input to the simulator 30. The simulated data acquisition unit 140 may mainly provide state data that has been labeled abnormal by the detection unit 120, i.e., abnormal data indicating state data in an abnormal situation, via a communication interface to the simulator 30 via a network. Accordingly, the simulator 30 may input abnormal data and simulate how the state of the equipment 10 changes when the control target 15 is controlled according to a plurality of candidate operations. The simulator 30 may then output the simulated state data after the change as simulated data for each of the plurality of candidate operations. The simulated data acquisition unit 140 may acquire the plurality of simulated data sets output from the simulator 30 in this manner via a network. The simulated data acquisition unit 140 then supplies the acquired plurality of simulated data sets to the recovery operation determination unit 150.

[0034] The recovery operation determination unit 150 determines a recovery operation to restore the equipment 10 from abnormal to normal based on a plurality of simulated data. The recovery operation determination unit 150 may be mainly provided by the CPU and may determine the recovery operation based on the respective distances between a plurality of simulated data acquired by the simulated data acquisition unit 140 and the target data determined by the target data determination unit 130. The recovery operation determination unit 150 supplies the determined recovery operation to the control device 20.

[0035] In response, the control device 20 controls the controlled object 15 according to the reset operation. As a result, the equipment 10 changes its state and, preferably, returns from an abnormal state to a normal state.

[0036] The warning unit 190 issues a warning if the equipment 10 does not recover from an abnormal state within predetermined conditions even after the determined recovery operation. The warning unit 190 may be mainly provided by a display device and may display a warning screen indicating that the equipment 10 does not recover from an abnormal state within predetermined conditions even after the determined recovery operation.

[0037] The device 100 equipped with such a functional unit may be a computer such as a PC (personal computer), tablet computer, smartphone, workstation, server computer, or general-purpose computer, or it may be a computer system in which multiple computers are connected. Such a computer system is also a computer in a broad sense. Furthermore, the device 100 may be implemented by a virtual computer environment that can run one or more times within the computer. Alternatively, the device 100 may be a dedicated computer designed to determine the recovery operation, or it may be dedicated hardware realized by a dedicated circuit. Also, if the device 100 is connected to the internet, the device 100 may be implemented by cloud computing.

[0038] Such a computer may include a memory for storing programs and a processor for executing programs, and the processor may implement the functions of a device 100 by executing the program. That is, a program may be provided that is executed by the computer and causes the computer to function as: a state data acquisition unit 110 that acquires state data indicating the state of the equipment 10; a simulated data acquisition unit 140 that acquires a plurality of simulated data that simulates the state of the equipment 10 when the controlled object 15 is controlled according to a plurality of candidate operations in response to abnormal data indicating state data in the event of an abnormality being input to the simulator; and a recovery operation determination unit 150 that determines a recovery operation to restore the equipment 10 from an abnormality to normal based on the plurality of simulated data. Furthermore, a non-temporary computer-readable medium on which such a program is recorded may be provided.

[0039] Figure 2 shows a first example of determining target data. This figure shows the feature space defined by state data. In this figure, circles (〇) represent normal data, i.e., state data that has been labeled as normal by the detection unit 120, and crosses (×) represent abnormal data, i.e., state data that has been labeled as abnormal by the detection unit 120. The symbol 210 visualizes the decision boundary. The machine learning model that the detection unit 120 may use may be tuned by machine learning in this way to determine the boundary for classifying the equipment 10 as normal or abnormal.

[0040] Reference numeral 220 indicates the target abnormal data. When the target abnormal data is supplied from the detection unit 120, the target data determination unit 130 may determine target data that indicates the target state of the equipment 10 in order to restore the equipment 10 from abnormal to normal. In this case, the target data determination unit 130 may determine the target data based on a plurality of normal data. The target data determination unit 130 can determine such target data using various methods.

[0041] This figure illustrates an example of a method for determining target data based on statistics from multiple normal data points. Reference numeral 230 indicates the centroid of the multiple normal data points. The target data determination unit 130 may calculate the sum of the squares of the distances from the multiple normal data points and define the point where the sum of the squares of the distances is minimized as the centroid 230. In this case, the target data determination unit 130 may select the multiple normal data points to be used for statistical processing according to predetermined rules. For example, when the target abnormal data is supplied from the detection unit 120, the target data determination unit 130 may select m normal data points supplied from the detection unit 120 up to that point in chronological order and use the selected m normal data points for statistical processing.

[0042] The target data determination unit 130 may calculate a vector 240 pointing from the target abnormal data 220 to the centroid 230 of multiple normal data. The target data determination unit 130 may then determine the intersection point 250 of the vector 240 and the determination boundary 210 as the target data. In the above description, the case where the intersection point 250 of the vector 240 and the determination boundary 210 is used as the target data was shown as an example, but the target data determination unit 130 may also determine the centroid 230 itself as the target data, or any point on the vector 240 between the intersection point 250 and the centroid 230 as the target data. Furthermore, in the above description, the case where the centroid is used as a statistic was explained as an example, but the target data determination unit 130 may also determine the target data based on other statistics such as the mean, median, or mode. For example, the target data determination unit 130 can determine the target data based on statistics in multiple normal data in this way.

[0043] Figure 3 shows a second example of determining target data. In this figure, components with the same function and configuration as in Figure 2 are given the same reference numerals, and explanations are omitted below except for differences. In this figure, the numbers in circles (〇) indicate the time-series order of normal data, with smaller values ​​indicating newer data and larger values ​​indicating older data.

[0044] This figure illustrates an example of a method for determining target data based on the time series of multiple normal data points. Reference numeral 310 indicates the most recent normal data point among the selected m (m=10 in this figure) normal data points. The target data determination unit 130 may calculate a vector 320 pointing from the target abnormal data point 220 to the most recent normal data point 310. The target data determination unit 130 may then determine the intersection point 330 of the vector 320 and the determination boundary 210 as the target data point. While the above explanation uses the intersection point 330 of the vector 320 and the determination boundary 210 as the target data point, the target data determination unit 130 may also determine the most recent normal data point 310 itself as the target data point, or it may determine any point between the intersection point 330 on the vector 320 and the most recent normal data point 310 as the target data point. The target data determination unit 130 can also determine target data based on the time series of multiple normal data points in this manner, for example.

[0045] Although the methods for determining target data based on statistics from multiple normal data and the methods for determining target data based on time series from multiple normal data have been described as separate methods, the two can be combined. For example, the target data determination unit 130 may calculate a weighted average for multiple normal data by setting weights according to the time series order, such that newer data contribute more and older data contribute less. The target data determination unit 130 may then determine the target data based on the weighted average. In this way, the target data determination unit 130 can also determine the target data based on statistics from multiple normal data and time series.

[0046] Figure 4 shows an example of a flowchart of a method that the device 100 according to the first embodiment may perform. Each step in this figure may be performed by the device 100, i.e., the computer, as the operating entity. However, in each step, it is sufficient that the computer is the operating entity as a whole, and it may include cases where a part other than the computer performs a part that is not the main part.

[0047] In step S400, the computer performs initialization. For example, the computer may initialize a counter that counts the number of times the controlled object 15 has been controlled in accordance with the recovery operation, k. That is, the computer may set k=0. The computer may also initialize a timer that measures the elapsed time t corresponding to the detection of an abnormality in the equipment 10, t. That is, the computer may set t=0.

[0048] In step S410, the computer acquires status data indicating the state of the equipment 10. For example, a status data acquisition unit 110, which may be implemented in the computer, may acquire status data S indicating the state of the equipment 10 from the equipment 10 via the network in a time series. As an example, when k=0, the status data acquisition unit 110 may acquire status data S0. The status data acquisition unit 110 supplies the acquired status data S to the detection unit 120.

[0049] In step S420, the computer determines whether or not it has detected an abnormality in the equipment 10 based on the state data. For example, a detection unit 120, which may be implemented in the computer, may determine whether or not it has detected an abnormality in the equipment 10 based on the state data S acquired in step S410. As an example, when k=0, the detection unit 120 may determine whether or not it has detected an abnormality in the equipment 10 based on the state data S0. In this case, the detection unit 120 may use a machine learning model that classifies the equipment 10 into a normal state and an abnormal state based on the state data S, as described above.

[0050] If the machine learning model classifies the equipment 10 as being in a normal state in response to the input state data S, the detection unit 120 may determine that it has not detected any abnormality in the equipment 10 (No). In this case, the detection unit 120 assigns a normal label n to the state data S and supplies it to the target data determination unit 130. The computer then returns to step S400 to continue the flow.

[0051] On the other hand, if the machine learning model classifies the equipment 10 as being in an abnormal state in response to the input state data S, the detection unit 120 may determine that it has detected an abnormality in the equipment (Yes). In this case, the detection unit 120 attaches an abnormality label a to the state data S and supplies it to the target data determination unit 130 and the simulated data acquisition unit 140. The detection unit 120 also notifies the warning unit 190 that it has detected an abnormality in the equipment 10. The computer then proceeds to step S430.

[0052] In step S430, the computer determines whether the conditions are within a predetermined range. For example, a warning unit 190, which may be implemented in the computer, may determine whether the number of steps k is within a predetermined threshold K (where K is 1 or an integer greater than or equal to 2). The warning unit 190 may also determine whether the elapsed time t is within a predetermined threshold T. However, it is not limited to these conditions. Various conditions for canceling, interrupting, or terminating the decision on the recovery operation may be predetermined. If it is determined that the conditions are within a predetermined range (Yes), the computer proceeds to step S440.

[0053] In step S440, the computer determines whether or not the recovery process is in progress. For example, the computer may determine whether the count k is 0. If k=0, the computer may determine that the recovery process is not in progress (No). If it is determined that the recovery process is not in progress, the computer proceeds to step S445. On the other hand, if k≠0, the computer may determine that the recovery process is in progress (Yes). If it is determined that the recovery process is in progress, the computer proceeds to step S460.

[0054] In step S445, the computer starts a timer that measures the elapsed time t corresponding to the detection of an abnormality in equipment 10. Here, the computer may start the timer from a predetermined starting point in response to the detection of an abnormality in equipment 10. For example, the computer may start the timer at the moment the abnormality in equipment 10 is detected (after YES in S420) to measure the elapsed time t since the abnormality in equipment 10 was detected. Alternatively, the computer may measure the elapsed time t from the time the first recovery operation is decided or executed after the abnormality in equipment 10 is detected (S480). The computer may also use any other starting point from which the time required to recover from the abnormality in equipment 10 can be measured. Then, the computer proceeds to step S450.

[0055] In step S450, the computer determines target data that indicates the target state of the equipment 10 in order to restore the equipment 10 from abnormal to normal. For example, a target data determination unit 130, which may be implemented in the computer, may determine the target data St in step S420 based on the state data S to which the normal label n is attached, that is, the normal data Sn which indicates the state data S when it is normal.

[0056] In this case, the target data determination unit 130 may determine the target data St based on a plurality of normal data Sn1, Sn2, ..., Snm that represent the state data S under normal conditions. Here, the normal data Sn1, Sn2, ..., Snm are m normal data Sn selected in reverse chronological order from before the time when the abnormality of the equipment 10 was detected. m indicates the chronological order of the normal data Sn, with a smaller value indicating newer data and a larger value indicating older data.

[0057] In this case, the target data determination unit 130 may determine the target data St based on statistical quantities in multiple normal data Sn1, Sn2, ..., Snm using, for example, the method shown in Figure 2. Alternatively, the target data determination unit 130 may determine the target data St based on the time series of multiple normal data Sn1, Sn2, ..., Snm using, for example, the method shown in Figure 3. Furthermore, the target data determination unit 130 may combine, for example, the methods shown in Figure 2 and Figure 3 to determine the target data St based on statistical quantities and time series in multiple normal data Sn1, Sn2, ..., Snm. The target data determination unit 130 supplies the determined target data St to the recovery operation determination unit 150.

[0058] In step S460, the computer inputs abnormal data indicating the state data in an abnormal situation into the simulator 30, and in response, acquires a plurality of simulated data that simulates the state of the equipment 10 when the control target 15 is controlled according to a plurality of candidate operations. For example, a simulated data acquisition unit 140, which may be implemented in the computer, may supply the simulator 30 via the network the state data S with abnormal label a, i.e., the abnormal data Sa indicating the state data S in an abnormal situation, in step S420.

[0059] Here, multiple candidate operations Ac1, Ac2, ..., Acn may be predefined within the simulator 30. However, it is not limited to this. Multiple candidate operations Ac1, Ac2, ..., Acn may also be defined by the device 100. In this case, the simulated data acquisition unit 140 only needs to supply the multiple candidate operations Ac1, Ac2, ..., Acn along with the abnormal data Sa to the simulator 30.

[0060] Simulator 30 may simulate how equipment 10 changes when the controlled object 15 is controlled according to candidate operation Ac1 while equipment 10 is in a state indicated by abnormal data Sa, and output simulated data Si1 showing the simulated state after the change. Similarly, simulator 30 may simulate how equipment 10 changes when the controlled object 15 is controlled according to candidate operation Ac2 while equipment 10 is in a state indicated by abnormal data Sa, and output simulated data Si2 showing the simulated state after the change. Simulator 30 may repeat the same process n times up to candidate operation Acn. As a result, simulator 30 may output multiple simulated data Si1, Si2, ..., Sin. Simulated data acquisition unit 140 may acquire the multiple simulated data Si1, Si2, ..., Sin output from simulator 30 via the network. The simulated data acquisition unit 140 supplies the acquired simulated data Si1, Si2, ..., Sin to the return operation determination unit 150.

[0061] In step S480, the computer determines a recovery operation to restore the equipment 10 from abnormal to normal based on a plurality of simulated data. For example, a recovery operation determination unit 150, which may be implemented in the computer, may determine a recovery operation Ar based on a plurality of simulated data Si1, Si2, ..., Sin acquired in step S460. In this case, the recovery operation determination unit 150 may determine the recovery operation based on the respective distances D between the plurality of simulated data Si1, Si2, ..., Sin acquired in step S460 and the target data St determined in step S450.

[0062] As an example, the recovery operation determination unit 150 may calculate the distance D1 between simulated data Si1 and target data St. In this case, the recovery operation determination unit 150 may calculate at least one of the Euclidean distance, Manhattan distance, Chebyshev distance, or Mahalanobis distance. Similarly, the recovery operation determination unit 150 may calculate the distance D2 between simulated data Si2 and target data St. The recovery operation determination unit 150 may repeat the same process n times up to simulated data Sin. In this way, the recovery operation determination unit 150 may calculate distances D1, D2, ..., Dn, respectively.

[0063] The recovery operation determination unit 150 may then determine the candidate operation Ac that yielded the smallest distance Dmin among the calculated distances D1, D2, ..., Dn as the recovery operation. For example, suppose that among the distances D1, D2, ..., Dn, distance D2 was the smallest. Here, distance D2 was calculated using simulated data Si2. In this case, the recovery operation determination unit 150 may determine the candidate operation Ac2 that yielded the simulated data Si2 as the recovery operation Ar.

[0064] The recovery operation determination unit 150 supplies the recovery operation Ar determined in this manner, for example, to the control device 20. In response, the control device 20 controls the controlled object 15 according to the recovery operation Ar by executing the recovery operation Ar. As a result, the state of the equipment 10 changes. The computer then proceeds to step S485.

[0065] In step S485, the computer performs an increment operation. For example, the computer may set k to k+1. As an example, if k=0, the computer may set k=1. Then, the computer returns to step S410 and continues the flow.

[0066] In other words, the computer may acquire state data S again after the controlled object 15 has been controlled according to the recovery operation Ar, and then determine again whether or not it has detected an abnormality in the equipment 10. For example, when k=1, the state data acquisition unit 110 may acquire state data S1, and the detection unit 120 may determine whether or not it has detected an abnormality in the equipment 10 based on the state data S1. The computer may then repeatedly execute the recovery process in step S420 until it no longer detects an abnormality in the equipment 10, or in step S430 until it exceeds a predetermined condition. In other words, the computer may repeatedly attempt to recover from an abnormality to normal by determining a new recovery operation Ar and supplying it to the control device 20.

[0067] During the execution of such recovery processing, if the number of repetitions k exceeds the threshold K, or if the elapsed time t exceeds the threshold T, the warning unit 190 may determine that the condition is not within the predetermined range (No). In this case, the computer proceeds to step S490.

[0068] In step S490, the computer issues a warning if the equipment 10 does not recover normally from an abnormality within predetermined conditions. For example, a warning unit 190, which may be implemented in the computer, may display a warning screen indicating this if the number of times k exceeds a threshold K, or if the elapsed time t since the timer was started in S445 in response to the detection of an abnormality in the equipment 10 exceeds a threshold T. In this case, the warning unit 190 may also display the execution history of the recovery process on the screen. As an example, the warning unit 190 may display the progress of the recovery operation Ar and the state data S on the screen using a graph or the like. The warning unit 190 may issue a warning if, for example, the number of times (e.g. k) the controlled object 15 has been controlled in accordance with the recovery operation exceeds a predetermined threshold (e.g. K). The warning unit 190 may also issue a warning if the elapsed time (e.g. t) until the equipment 10 recovers normally in response to the detection of an abnormality exceeds a predetermined threshold (e.g. T).

[0069] Thus, a method may be provided in which the computer acquires state data indicating the state of the equipment 10, acquires multiple simulated data that simulate the state of the equipment 10 when the controlled object 15 is controlled according to multiple candidate operations in response to inputting abnormal data indicating the state data in the event of an abnormality into the simulator 30, and determines a recovery operation to restore the equipment 10 from an abnormality to normal based on the multiple simulated data.

[0070] In the above explanation, the case where the computer determines in step S440 that a recovery process is in progress (Yes) and proceeds to step S460 was shown as an example. That is, the case where the computer determines the target data only when k=0 and does not update the target data when k≠0 was shown as an example. However, the computer may proceed to step S450 if it determines in step S440 that a recovery process is in progress. That is, the computer may determine the target data anew each time k is incremented and update the target data.

[0071] Traditionally, recovery procedures for abnormal conditions were determined by referring to a recovery procedure determination database that predefined recovery procedures for abnormal conditions. However, it is practically impossible to consider various abnormal conditions in advance, and this problem is particularly pronounced in complex facilities such as plants where various conditions interact with each other.

[0072] In contrast, the device 100 according to the first embodiment acquires multiple simulated data sets that simulate the state of the equipment 10 when the control target 15 is controlled according to a plurality of candidate operations, in response to the input of abnormal data to the simulator 30, and determines a recovery operation based on the multiple simulated data sets. Thus, according to the device 100 according to the first embodiment, the recovery operation is determined based on the results of simulating the state of the equipment 10 in cooperation with the simulator 30, so the optimal recovery operation can be determined for each of the various abnormal conditions without having to prepare a database for determining the recovery operation in advance.

[0073] Furthermore, the device 100 according to the first embodiment may determine target data and determine a return operation based on the respective distances between multiple simulated data and the target data. Thus, according to the device 100 according to the first embodiment, a return operation can be determined that brings the state of the equipment 10 closer to the target state.

[0074] Furthermore, the device 100 according to the first embodiment may determine target data based on a plurality of normal data. This allows the device 100 according to the first embodiment to objectively set the target to be achieved when restoring the equipment 10 from abnormal to normal, based on a plurality of normal data, rather than setting it randomly.

[0075] In this case, the device 100 according to the first embodiment may determine the target data based on statistical values ​​in a plurality of normal data sets, or it may determine the target data based on statistical values ​​in a plurality of normal data sets. There are many different types of abnormalities, including static abnormalities where there is no order or other relationship between the data, and dynamic abnormalities where there is an order relationship between the data. According to the device 100 according to the first embodiment, even with respect to such a wide variety of abnormalities, it is possible to appropriately set the target to be aimed for in order to restore the equipment 10 from abnormality to normal.

[0076] Furthermore, the device 100 according to the first embodiment may also be equipped with a function to detect abnormalities in the equipment 10 based on status data. This allows the device 100 according to the first embodiment to realize both an abnormality detection function and a recovery operation determination function in a single device. In addition, the device 100 according to the first embodiment can autonomously detect abnormalities in the equipment 10 without human intervention, and can automatically sort normal data and abnormal data necessary for determining a recovery operation by assigning normal labels and abnormal labels to the status data.

[0077] Furthermore, the device 100 according to the first embodiment may also be equipped with a function to issue a warning if the equipment 10 does not recover normally from an abnormality within predetermined conditions. This allows the device 100 according to the first embodiment to inform the user if the equipment 10 does not recover normally from an abnormality within the conditions, even though the controlled object 15 has been controlled according to the recovery operation. Therefore, even if it is difficult to automatically recover the equipment 10 according to the device 100 according to the first embodiment, the user can be prompted to switch to manual recovery, etc., without unnecessarily repeating the recovery operation decision process.

[0078] In this case, the device 100 according to the first embodiment may issue a warning if the number of times the controlled object 15 has been controlled in accordance with the reset operation exceeds a predetermined threshold, or if the elapsed time until the equipment 10 returns to normal after an abnormality has been detected exceeds a predetermined threshold. Since the time constant and settling time vary depending on the equipment 10, the speed at which the state of the equipment changes when the controlled object 15 is controlled in accordance with the reset operation varies. According to the device 100 according to the first embodiment, even in such cases, the timing for canceling, interrupting, or ending the reset operation can be set to the optimal timing for each piece of equipment 10.

[0079] Figure 5 shows another example of a block diagram of a control system 1 which may include the device 100 according to the first embodiment. In this figure, the same reference numerals are used for components having the same function and configuration as in Figure 1, and descriptions are omitted below except for differences. Up to this point, we have shown an example in which the control device 20, simulator 30, and device 100 are provided as separate, independent devices. However, the control device 20, simulator 30, and device 100 may be provided as a single integrated device, either partially or entirely. In this figure, we show a case in which device 100 also provides the functions of the control device 20 and simulator 30.

[0080] In this figure, the device 100 further comprises a simulator 30 and a control unit 510. In this figure, the state data acquisition unit 110 may supply the acquired state data to the control unit 510 in addition to the detection unit 120. Also, the recovery operation determination unit 150 may supply the determined recovery operation to the control unit 510 instead of the control device 20.

[0081] The control unit 510 may be mainly provided by a CPU and may be implemented in the device 100 as a functional unit equivalent to the control device 20. When no abnormality occurs in the equipment 10, the control unit 510 may control the controlled object 15 based on the state data acquired by the state data acquisition unit 110. In this case, the control unit 510 may control the controlled object 15 by PID control or by AI control. On the other hand, when an abnormality occurs in the equipment 10, the control unit 510 may control the controlled object 15 according to the recovery operation determined by the recovery operation determination unit 150. In this case, the control unit 510 may switch the control mode depending on whether or not an abnormality in the equipment 10 has been detected by the detection unit 120.

[0082] Thus, the device 100 according to the first embodiment may further include a control unit 510. With this, the device 100 according to the first embodiment can realize the function of determining the return operation and the function of controlling the controlled object 15 in a single device. Therefore, with the device 100 according to the first embodiment, there is no need to supply the return operation from the device 100 to the control device 20, and the risk of the return operation being tampered with during communication between the device 100 and the control device 20 can be eliminated, thus protecting the equipment 10 from security threats.

[0083] Furthermore, the apparatus 100 according to the first embodiment may also include a simulator 30. As a result, the apparatus 100 according to the first embodiment does not require communication with the outside when acquiring simulated data, thus reducing communication costs and time, and preventing information leakage to the outside.

[0084] Figure 6 shows an example of a block diagram of a control system 1 which may include a modified device 100 according to the first embodiment. In this figure, the same reference numerals are used for components having the same function and configuration as in Figure 1, and descriptions are omitted below except for differences. In the above description, an example was shown in which the device 100 determines the return operation based on target data. However, in this modified example, the device 100 determines the return operation based on evaluation indicators.

[0085] In this modified example, the control system 1 may further include an evaluation model 40. The evaluation model 40 outputs an evaluation index that assesses the state of the equipment 10 in response to the input of state data indicating the state of the equipment 10. In generating such an evaluation model 40, for example, labeling data may be generated based on operational targets for the equipment 10 (plant KPIs (Key Performance Indicators), etc.), state data indicating the state of the equipment 10, and training labels. Such operational targets may be operational targets for the entire plant or factory if the equipment 10 is the entire plant or factory, operational targets for a segment if the equipment 10 is a part of the plant or factory, or operational targets for a single device or a single process if the equipment 10 corresponds to a single device or a single process.

[0086] Then, using the generated labeling data as training data, an evaluation model 40 may be generated by a machine learning algorithm. The process of generating the evaluation model 40 itself is optional, so further details will be omitted here.

[0087] In this modified example, the control device 20 performs AI control using an operation model. Furthermore, this figure shows an example where the evaluation model 40 is the same as the evaluation model used during reinforcement learning of the operation model. That is, the evaluation metrics used for evaluating the simulated data and the evaluation metrics used for reinforcement learning of the operation model may be output from the same model. However, it is not limited to this. The evaluation model 40 may be different from the evaluation model used during reinforcement learning of the operation model. That is, the evaluation metrics used for evaluating the simulated data and the evaluation metrics used for reinforcement learning of the operation model may be output from different models.

[0088] In this modified example, the device 100 further includes an indicator acquisition unit 610 in place of the target data determination unit 130. Furthermore, the simulated data acquisition unit 140 supplies the acquired multiple simulated data to the indicator acquisition unit 610 in addition to the return operation determination unit 150.

[0089] The indicator acquisition unit 610 acquires multiple evaluation indicators that evaluate the state of the simulated equipment 10 in response to the input of multiple simulated data into the evaluation model 40. The indicator acquisition unit 610 may be mainly provided by a communication interface and may supply multiple simulated data acquired by the simulated data acquisition unit 140 to the evaluation model 40 via a network. The evaluation model 40 may output multiple evaluation indicators that evaluate the state of the equipment 10 in response to the input of multiple simulated data. The indicator acquisition unit 610 may acquire the multiple evaluation indicators output from the evaluation model 40 in this manner via a network. The indicator acquisition unit 610 supplies the acquired multiple evaluation indicators to the return operation determination unit 150.

[0090] In this modified example, the recovery operation determination unit 150 determines a recovery operation based on multiple evaluation indicators. The recovery operation determination unit 150 may determine a candidate recovery operation from among the multiple simulated data acquired by the simulated data acquisition unit 140 that yields the best simulated data among the multiple evaluation indicators acquired by the indicator acquisition unit 610 (for example, with a large value).

[0091] Figure 7 shows an example of a flowchart of a method that the apparatus 100 according to a modified version of the first embodiment may perform. Steps S400 to S445, S485, and S490 may be the same processes as in Figure 4, so a detailed explanation is omitted here. In this modified version, after starting the timer in step S445, the computer proceeds to step S460.

[0092] In step S460, the computer inputs abnormal data indicating the state data in an abnormal situation into the simulator 30 and acquires multiple simulated data that simulate the state of the equipment 10 when the control target 15 is controlled according to multiple candidate operations. The process for acquiring the multiple simulated data may be the same as in Figure 4, so a detailed explanation is omitted here. In this modified example, the simulated data acquisition unit 140 supplies the acquired multiple simulated data Si1, Si2, ..., Sin to the indicator acquisition unit 610 in addition to the return operation determination unit 150. The computer then proceeds to step S470.

[0093] In step S470, the computer acquires multiple evaluation indices that evaluate the state of the simulated equipment 10, in response to the input of multiple simulated data into the evaluation model 40. For example, an index acquisition unit 610, which may be implemented in the computer, may supply the multiple simulated data Si1, Si2, ..., Sin acquired in step S460 to the evaluation model 40 via a network.

[0094] The evaluation model 40 may output an evaluation index I1 that evaluates the state of the equipment 10 in response to the input of simulated data Si1. Similarly, the evaluation model 40 may output an evaluation index I2 that evaluates the state of the equipment 10 in response to the input of simulated data Si2. The evaluation model 40 may repeat the same process n times until it receives the simulated data Sin. As a result, the evaluation model 40 may output multiple evaluation indices I1, I2, ..., In. The index acquisition unit 610 may acquire the multiple evaluation indices I1, I2, ..., In output from the evaluation model 40 via the network. For example, the index acquisition unit 610 acquires multiple evaluation indices I1, I2, ..., In that way, which evaluate the state of the simulated equipment 10 in response to the input of multiple simulated data Si1, Si2, ..., Sin to the evaluation model 40. The index acquisition unit 610 supplies the acquired multiple evaluation indices to the return operation determination unit 150.

[0095] In step S480, the computer determines a recovery operation based on multiple evaluation indicators. For example, a recovery operation determination unit 150, which may be implemented in the computer, determines a recovery operation Ar based on multiple evaluation indicators I1, I2, ..., In obtained in step S470.

[0096] As an example, the recovery operation determination unit 150 may compare multiple evaluation indices I1, I2, ..., In. The recovery operation determination unit 150 may then determine candidate operation Ac, which yields the best index Imax (for example, the one with the largest value) among the multiple evaluation indices I1, I2, ..., In, as the recovery operation. For example, suppose that among the multiple evaluation indices I1, I2, ..., In, the value of evaluation index I1 is the largest. Here, evaluation index I1 is obtained using simulated data Si1. In this case, the recovery operation determination unit 150 may determine candidate operation Ac1, which yielded the simulated data Si1, as the recovery operation Ar.

[0097] The reset operation determination unit 150 supplies the reset operation Ar determined in this manner, for example, to the control device 20. In response, the control device 20 controls the controlled object 15 according to the reset operation Ar. As a result, the state of the equipment 10 changes.

[0098] As described above, various methods can be considered for setting the target to be achieved when restoring the equipment 10 from abnormal to normal, and it may be unclear which method is optimal for determining the target data. In contrast, the device 100 according to this modified example determines the recovery operation based on the results of evaluating multiple simulated data sets in cooperation with the evaluation model 40. Thus, with the device 100 according to this modified example, instead of determining specific target data with the target data determination unit 130 and determining the recovery operation to approach that target data when restoring the equipment 10 from abnormal to normal, it is possible to determine the recovery operation to improve the evaluation index obtained using the evaluation model 40.

[0099] In particular, if the evaluation model 40 used to evaluate multiple simulated data is the same as the evaluation model used during reinforcement learning of the operational model, the modified apparatus 100 can determine a return operation that is consistent with, or has little to no consistency with, the operation under AI control.

[0100] On the other hand, if an abnormality occurs in the equipment 10, the cause may lie in the operation model or evaluation model used for AI control (for example, undertraining, overtraining, or labeling errors). Therefore, if the evaluation model 40 that evaluates multiple simulated data differs from the evaluation model used during reinforcement learning of the operation model, the device 100 according to this modified example can determine an independent operation, separate from the operation under AI control, as the recovery operation.

[0101] Figure 8 shows another example of a block diagram of a control system 1 which may include a modified device 100 according to the first embodiment. In this figure, the same reference numerals are used for components having the same function and configuration as in Figure 5 or Figure 6, and descriptions are omitted below except for differences. Up to this point, an example has been shown in which the evaluation model 40 is stored outside the device 100. However, the evaluation model 40 may be stored inside the device 100. In this figure, the device 100 further comprises the evaluation model 40.

[0102] Thus, the modified device 100 may further include an evaluation model 40. With this modification, the device 100 can realize both the function of determining the recovery operation and the function of storing the evaluation model 40 in a single device. Therefore, with the device 100, there is no need to communicate with the outside when acquiring multiple evaluation indicators, thus reducing communication costs and time, and preventing information leakage to the outside.

[0103] Figure 9 shows an example of a block diagram of a control system 1 which may include the device 1000 according to the second embodiment. The device 1000 according to the second embodiment searches for a recovery operation to return the equipment 10 from an abnormal state to normal through trial operations using the actual equipment. Thus, according to the device 1000 according to the second embodiment, even if the equipment 10 takes on various abnormal states, a recovery operation can be searched for through trial operations. This will be explained in detail. The device 1000 may include a state data acquisition unit 110, a detection unit 120, a target data determination unit 130, an evaluation unit 170, a search unit 180, and a warning unit 190.

[0104] The status data acquisition unit 110 acquires status data indicating the status of the equipment 10. The status data acquisition unit 110 may be provided mainly by a communication interface and may acquire status data from the equipment 10 via a network in a time series. However, it is not limited to this. The status data acquisition unit 110 may acquire status data from a device other than the equipment 10, or via means other than a network (various memory devices, or user input, etc.). The status data acquisition unit 110 supplies the acquired status data to the detection unit 120.

[0105] The detection unit 120 detects abnormalities in the equipment 10 based on status data. The detection unit 120 may be mainly provided by the CPU and may detect abnormalities in the equipment 10 based on status data acquired by the status data acquisition unit 110. In this case, the detection unit 120 may use a machine learning model that classifies the equipment 10 into a normal state and an abnormal state based on the status data. If it is determined that no abnormality has been detected in the equipment 10, the detection unit 120 attaches a normal label to the status data and supplies it to the target data determination unit 130. If it is determined that an abnormality has been detected in the equipment 10, the detection unit 120 attaches an abnormal label to the status data and supplies it to the target data determination unit 130 and the evaluation unit 170. The detection unit 120 also notifies the search unit 180 and the warning unit 190 that an abnormality has been detected in the equipment 10.

[0106] The target data determination unit 130 determines target data that indicates the target state of the equipment 10 in order to restore the equipment 10 from abnormal to normal. The target data determination unit 130 may mainly determine the target data based on a plurality of state data that are provided by the CPU and labeled as normal by the detection unit 120, i.e., a plurality of normal data that indicate the state data when the equipment is functioning normally. Details of this will be described later. The target data determination unit 130 supplies the determined target data to the evaluation unit 170.

[0107] The evaluation unit 170 evaluates the trial operation based on the changes in state data when the controlled object 15 is controlled according to the trial operation attempted to restore the equipment 10 from abnormal to normal. The evaluation unit 170 may mainly evaluate the trial operation based on the change in distance between state data, which may be provided by the CPU and labeled as abnormal by the detection unit 120, and target data determined by the target data determination unit 130. The evaluation unit 170 supplies the evaluated results to the search unit 180.

[0108] The search unit 180 searches for a recovery operation to restore the equipment 10 from an abnormal state to a normal state, based on the evaluated results. The search unit 180 may be mainly provided by a communication interface and a CPU, and may supply trial operations to the control device 20 via a network. The control device 20 may then control the controlled object 15 according to the trial operations. As a result, the state of the equipment 10 changes. The state data acquisition unit 110 may acquire state data again after the control according to the trial operations. The evaluation unit 170 may evaluate the trial operations based on the changes in state data. The search unit 180 may then sequentially change one of the operation parameters included in the trial operations based on the evaluated results. By repeatedly executing this process, the search unit 180 can search for a recovery operation through trial operations based on the results evaluated by the evaluation unit 170.

[0109] The warning unit 190 issues a warning if the equipment 10 does not recover from an abnormality to normal operation within predetermined conditions. The warning unit 190 may be mainly provided by a display device, and may display a warning screen indicating that the equipment 10 does not recover from an abnormality to normal operation within predetermined conditions.

[0110] The device 1000 equipped with such a functional unit may be a computer such as a PC (personal computer), tablet computer, smartphone, workstation, server computer, or general-purpose computer, or it may be a computer system in which multiple computers are connected. Such a computer system is also a computer in a broad sense. The device 1000 may also be implemented by a virtual computer environment that can run one or more times within the computer. Alternatively, the device 1000 may be a dedicated computer designed to search for recovery operations, or dedicated hardware realized by dedicated circuitry. Furthermore, if the device 1000 is connected to the internet, the device 1000 may be implemented by cloud computing.

[0111] Such a computer may include a memory for storing programs and a processor for executing programs, and the processor may implement the functions of a device 1000 by executing the programs. That is, a program may be provided which is executed by the computer and causes the computer to function as a state data acquisition unit 110 that acquires state data indicating the state of the equipment 10, an evaluation unit 170 that evaluates the trial operations based on changes in state data when the controlled object 15 is controlled according to trial operations attempted to restore the equipment 10 from abnormal to normal, and a search unit 180 that searches for a recovery operation to restore the equipment 10 from abnormal to normal based on the evaluated results.

[0112] Figure 10 shows an example of a flowchart of a method that the device 1000 according to the second embodiment may perform. Each step in this figure may be performed by the device 1000, i.e., the computer, as the operating entity. However, in each step, it is sufficient that the computer is the operating entity as a whole, and it may include cases where a part other than the computer performs a part that is not the main part.

[0113] In step S1400, the computer performs initialization. For example, the computer may initialize a counter that counts the number of times k the controlled object 15 has been controlled according to the trial operation. That is, the computer may set k=0. The computer may also initialize a timer that measures the elapsed time t since an abnormality in the equipment 10 was detected. That is, the computer may set t=0.

[0114] In step S1410, the computer acquires status data indicating the state of the equipment 10. For example, a status data acquisition unit 110, which may be implemented in the computer, may acquire status data S indicating the state of the equipment 10 from the equipment 10 via the network in a time series. As an example, when k=0, the status data acquisition unit 110 may acquire status data S0. The status data acquisition unit 110 supplies the acquired status data S to the detection unit 120.

[0115] In step S1420, the computer determines whether or not it has detected an abnormality in the equipment 10 based on the state data. For example, a detection unit 120, which may be implemented in the computer, may determine whether or not it has detected an abnormality in the equipment 10 based on the state data S acquired in step S1410. As an example, when k=0, the detection unit 120 may determine whether or not it has detected an abnormality in the equipment 10 based on the state data S0. In this case, the detection unit 120 may use a machine learning model that classifies the equipment 10 into a normal state and an abnormal state based on the state data S, as described above.

[0116] If the machine learning model classifies the equipment 10 as being in a normal state in response to the input state data S, the detection unit 120 may determine that it has not detected any abnormality in the equipment 10 (No). In this case, the detection unit 120 assigns a normal label n to the state data S and supplies it to the target data determination unit 130. The computer then returns to step S1400 to continue the flow.

[0117] On the other hand, if the machine learning model classifies the equipment 10 as being in an abnormal state in response to the input state data S, the detection unit 120 may determine that it has detected an abnormality in the equipment 10 (Yes). In this case, the detection unit 120 attaches an abnormality label a to the state data S and supplies it to the target data determination unit 130 and the evaluation unit 170. The detection unit 120 also notifies the search unit 180 and the warning unit 190 that it has detected an abnormality in the equipment 10. The computer then proceeds to step S1430.

[0118] In step S1430, the computer determines whether the conditions are within a predetermined range. For example, a warning unit 190, which may be implemented in the computer, may determine whether the number of attempts k is within a predetermined threshold K. The warning unit 190 may also determine whether the elapsed time t is within a predetermined threshold T. However, it is not limited to these conditions. Various conditions for stopping, interrupting, or terminating the search for a recovery operation may be predetermined. If it is determined that the conditions are within a predetermined range (Yes), the computer proceeds to step S1440.

[0119] In step S1440, the computer determines whether or not the recovery process is currently running. For example, the computer may determine whether the count k is 0. If k=0, the computer may determine that the recovery process is not currently running (No). If it is determined that the recovery process is not currently running, the computer proceeds to step S1445.

[0120] In step S1445, the computer starts a timer that measures the elapsed time t since the abnormality in the equipment 10 was detected. Then, the computer proceeds to step S1450.

[0121] In step S1450, the computer determines target data that indicates the target state of the equipment 10 in order to restore the equipment 10 from abnormal to normal. For example, a target data determination unit 130, which may be implemented in the computer, may determine the target data St in step S1420 based on the state data S to which the normal label n is attached, that is, the normal data Sn which indicates the state data S when it is normal.

[0122] In this case, the target data determination unit 130 may determine the target data St based on a plurality of normal data Sn1, Sn2, ..., Snm that represent the state data S under normal conditions. Here, the normal data Sn1, Sn2, ..., Snm are m normal data Sn selected in reverse chronological order from before the time when the abnormality of the equipment 10 was detected. m indicates the chronological order of the normal data Sn, with a smaller value indicating newer data and a larger value indicating older data.

[0123] In this case, the target data determination unit 130 may determine the target data St based on statistical quantities in multiple normal data Sn1, Sn2, ..., Snm using, for example, the method shown in Figure 2. Alternatively, the target data determination unit 130 may determine the target data St based on the time series of multiple normal data Sn1, Sn2, ..., Snm using, for example, the method shown in Figure 3. Furthermore, the target data determination unit 130 may combine, for example, the methods shown in Figure 2 and Figure 3 to determine the target data St based on statistical quantities and time series in multiple normal data Sn1, Sn2, ..., Snm. The target data determination unit 130 supplies the determined target data St to the evaluation unit 170.

[0124] In step S1455, the computer supplies the control device 20 with a trial operation A0 to attempt to restore the equipment 10 from abnormality to normal. For example, a search unit 180, which may be implemented in the computer, may supply the trial operation A0 to the control device 20 via a network. Note that in step S1455, this is the first time that trial operation A is supplied after an abnormality in the equipment 10 has been detected, and since the evaluation of trial operation A has not yet been obtained, trial operation A0 may be set to an initial value.

[0125] Here, trial operation A may include multiple operating parameters. Furthermore, each of the multiple operating parameters may be selected from multiple candidate operating quantities. Here, as an example, let's assume that trial operation A consists of a set of multiple operating parameters [Aa, Ab, Ac, Ad, ...]. Operating parameter Aa is a parameter for controlling the illumination of the light and shall be selected from candidate operating quantities {OFF (off), ON (on)}. Operating parameter Ab is a parameter for controlling the supply of the additive and shall be selected from candidate operating quantities {OFF (cut off), ON (supply)}. Operating parameter Ac is a parameter for controlling the opening degree of the valve and shall be selected from candidate operating quantities {-5 (close by 5 degrees), 0 (no change), +5 (open by 5 degrees)}. Operating parameter Ad is a parameter for controlling the temperature of the heater and shall be selected from candidate operating quantities {-3 (decrease by 3 degrees), 0 (no change), +3 (increase by 3 degrees)}.

[0126] In such a case, the trial operation A0 may be set to, for example, [OFF,OFF,0,0,…]. The search unit 180 may supply such a trial operation A0 to the control device 20. In response, the control device 20 may control the controlled object 15 according to the trial operation A0. The computer then proceeds to step S1460.

[0127] In step S1460, the computer performs an increment operation. For example, the computer may set k to k+1. If k=0, for example, the computer may set k to 1. Then, the computer returns to step S1410 and continues the flow.

[0128] In other words, if k=1, the state data acquisition unit 110 may acquire state data S1 indicating the state of the equipment 10 after the controlled object 15 has been controlled according to the trial operation A0, and the detection unit 120 may determine whether or not it has detected an abnormality in the equipment 10 based on the state data S1.

[0129] Here, if k=1, in step S1440, the computer may determine that k≠0 and therefore the recovery process is in progress (Yes). If it is determined that the recovery process is in progress, the computer proceeds to step S1470.

[0130] In step S1470, the computer evaluates the trial operation based on the change in state data when it controls the controlled object 15 according to the trial operation attempted to restore the equipment 10 from abnormal to normal. For example, an evaluation unit 170, which may be implemented in the computer, may evaluate the trial operation based on the change in distance between the state data to which an abnormality label was assigned in step S1420 and the target data determined in step S1450.

[0131] For example, when k=1, the evaluation unit 170 may calculate the distance D0 between the state data S0 and the target data St. In this case, the evaluation unit 170 may calculate at least one of the Euclidean distance, Manhattan distance, Chebyshev distance, or Mahalanobis distance. Similarly, the evaluation unit 170 may calculate the distance D1 between the state data S1 and the target data St. Then, the evaluation unit 170 may calculate the difference d01 by subtracting distance D1 from distance D0.

[0132] If the difference d01 is greater than 0, that is, if the distance D1 is less than the distance D0, it means that the state of the equipment 10 has approached the target state as a result of trial operation A0. In this case, the evaluation unit 170 may assign an evaluation value greater than 0 to trial operation A0. In this case, the evaluation unit 170 may assign an evaluation value such that the value increases as the absolute value of the difference d01 increases.

[0133] If the difference d01 is 0, that is, if distance D0 and distance D1 are the same, it means that the state of the equipment 10 did not change as a result of trial operation A0. In this case, the evaluation unit 170 may assign an evaluation value of 0 to trial operation A0.

[0134] If the difference d01 is less than 0, that is, if distance D1 is greater than distance D0, it means that the state of the equipment 10 has moved away from the target state due to trial operation A0. In this case, the evaluation unit 170 may assign an evaluation value less than 0 to trial operation A0. In this case, the evaluation unit 170 may assign an evaluation value such that the value decreases as the absolute value of the difference d01 increases.

[0135] The evaluation unit 170 may evaluate the trial operation A based on the change in distance D between the state data S and the target data St, for example, as shown above. The evaluation unit 170 supplies the evaluated result to the search unit 180.

[0136] In step S1475, the computer searches for a recovery operation to restore the equipment 10 from abnormal to normal based on the evaluated results. For example, a search unit 180, which may be implemented in the computer, may search for a recovery operation based on the evaluated results in step S1470. In this case, the search unit 180 may sequentially change one of the operation parameters included in the trial operation when searching for a recovery operation. For example, suppose that when k=1, the evaluation value of trial operation A0 is 0. In this case, the search unit 180 may randomly select one of the operation parameters and change one operation parameter to another candidate operation quantity. For example, the search unit 180 may change the operation parameter Aa in trial operation A0[OFF,OFF,0,0,…] from "OFF" to "ON" and set trial operation A1 to [ON,OFF,0,0,…].

[0137] In step S1480, the computer supplies the control device 20 with a trial operation A to attempt to restore the equipment 10 from abnormal to normal. For example, a search unit 180, which may be implemented in the computer, may supply the trial operation A, which was modified in step S1475, to the control device 20 via the network. As an example, when k=1, the search unit 180 may supply trial operation A1 [ON, OFF, 0, 0, ...] to the control device 20. In response, the control device 20 may control the controlled object 15 according to trial operation A1. The computer then proceeds to step S1460 and repeatedly executes the recovery process.

[0138] In other words, when k=2, the state data acquisition unit 110 acquires state data S2 indicating the state of the equipment 10 after the controlled object 15 has been controlled according to the trial operation A1, and the evaluation unit 170 may calculate the distance D2 between the state data S2 and the target data St. The evaluation unit 170 then calculates the difference d12 by subtracting distance D2 from distance D1, and may assign an evaluation value to the trial operation A1 corresponding to the difference d12.

[0139] Here, suppose that when the controlled object 15 is controlled according to trial operation A1, the evaluation value of trial operation A1 is 0. Upon obtaining such an evaluation result, the search unit 180 can recognize that the change in operation parameter Aa does not contribute to the return operation (i.e., operation parameter Aa is an insensitive parameter). In this case, the search unit 180 may decide on an arbitrary candidate operation quantity (for example, "OFF"). The search unit 180 may then select one of the multiple undecided operation parameters and change it to another candidate operation quantity. As an example, the search unit 180 may change operation parameter Ab from "OFF" to "ON" and set trial operation A2 to [OFF,ON,0,0,…].

[0140] Next, suppose that when the controlled object 15 is controlled according to trial operation A2, the evaluation value of trial operation A2 is greater than 0. Having obtained such an evaluation result, the search unit 180 can recognize that the state of the equipment 10 has improved due to the change in operation parameter Ab. In this case, the search unit 180 may decide on the candidate operation quantity after changing operation parameter Ab (here, "ON"). Then, the search unit 180 may select one of the multiple undecided operation parameters and change it to another candidate operation quantity. For example, the search unit 180 may change operation parameter Ac from "0" to "+5" and set trial operation A3 to [OFF, ON, +5, 0, ...].

[0141] Next, suppose that when the controlled object 15 is controlled according to trial operation A3, the evaluation value of trial operation A3 is less than 0. Upon obtaining such an evaluation result, the search unit 180 can recognize that the state of the equipment 10 has deteriorated due to the change in the operation parameter Ac. In this case, the search unit 180 may change the operation parameter Ac to another candidate control variable (in this case, "-5") and set trial operation A4 to [OFF, ON, -5, 0, ...].

[0142] Next, suppose that when the controlled object 15 is controlled according to trial operation A4, the evaluation value of trial operation A4 is greater than 0. Having obtained such an evaluation result, the search unit 180 can recognize that the state of the equipment 10 has improved by changing the operation parameter Ac. In this case, the search unit 180 may decide on a candidate control quantity after changing the operation parameter Ac (here, "-5"). The search unit 180 may then select one of the undecided operation parameters from among the multiple operation parameters and change it to another candidate control quantity. For example, the search unit 180 may change the operation parameter Ad from "0" to "+3" and set trial operation A5 to [OFF, ON, -5, +3, ...].

[0143] Next, suppose that when the controlled object 15 is controlled according to trial operation A5, the evaluation value of trial operation A5 is greater than 0. Having obtained such an evaluation result, the search unit 180 can recognize that the state of the equipment 10 has improved by changing the operation parameter Ad. Here, "-3" can also be selected as another candidate operation quantity for operation parameter Ad. However, since the state of the equipment 10 improved as a result of changing operation parameter Ad to "+", it is expected that the state of the equipment 10 will worsen if operation parameter Ad is changed to "-3", which has a different polarity from "+3". In such a case, the search unit 180 may decide on the candidate operation quantity after changing operation parameter Ad (in this case, "+3") without trying the trial operation in which operation parameter Ad is changed to "-3". In this way, for example, the search unit 180 can also omit changing to some of the candidate operation quantities among multiple candidate operation quantities for one operation parameter.

[0144] The computer may, by trying one or more trial operations using the actual equipment in this manner, search for a recovery operation through trial and error until it no longer detects an abnormality in the equipment 10 in step S1420, or until it exceeds predetermined conditions in step S1430.

[0145] During the search for such a recovery operation, if the number of attempts k exceeds the threshold K, or if the elapsed time t exceeds the threshold T, the warning unit 190 may determine that it is not within the predetermined conditions (No). In this case, the computer proceeds to step S1490.

[0146] In step S1490, the computer issues a warning if the equipment 10 does not recover from an abnormality to normal operation within predetermined conditions. For example, a warning unit 190, which may be implemented in the computer, may display a warning screen indicating that the number of times k exceeds a threshold K, or that the elapsed time t exceeds a threshold T. In this case, the warning unit 190 may also display the execution history of the search on the screen. As an example, the warning unit 190 may display the progress of trial operation A and state data S on the screen using a graph or the like. The warning unit 190 may issue a warning if, for example, the number of times the controlled object 15 has been controlled according to the trial operation exceeds a predetermined threshold. The warning unit 190 may also issue a warning if the elapsed time from the detection of an abnormality in the equipment 10 until it recovers to normal operation exceeds a predetermined threshold.

[0147] Thus, a method may be provided that includes: a computer acquiring state data indicating the state of equipment 10; evaluating the trial operations based on changes in the state data when the controlled object 15 is controlled according to trial operations attempted to restore equipment 10 from abnormal to normal; and searching for a recovery operation to restore equipment 10 from abnormal to normal based on the evaluated results.

[0148] Traditionally, recovery procedures for abnormal conditions were determined by referring to a recovery procedure determination database that predefined recovery procedures for abnormal conditions. However, it is practically impossible to consider various abnormal conditions in advance, and this problem is particularly pronounced in complex facilities such as plants where various conditions interact with each other.

[0149] In contrast, the device 1000 according to the second embodiment evaluates the trial operation based on the changes in state data when the controlled object 15 is controlled according to the trial operation, and searches for a recovery operation based on the evaluation result. Thus, according to the device 1000 according to the second embodiment, a recovery operation to restore the equipment 10 from abnormal to normal is searched for by trial operation using the actual equipment, so it is possible to attempt recovery from various abnormal states without having to prepare in advance a database for determining the recovery operation or a simulator that simulates the equipment 10.

[0150] Furthermore, the apparatus 1000 according to the second embodiment may determine target data and evaluate the trial operation based on the change in distance between the state data and the target data. As a result, the apparatus 1000 according to the second embodiment can give a higher evaluation to trial operations that bring the state of the equipment 10 closer to the target state.

[0151] Furthermore, the device 1000 according to the second embodiment may determine target data based on a plurality of normal data. As a result, the device 1000 according to the second embodiment can objectively set the target to be achieved when restoring the equipment 10 from abnormal to normal, based on a plurality of normal data, rather than setting it randomly.

[0152] In this case, the apparatus 1000 according to the second embodiment may determine the target data based on statistical values ​​in a plurality of normal data sets. There are many different types of abnormalities, including static abnormalities where there is no order or other relationship between the data, and dynamic abnormalities where there is an order relationship between the data. According to the apparatus 1000 according to the second embodiment, even in the case of such a wide variety of abnormalities, it is possible to appropriately set the target to be aimed for in order to restore the equipment 10 from abnormality to normal.

[0153] Furthermore, in the second embodiment, the device 1000 may sequentially change one of the multiple operation parameters included in the trial operation when searching for a recovery operation. As a result, the device 1000 in the second embodiment can search for a recovery operation by sequentially evaluating each operation parameter, even when it is unclear which operation parameter contributes to the recovery operation.

[0154] In this case, the device 1000 according to the second embodiment may omit changing one operation parameter to some of the candidate operation quantities among the multiple candidate operation quantities. As a result, the device 1000 according to the second embodiment can search for a return operation without exhaustively trying all combinations of candidate operation quantities.

[0155] Furthermore, the device 1000 according to the second embodiment may also be equipped with a function to detect abnormalities in the equipment 10 based on status data. As a result, the device 1000 according to the second embodiment can realize both an abnormality detection function and a recovery operation search function in a single device. Moreover, the device 1000 according to the second embodiment can autonomously detect abnormalities in the equipment 10 without human intervention, and can automatically sort normal data and abnormal data necessary for searching for recovery operations by assigning normal labels and abnormal labels to the status data.

[0156] Furthermore, the device 1000 according to the second embodiment may also be equipped with a function to issue a warning if the equipment 10 does not recover normally from an abnormality within predetermined conditions. This allows the device 1000 according to the second embodiment to inform the user if the equipment 10 does not recover normally from an abnormality within the conditions despite searching for a recovery operation. Therefore, even if it is difficult to automatically recover the equipment 10 according to the device 1000 according to the second embodiment, the user can be prompted to switch to manual recovery, etc., without unnecessarily repeating the recovery operation search process.

[0157] In this case, the device 1000 according to the second embodiment may issue a warning if the number of times the control target 15 has been controlled according to the trial operation exceeds a predetermined threshold, or if the elapsed time from the detection of an abnormality in the equipment 10 until it returns to normal exceeds a predetermined threshold. Since the time constant and settling time vary depending on the equipment 10, the rate at which the state of the equipment changes when the control target 15 is controlled according to the trial operation varies. According to the device 1000 according to the second embodiment, even in such cases, the timing for stopping, interrupting, or ending the search for a return operation can be set to the optimal timing for each piece of equipment 10.

[0158] Figure 11 shows another example of a block diagram of a control system 1 which may include the device 1000 according to the second embodiment. In this figure, the same reference numerals are used for components having the same function and configuration as in Figure 9, and descriptions are omitted below except for differences. Up to this point, the case in which the control device 20 and the device 1000 are provided as separate, independent devices has been shown as an example. However, the control device 20 and the device 1000 may be provided as a single integrated device, either partially or entirely. In this figure, the case in which the device 1000 also provides the functions of the control device 20 is shown.

[0159] In this figure, the device 1000 further comprises a control unit 510. In this figure, the state data acquisition unit 110 may supply the acquired state data to the control unit 510 in addition to the detection unit 120. Also, the search unit 180 may supply trial operations to the control unit 510 instead of the control device 20.

[0160] The control unit 510 may be mainly provided by a CPU and may be implemented in the device 1000 as a functional unit similar to the control device 20. That is, if no abnormality occurs in the equipment 10, the control unit 510 may control the controlled object 15 based on the state data acquired by the state data acquisition unit 110. In this case, the control unit 510 may control the controlled object 15 by PID control or by AI control. On the other hand, if an abnormality occurs in the equipment 10, the control unit 510 may control the controlled object 15 according to trial operations supplied by the search unit 180. In this case, the control unit 510 may switch the control mode depending on whether or not an abnormality in the equipment 10 has been detected by the detection unit 120.

[0161] Thus, the device 1000 according to the second embodiment may further include a control unit 510. As a result, the device 1000 according to the second embodiment can realize both the function of searching for a recovery operation and the function of controlling the controlled object 15 with a single device. Therefore, the device 1000 according to the second embodiment does not require supplying trial operations from the device 1000 to the control unit 20, and the risk of trial operations being tampered with during communication between the device 1000 and the control unit 20 can be eliminated, thereby protecting the equipment 10 from security threats.

[0162] Figure 12 shows an example of a block diagram of a control system 1 which may include a modified example of the second embodiment, the apparatus 1000. In this figure, the same reference numerals are used for components having the same function and configuration as in Figure 9, and descriptions are omitted below except for differences. In the above description, an example was shown in which the apparatus 1000 evaluates the trial operation using target data. However, in this modified example, the apparatus 1000 evaluates the trial operation using an evaluation index.

[0163] In this modified example, the control system 1 may further include an evaluation model 40. The evaluation model 40 outputs an evaluation index that assesses the state of the equipment 10 in response to state data indicating the state of the equipment 10 being input. In generating such an evaluation model 40, for example, labeling data may be generated based on the operational targets of the equipment 10 (plant KPI (Key Performance Indicator) etc.), state data indicating the state of the equipment 10, and training labels. Then, the evaluation model 40 may be generated using a machine learning algorithm with the generated labeling data as training data. The process of generating the evaluation model 40 itself is arbitrary, so further details will not be explained here.

[0164] In this modified example, the control device 20 performs AI control using an operation model. In this figure, the case where the evaluation model 40 is the same as the evaluation model used during reinforcement learning of the operation model is shown as an example. That is, the evaluation index used for evaluating the trial operation and the evaluation index used for reinforcement learning of the operation model may be output from the same model. However, it is not limited to this. The evaluation model 40 may be different from the evaluation model used during reinforcement learning of the operation model. That is, the evaluation index used for evaluating the trial operation and the evaluation index used for reinforcement learning of the operation model may be output from different models.

[0165] In this modified example, the device 1000 further includes an indicator acquisition unit 610 instead of the target data determination unit 130. Furthermore, if the detection unit 120 determines that it has detected an abnormality in the equipment 10, it attaches an abnormality label to the status data and supplies it to the indicator acquisition unit 610.

[0166] The index acquisition unit 610 acquires an evaluation index that evaluates the state of the equipment 10 in response to the input of state data to the evaluation model 40. The index acquisition unit 610 may mainly provide state data that has been labeled with an abnormality by the detection unit 120 via a network, which may be provided via a communication interface. The evaluation model 40 may output an evaluation index that evaluates the state of the equipment 10 in response to the input of state data. The index acquisition unit 610 may acquire the evaluation index output from the evaluation model 40 in this manner via the network. The index acquisition unit 610 supplies the acquired evaluation index to the evaluation unit 170.

[0167] In this modified example, the evaluation unit 170 evaluates the trial operation based on changes in the evaluation index. The evaluation unit 170 may be mainly provided by the CPU and may derive changes in the evaluation index by analyzing evaluation index acquired in time series from the index acquisition unit 610. The evaluation unit 170 may then evaluate the trial operation based on the changes in the evaluation index. The evaluation unit 170 supplies the evaluated results to the search unit 180. The search unit 180 may search for a recovery operation based on these evaluation results.

[0168] Figure 13 shows an example of a flowchart of a method that the apparatus 1000 according to a modified version of the second embodiment may perform. Steps S1400 to S1460 and steps S1475 to S1490 may be the same as in Figure 10, except that step S1450 is omitted, so a detailed explanation is omitted here. In this modified version, if the computer determines in step S1440 that a recovery process is being performed, the computer proceeds to step S1465.

[0169] In step S1465, the computer acquires an evaluation index that evaluates the state of the equipment 10 in response to inputting state data into the evaluation model 40. For example, an index acquisition unit 610, which may be implemented in the computer, may supply the state data S, to which an abnormality label has been attached in step S1420, to the evaluation model 40 via the network.

[0170] The evaluation model 40 may output an evaluation index I that evaluates the state of the equipment 10 in response to the input of state data S. For example, when k=1, the evaluation model 40 may output an evaluation index I1 that evaluates the state of the equipment 10 before the controlled object 15 is controlled according to trial operation A0 in response to the input of state data S0. The evaluation model 40 may also output an evaluation index I1 that evaluates the state of the equipment 10 after the controlled object 15 has been controlled according to trial operation A0 in response to the input of state data S1. Thus, the evaluation model 40 may output evaluation indices I0 and I1 before and after the controlled object 15 is controlled according to trial operation A0. The index acquisition unit 610 may acquire the evaluation indices I0 and I1 output from the evaluation model 40 via the network.

[0171] Similarly, when k=2, the evaluation model 40 may output an evaluation index I2 that evaluates the state of the equipment 10 after the controlled object 15 has been controlled according to the trial operation A1, in response to the input of state data S2. The index acquisition unit 610 may then acquire the evaluation index I2 output from the evaluation model 40 via the network. The index acquisition unit 610 acquires an evaluation index I that evaluates the state of the equipment 10 in response to the input of state data S to the evaluation model 40, for example in this way. The index acquisition unit 610 then supplies the acquired evaluation index I to the evaluation unit 170.

[0172] In step S1470, the computer evaluates the trial operation based on the change in the evaluation index. For example, an evaluation unit 170, which may be implemented in the computer, may evaluate evaluation index A based on the change in evaluation index I obtained in step S1465.

[0173] For example, when k=1, the evaluation unit 170 may calculate the difference i01 by subtracting the evaluation index I1 from the evaluation index I0. If the difference i01 is less than 0, that is, if the evaluation index I1 is higher than the evaluation index I0, it means that the condition of the equipment 10 has improved as a result of trial operation A0. In this case, the evaluation unit 170 may assign an evaluation value greater than 0 to trial operation A0. In this case, the evaluation unit 170 may assign an evaluation value such that the value increases as the absolute value of the difference i01 increases.

[0174] If the difference i01 is 0, that is, if evaluation index I0 and evaluation index I1 are the same, it means that the state of the equipment 10 did not change as a result of trial operation A0. In this case, the evaluation unit 170 may assign an evaluation value of 0 to trial operation A0.

[0175] If the difference i01 is less than 0, that is, if the evaluation index I1 is lower than the evaluation index I0, it means that the condition of the equipment 10 has deteriorated due to trial operation A0. In this case, the evaluation unit 170 may assign an evaluation value less than 0 to trial operation A0. In this case, the evaluation unit 170 may assign an evaluation value such that the value decreases as the absolute value of the difference d01 increases.

[0176] The evaluation unit 170 may evaluate the trial operation A based on the change in the evaluation index I, for example, as shown above. The evaluation unit 170 supplies the evaluated result to the search unit 180. The search unit 180 may then search for a recovery operation based on such an evaluation result.

[0177] As described above, various methods can be considered for setting the target to be achieved when restoring equipment 10 from abnormal to normal, and it may be unclear which method is optimal for determining the target data. In contrast, the device 1000 according to this modified example searches for a recovery operation based on the results of evaluating trial operations in cooperation with the evaluation model 40. As a result, the device 1000 according to this modified example can search for a recovery operation without determining target data when restoring equipment 10 from abnormal to normal.

[0178] In particular, if the evaluation model 40 that outputs the evaluation index is the same as the evaluation model used during reinforcement learning of the operation model, the apparatus 1000 according to this modified example can search for a return operation that is consistent with, or has little consistency with, the operation under AI control.

[0179] On the other hand, if an abnormality occurs in the equipment 10, the cause may lie in the operation model or evaluation model used for AI control (for example, undertraining, overtraining, or labeling errors). Therefore, if the evaluation model 40 that outputs evaluation indicators is different from the evaluation model used during reinforcement learning of the operation model, the device 1000 according to this modified example can search for an independent operation separate from the operation under AI control as a recovery operation.

[0180] Figure 14 shows another example in the block diagram of the control system 1, which may include the device 1000 according to a modification of the second embodiment. In this figure, the same reference numerals are used for components having the same function and configuration as in Figure 11 or Figure 12, and descriptions are omitted below except for differences. Up to this point, an example has been shown in which the evaluation model 40 is stored outside the device 1000. However, the evaluation model 40 may be stored inside the device 1000. In this figure, the device 1000 further comprises the evaluation model 40.

[0181] Thus, the modified device 1000 may further include an evaluation model 40. This allows the device 1000 to implement both a function for searching for a recovery operation and a function for storing the evaluation model 40 within a single device. Therefore, the device 1000, when acquiring evaluation indicators, does not require external communication, thus reducing communication costs and time, and preventing information leakage to external parties.

[0182] Up to this point, the first embodiment has described a first recovery process that determines a recovery operation to restore the equipment 10 from abnormal to normal based on simulation results using the simulator 30, and the second embodiment has described a second recovery process that searches for a recovery operation to restore the equipment 10 from abnormal to normal through trial operations using the actual equipment, as separate embodiments. However, the first and second embodiments can also be combined as appropriate.

[0183] Figure 15 shows an example of a block diagram of the device 1500 according to the third embodiment. The device 1500 according to the third embodiment is capable of performing both a first recovery process and a second recovery process, and when an abnormality occurs in the equipment 10, it selects which recovery process to attempt to recover from the abnormality. This will be explained in detail. The device 1500 may include a first recovery processing unit 1510, a second recovery processing unit 1520, a priority storage unit 1530, a recovery process selection unit 1540, a notification unit 1550, and a user input unit 1560.

[0184] The first recovery processing unit 1510 executes a first recovery process to determine a recovery operation to restore the equipment 10 from abnormal to normal based on the simulation results using the simulator 30. For example, the first recovery processing unit 1510 may have a functional unit similar to the functional unit of the device 100 according to the first embodiment, and may be capable of executing a recovery process similar to that of the device 100 according to the first embodiment, i.e., the first recovery process. The first recovery processing unit 1510 executes the first recovery process when the first recovery process is selected by the recovery process selection unit 1540, and may notify the recovery process selection unit 1540 of any warnings issued during the first recovery process.

[0185] The second recovery processing unit 1520 performs a second recovery process to search for a recovery operation by performing trial operations using the actual equipment. For example, the second recovery processing unit 1520 may have a functional unit similar to the functional unit of the device 1000 according to the second embodiment, and may be capable of performing a recovery process similar to that of the device 1000 according to the second embodiment, i.e., the second recovery process. The second recovery processing unit 1520 then performs the second recovery process when the recovery process selection unit 1540 selects the second recovery process, and may notify the recovery process selection unit 1540 of any warnings issued during the second recovery process. Here, "actual equipment" may mean the entire facility 10 that is subject to control based on the recovery process selected by the device such as the device 1500, or it may mean the controlled object 15 in such facility 10.

[0186] The priority storage unit 1530 stores a first priority for prioritizing the first return process and a second priority for prioritizing the second return process. The priority storage unit 1530 may be mainly provided by memory and may store the first priority and the second priority in a read / write manner.

[0187] When an abnormality occurs in the equipment 10, the recovery process selection unit 1540 selects a recovery process to be executed from among the first recovery process and the second recovery process, according to predetermined rules. The recovery process selection unit 1540 may be mainly provided by the CPU, and may select a recovery process to be executed according to the first priority and second priority stored in the priority storage unit 1530. If the recovery process selection unit 1540 selects the first recovery process, it may instruct the first recovery processing unit 1510 to execute the first recovery process. If the recovery process selection unit 1540 selects the second recovery process, it may instruct the second recovery processing unit 1520 to execute the second recovery process.

[0188] Furthermore, if the recovery process selection unit 1540 is notified that the first recovery processing unit 1510 has issued a warning during the first recovery process, and is also notified that the second recovery processing unit 1520 has issued a warning during the second recovery process, it may notify the notification unit 1550 of this fact.

[0189] The notification unit 1550 notifies that the equipment 10 cannot be automatically restored if the equipment 10 fails to recover normally from the abnormal state by either the first or second recovery process. The notification unit 1550 may be mainly provided by a display, and may display a notification screen indicating that the equipment 10 cannot be automatically restored in response to a notification from the recovery process selection unit 1540.

[0190] The user input unit 1560 receives input from the user for a reset operation when it is notified that the equipment 10 cannot be automatically reset. The user input unit 1560 may be mainly provided by an input / output unit and may receive a reset operation input by the user using a keyboard, mouse, etc. The user input unit 1560 may supply the user's reset operation to the second reset processing unit 1520. In response, the second reset processing unit 1520 may supply the user's reset operation to the control device 20, or control the controlled object 15 according to the user's reset operation.

[0191] The device 1500 equipped with such a functional unit may be a computer such as a PC (personal computer), tablet computer, smartphone, workstation, server computer, or general-purpose computer, or it may be a computer system in which multiple computers are connected. Such a computer system is also a computer in a broad sense. The device 1500 may also be implemented by a virtual computer environment that can run one or more times within the computer. Alternatively, the device 1500 may be a dedicated computer designed for selecting recovery processing, or it may be dedicated hardware realized by dedicated circuitry. Furthermore, if the device 1500 is connected to the internet, the device 1500 may be implemented by cloud computing.

[0192] Such a computer may include a memory for storing programs and a processor for executing programs, and the processor may implement the functions of the device 1500 by executing the program. That is, a program may be provided that is executed by the computer and causes the computer to function as follows: a first recovery processing unit 1510 that executes a first recovery processing that determines a recovery operation to restore the equipment 10 from abnormal to normal based on simulation results using a simulator; a second recovery processing unit 1520 that executes a second recovery processing that searches for a recovery operation through trial operations using the actual machine; and a recovery processing selection unit 1540 that, when an abnormality occurs in the equipment 10, selects a recovery processing to be executed from the first recovery processing and the second recovery processing according to predetermined rules. Furthermore, a non-temporary computer-readable medium on which such a program is recorded may be provided.

[0193] Figure 16 shows an example of a flowchart of a method that the device 1500 according to the third embodiment may perform. Each step in this figure may be performed by the device 1500, i.e., the computer, as the operating entity. However, in each step, it is sufficient that the computer is the operating entity as a whole, and it may include cases where a non-computer entity performs a part of the process that is not the main part.

[0194] In step S1600, the computer determines whether the first priority is higher than the second priority. For example, a recovery process selection unit 1540, which may be implemented in the computer, may access the priority storage unit 1530 and obtain a first priority for prioritizing the first recovery process and a second priority for prioritizing the second recovery process.

[0195] The first and second priorities may have their initial values ​​predetermined by the user. Furthermore, the first and second priorities may be updated as needed based on the recovery process performance, as described later.

[0196] The recovery process selection unit 1540 may compare the acquired first priority and second priority and determine whether the first priority is higher than the second priority. If the first priority is higher than the second priority (Yes), the recovery process selection unit 1540 may select the first recovery process as the recovery process to attempt recovery from the abnormality and instruct the first recovery processing unit 1510 to execute the first recovery process. The computer then proceeds to step S1610.

[0197] On the other hand, if the first priority is not higher than the second priority (i.e., No), the recovery process selection unit 1540 may select the second recovery process as the recovery process to attempt recovery from the abnormality, and instruct the second recovery processing unit 1520 to execute the second recovery process. The computer then proceeds to step S1620. The recovery process selection unit 1540 may, for example, select a recovery process to be executed according to the first priority and the second priority stored in the priority storage unit 1530.

[0198] In step S1610, the computer performs a first recovery process. For example, a first recovery processing unit 1510, which may be implemented in the computer, may perform a first recovery process that determines a recovery operation to restore the equipment 10 from abnormal to normal based on the simulation results using the simulator 30, when instructed by the recovery processing selection unit 1540 to perform the first recovery process.

[0199] In step S1611, the computer determines whether the equipment 10 has recovered from an abnormality to normal operation. For example, a first recovery processing unit 1510, which may be implemented in the computer, may acquire status data indicating the state of the equipment 10 and determine whether an abnormality in the equipment 10 has been detected based on the status data. If no abnormality in the equipment 10 is detected, the first recovery processing unit 1510 may determine that the equipment 10 has recovered from an abnormality to normal operation (Yes). If the equipment 10 has recovered from an abnormality to normal operation, the first recovery processing unit 1510 notifies the recovery processing selection unit 1540 of this fact. The computer then proceeds to step S1612.

[0200] In step S1612, the computer increases the first priority. For example, a recovery process selection unit 1540, which may be implemented in the computer, may increase the first priority and update the first priority stored in the priority storage unit 1530 when it is notified by the first recovery processing unit 1510 that the equipment 10 has recovered from an abnormality to a normal state. The recovery process selection unit 1540 may increase the first priority in this way, for example, when the equipment 10 recovers from an abnormality to a normal state while the first recovery process is selected. Then the computer terminates this flow.

[0201] On the other hand, if an abnormality in the equipment 10 is detected in step S1611, the first recovery processing unit 1510 may determine that the equipment 10 did not recover normally from the abnormality (No). If the equipment 10 did not recover normally from the abnormality, the computer proceeds to step S1613.

[0202] In step S1613, the computer determines whether or not the conditions are within a predetermined range. For example, a first recovery processing unit 1510, which may be implemented in the computer, may determine whether the number of steps k is within a predetermined threshold K. The first recovery processing unit 1510 may also determine whether or not the elapsed time t is within a predetermined threshold T. However, it is not limited to these conditions. Various conditions for stopping, interrupting, or terminating the first recovery processing may be predetermined. If it is determined that the conditions are within a predetermined range (Yes), the computer returns the process to step S1610 and continues the flow. On the other hand, if it is determined that the conditions are not within a predetermined range (No), the first recovery processing unit 1510 notifies the recovery processing selection unit 1540 of this fact. The computer then proceeds the process to step S1614.

[0203] In step S1614, the computer stops the first recovery process. For example, a recovery process selection unit 1540, which may be implemented in the computer, may instruct the first recovery processing unit 1510 to stop the first recovery process if it is notified by the first recovery processing unit 1510 that the conditions are not within a predetermined range. In response, the first recovery processing unit 1510 may stop the first recovery process.

[0204] In step S1615, the computer lowers the first priority. For example, a recovery process selection unit 1540, which may be implemented in the computer, may lower the first priority and update the first priority stored in the priority storage unit 1530 when it instructs the computer to stop the first recovery process. The recovery process selection unit 1540 may, for example, lower the first priority in this way if the equipment 10 does not recover normally from an abnormality while the first recovery process is selected. The computer then proceeds to step S1616.

[0205] In step S1616, the computer determines whether or not the second recovery process has been executed. For example, a recovery process selection unit 1540, which may be implemented in the computer, may determine whether or not it has instructed the second recovery processing unit 1520 to execute the second recovery process. If the second recovery processing unit 1520 has not been instructed to execute the second recovery process, the recovery process selection unit 1540 may determine that the second recovery process has not been executed (No). If it is determined that the second recovery process has not been executed, the recovery process selection unit 1540 may instruct the second recovery processing unit 1520 to execute the second recovery process. Then, the computer proceeds to step S1620.

[0206] In step S1620, the computer performs a second recovery process. For example, a second recovery processing unit 1520, which may be implemented in the computer, may perform a second recovery process that searches for a recovery operation by trial operation using the actual machine when instructed to perform a second recovery process by the recovery process selection unit 1540.

[0207] In step S1621, the computer determines whether the equipment 10 has recovered from an abnormality to normal operation. For example, a second recovery processing unit 1520, which may be implemented in the computer, may acquire status data indicating the state of the equipment 10 and determine whether an abnormality in the equipment 10 has been detected based on the status data. If no abnormality in the equipment 10 is detected, the second recovery processing unit 1520 may determine that the equipment 10 has recovered from an abnormality to normal operation (Yes). If the equipment 10 has recovered from an abnormality to normal operation, the second recovery processing unit 1520 notifies the recovery processing selection unit 1540 of this fact. The computer then proceeds to step S1622.

[0208] In step S1622, the computer increases the second priority. For example, a recovery process selection unit 1540, which may be implemented in the computer, may increase the second priority and update the second priority stored in the priority storage unit 1530 when it is notified by the second recovery processing unit 1520 that the equipment 10 has recovered from an abnormal state to a normal state. The recovery process selection unit 1540 may increase the second priority in this way, for example, when the equipment 10 recovers from an abnormal state to a normal state while the second recovery process is selected. Then the computer terminates this flow.

[0209] On the other hand, if an abnormality in the equipment 10 is detected in step S1621, the second recovery processing unit 1520 may determine that the equipment 10 did not recover normally from the abnormality (No). If the equipment 10 did not recover normally from the abnormality, the computer proceeds to step S1623.

[0210] In step S1623, the computer determines whether or not the conditions are within a predetermined range. For example, a second recovery processing unit 1520, which may be implemented in the computer, may determine whether the number of steps k is within a predetermined threshold K. The second recovery processing unit 1520 may also determine whether or not the elapsed time t is within a predetermined threshold T. However, it is not limited to these conditions. Various conditions for stopping, interrupting, or terminating the second recovery process may be predetermined. The conditions for stopping, interrupting, or terminating the second recovery process may be the same as or different from the conditions for stopping, interrupting, or terminating the first recovery process. If it is determined that the conditions are within a predetermined range (Yes), the computer returns the process to step S1620 and continues the flow. On the other hand, if it is determined that the conditions are not within a predetermined range (No), the second recovery processing unit 1520 notifies the recovery processing selection unit 1540 of this fact. The computer then proceeds to step S1624.

[0211] In step S1624, the computer stops the second recovery process. For example, a recovery process selection unit 1540, which may be implemented in the computer, may instruct the second recovery processing unit 1520 to stop the second recovery process if it is notified by the second recovery processing unit 1520 that the conditions are not within a predetermined range. In response, the second recovery processing unit 1520 may stop the second recovery process.

[0212] In step S1625, the computer lowers the second priority. For example, a recovery process selection unit 1540, which may be implemented in the computer, may lower the second priority and update the second priority stored in the priority storage unit 1530 when it instructs the computer to stop the second recovery process. The recovery process selection unit 1540 may, for example, lower the second priority in this way if the equipment 10 does not recover normally from the abnormality while the second recovery process is selected. The computer then proceeds to step S1626.

[0213] In step S1626, the computer determines whether or not the first recovery process has been executed. For example, a recovery process selection unit 1540, which may be implemented in the computer, may determine whether or not it has instructed the first recovery processing unit 1510 to execute the first recovery process. If the first recovery processing unit 1510 has not been instructed to execute the first recovery process, the recovery process selection unit 1540 may determine that the first recovery process has not been executed (No). If it is determined that the first recovery process has not been executed, the recovery process selection unit 1540 may instruct the first recovery processing unit 1510 to execute the first recovery process. Then, the computer proceeds to step S1610.

[0214] The recovery process selection unit 1540 may select the other recovery process from the first recovery process to the second recovery process if the equipment 10 does not recover normally from the abnormality within predetermined conditions while one of the first recovery process and the second recovery process is selected. In this case, the recovery process selection unit 1540 may select the other recovery process if the number of times the controlled object 15 has been controlled exceeds a predetermined threshold while one recovery process is selected, or if the elapsed time exceeds a predetermined threshold while one recovery process is selected.

[0215] On the other hand, if it is determined in step S1616 that the second recovery process has been performed (Yes), or if it is determined in step S1626 that the first recovery process has been performed (Yes), the recovery process selection unit 1540 may notify the notification unit 1550 that the equipment 10 has not recovered normally from the abnormal state by either the first or second recovery process. The computer then proceeds to step S1630.

[0216] In step S1630, the computer notifies that the equipment 10 cannot be automatically restored. For example, a notification unit 1550, which may be implemented in the computer, may notify that the equipment 10 cannot be automatically restored by displaying the message "Automatic restoration is not possible" on the display when it is notified by the restoration process selection unit 1540 that the equipment 10 cannot be restored normally from the abnormal state by either the first restoration process or the second restoration process.

[0217] In this case, the notification unit 1550 may further prompt the user to input a reset operation by displaying the message "Please input a reset operation" on the display. In response, the user input unit 1560 may accept a reset operation input from the user if it has notified that the equipment 10 cannot be automatically reset. When a reset operation is input by the user via a keyboard, mouse, etc., the user input unit 1560 may supply the user's reset operation to the second reset processing unit 1520. In response, the second reset processing unit 1520 may supply the user's reset operation to the control device 20, or control the controlled object 15 according to the user's reset operation. The computer then terminates this flow.

[0218] Thus, a method may be proposed in which the computer performs a first recovery process to determine a recovery operation to restore the equipment 10 from an abnormality to normal operation based on the simulation results using a simulator; performs a second recovery process to search for a recovery operation through trial operations using the actual equipment; and, when an abnormality occurs in the equipment 10, selects a recovery process to be executed from the first recovery process and the second recovery process according to predetermined rules.

[0219] The device 1500 according to the third embodiment does not allow only one of the first or second recovery process to be executed, but rather allows both to be executed, and selects which recovery process to attempt to recover from the abnormality using a rule-based method. As a result, the device 1500 according to the third embodiment can increase the likelihood of recovering the equipment 10 from an abnormality to normal operation using either recovery process, even when it is unknown whether the recovery process based on simulation results or the recovery process based on trial operations will function effectively.

[0220] In this case, the device 1500 according to the third embodiment may select the other recovery process if the equipment 10 does not recover normally from the abnormality within predetermined conditions while one recovery process is selected. Thus, according to the device 1500 according to the third embodiment, the device attempts to recover the equipment 10 using one recovery process as long as the conditions are met, and only switches to the other recovery process when the conditions are no longer met.

[0221] Furthermore, the device 1500 according to the third embodiment may further include a priority storage unit that stores a first priority for prioritizing the first recovery process and a second priority for prioritizing the second recovery process, and may select the recovery process to be executed according to the first priority and the second priority. As a result, the device 1500 according to the third embodiment can objectively select the recovery process to be executed according to the priority.

[0222] In this case, the device 1500 according to the third embodiment may increase the first priority if the equipment 10 recovers normally from an abnormality while the first recovery process is selected, and increase the second priority if the equipment 10 recovers normally from an abnormality while the second recovery process is selected. This makes it easier for the device 1500 according to the third embodiment to select a recovery process that has been successfully completed. Furthermore, the device 1500 according to the third embodiment may decrease the first priority if the equipment 10 does not recover normally from an abnormality while the first recovery process is selected, and decrease the second priority if the equipment 10 does not recover normally from an abnormality while the second recovery process is selected. This makes it more difficult for the device 1500 according to the third embodiment to select a recovery process that has failed to recover. In this way, the device 1500 according to the third embodiment can also dynamically control the priority by taking into account the recovery record.

[0223] Furthermore, the device 1500 according to the third embodiment may notify the user if the equipment 10 fails to recover from the abnormal state by either recovery process. In this way, the device 1500 according to the third embodiment can inform the user that the equipment 10 could not be automatically recovered despite both the first recovery process and the second recovery process being performed.

[0224] In this case, the device 1500 according to the third embodiment may accept input for a recovery operation by the user. As a result, the device 1500 according to the third embodiment accepts a recovery operation by the user instead of terminating the process when automatic recovery is not possible, so that even if automatic recovery is not possible, an attempt can be made to recover the equipment 10 by manual recovery.

[0225] Up to this point, possible implementations have been described by illustrating them. However, the above-described embodiments may be modified or applied in various ways. For example, in the above description, one example was shown where the recovery process selection unit 1540 exclusively selects the first recovery process and the second recovery process. That is, when the recovery process selection unit 1540 instructs the execution of the first recovery process, it stops the second recovery process, and when it instructs the execution of the second recovery process, it stops the first recovery process. However, the recovery process selection unit 1540 may select both the first recovery process and the second recovery process for at least a portion of the period.

[0226] If an abnormality occurs in equipment 10, it is desirable to restore equipment 10 to operation as quickly as possible. In the first recovery process, the simulator 30 needs to perform a simulation to acquire multiple simulated data, but such simulations can take a long time. This problem is particularly pronounced in large-scale equipment 10, such as a plant. However, if the simulator 30 is constructed using a simplified model in order to shorten the simulation time, the error between the actual equipment and the simulation results will become large, and the first recovery process may not function effectively.

[0227] The apparatus 1500 according to the third embodiment may be configured to allow both the first recovery process and the second recovery process to be selected at least temporarily simultaneously, taking such a situation into consideration. If both the first recovery process and the second recovery process are selected for a period of time, the recovery processes are executed by both the first recovery processing unit 1510 and the second recovery processing unit 1520 during this period. For example, if both the first recovery process and the second recovery process are selected, and the second recovery process is given a higher priority than the first recovery process, the second recovery processing unit 1520 may execute the second recovery process while the first recovery processing unit 1510 is running a simulation to prepare for the first recovery process. After the simulation by the first recovery processing unit 1510 is completed, the first recovery processing unit 1510 may execute the first recovery process.

[0228] As described above, the first recovery processing unit 1510 acquires multiple simulated data by inputting the initial state data of the equipment 10 when the abnormality occurred into the simulator 30 when executing the first recovery processing. If the second recovery processing unit 1520 executes the second recovery processing during this time, the state of the equipment 10 will have changed from its initial state by the time the first recovery processing unit 1510 acquires the multiple simulated data. In this case, if such a change is too large, even if the first recovery processing unit 1510 controls the controlled object 15 according to the recovery operation determined based on the simulation results, it may not function effectively.

[0229] Therefore, when the second recovery processing unit 1520 executes the second recovery processing while the simulation in the first recovery processing is being executed, it may impose constraints to prevent the state data from changing too much. For example, when evaluating the trial operation, the second recovery processing unit 1520 may be configured to lower the evaluation value of the trial operation if the degree of change in the state data exceeds a predetermined upper limit.

[0230] Furthermore, the above explanation shows an example in which the recovery process selection unit 1540 selects the first recovery process and the second recovery process once each, and terminates the selection if the equipment 10 does not recover normally from the abnormal state by either process. However, the recovery process selection unit 1540 may select at least one of the first recovery process and the second recovery process multiple times. For example, the recovery process selection unit 1540 may alternately select the first recovery process and the second recovery process multiple times. The recovery process selection unit 1540 may also be configured to terminate the selection when either recovery process has been selected a predetermined number of times.

[0231] Various embodiments of the present invention may be described with reference to flowcharts and block diagrams, where a block may represent (1) a stage in a process in which an operation is performed or (2) a section of a device having the role of performing the operation. Specific stages and sections may be implemented by dedicated circuits, programmable circuits supplied with computer-readable instructions stored on a computer-readable medium, and / or processors supplied with computer-readable instructions stored on a computer-readable medium. Dedicated circuits may include digital and / or analog hardware circuits, and may include integrated circuits (ICs) and / or discrete circuits. Programmable circuits may include reconfigurable hardware circuits, including logical AND, logical OR, logical XOR, logical NAND, logical NOR, and other logic operations, flip-flops, registers, memory elements such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), etc.

[0232] Computer-readable media may include any tangible device capable of storing instructions to be executed by a suitable device, and as a result, computer-readable media having instructions stored therein will comprise a product containing instructions that can be executed to create means for performing operations specified in a flowchart or block diagram. Examples of computer-readable media may include electronic storage media, magnetic storage media, optical storage media, electromagnetic storage media, semiconductor storage media, etc. More specific examples of computer-readable media may include floppy disks, diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), electrically erasable programmable read-only memory (EEPROM), static random access memory (SRAM), compact disk read-only memory (CD-ROM), digital versatile disk (DVD), Blu-ray (RTM) disk, memory stick, integrated circuit card, etc.

[0233] Computer-readable instructions may include assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk®, Java®, C++, and traditional procedural programming languages ​​such as the C programming language or similar programming languages.

[0234] Computer-readable instructions may be provided locally or via a wide area network (WAN), such as a local area network (LAN) or the internet, to a processor or programmable circuit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, and these instructions may be executed to create means for performing operations specified in a flowchart or block diagram. Examples of processors include computer processors, processing units, microprocessors, digital signal processors, controllers, microcontrollers, and the like.

[0235] Figure 17 shows an example of a computer 9900 in which multiple aspects of the present invention may be embodied in whole or in part. A program installed on the computer 9900 can cause the computer 9900 to function as an operation or one or more sections of an apparatus according to an embodiment of the present invention, or to execute such operation or one or more sections, and / or to cause the computer 9900 to execute a process or a stage of such process according to an embodiment of the present invention. Such a program may be executed by the CPU 9912 to cause the computer 9900 to perform a particular operation associated with some or all of the blocks in the flowcharts and block diagrams described herein.

[0236] The computer 9900 according to this embodiment includes a CPU 9912, RAM 9914, a graphics controller 9916, and a display device 9918, which are interconnected by a host controller 9910. The computer 9900 also includes input / output units such as a communication interface 9922, a hard disk drive 9924, a DVD drive 9926, and an IC card drive, which are connected to the host controller 9910 via an input / output controller 9920. The computer also includes legacy input / output units such as a ROM 9930 and a keyboard 9942, which are connected to the input / output controller 9920 via an input / output chip 9940.

[0237] The CPU 9912 operates according to programs stored in the ROM 9930 and RAM 9914, thereby controlling each unit. The graphics controller 9916 acquires image data generated by the CPU 9912 from a frame buffer provided in RAM 9914 or from itself, and displays the image data on the display device 9918.

[0238] The communication interface 9922 communicates with other electronic devices via a network. The hard disk drive 9924 stores programs and data used by the CPU 9912 in the computer 9900. The DVD drive 9926 reads programs or data from the DVD-ROM 9901 and provides them to the hard disk drive 9924 via the RAM 9914. The IC card drive reads programs and data from and / or writes programs and data to the IC card.

[0239] The ROM 9930 stores boot programs and / or programs that depend on the computer 9900's hardware, which are executed by the computer 9900 when activated. The input / output chip 9940 may also connect various input / output units to the input / output controller 9920 via parallel ports, serial ports, keyboard ports, mouse ports, etc.

[0240] The program is provided on a computer-readable medium such as a DVD-ROM 9901 or an IC card. The program is read from the computer-readable medium and installed on a hard disk drive 9924, RAM 9914, or ROM 9930, which are also examples of computer-readable medium, and executed by the CPU 9912. The information processing described within these programs is read by the computer 9900, resulting in coordination between the program and the various types of hardware resources described above. The apparatus or method may be configured to realize the manipulation or processing of information in accordance with the use of the computer 9900.

[0241] For example, when communication is performed between computer 9900 and an external device, CPU 9912 may execute a communication program loaded into RAM 9914 and instruct communication interface 9922 to perform communication processing based on the processing described in the communication program. Under the control of CPU 9912, communication interface 9922 reads transmission data stored in a transmission buffer processing area provided in a recording medium such as RAM 9914, hard disk drive 9924, DVD-ROM 9901, or IC card, transmits the read transmission data to the network, or writes received data received from the network to a receive buffer processing area provided on the recording medium.

[0242] Furthermore, the CPU 9912 may read all or necessary parts of files or databases stored on external recording media such as the hard disk drive 9924, DVD drive 9926 (DVD-ROM 9901), or IC card into the RAM 9914, and perform various types of processing on the data in the RAM 9914. The CPU 9912 then writes the processed data back to the external recording media.

[0243] Various types of information, such as various types of programs, data, tables, and databases, may be stored on the recording medium and subjected to information processing. The CPU 9912 may perform various types of processing on the data read from the RAM 9914, including various types of operations, information processing, conditional judgments, conditional branching, unconditional branching, information retrieval / replacement, etc., as described throughout this disclosure and specified by the program instruction sequence, and write the results back to the RAM 9914. The CPU 9912 may also retrieve information in files, databases, etc., within the recording medium. For example, if multiple entries are stored in the recording medium, each having an attribute value of a first attribute associated with an attribute value of a second attribute, the CPU 9912 may search among the multiple entries for an entry that matches the condition for which the attribute value of the first attribute is specified, read the attribute value of the second attribute stored in that entry, and thereby obtain the attribute value of the second attribute associated with the first attribute that satisfies a predetermined condition.

[0244] The programs or software modules described above may be stored on or near computer-readable media on computer 9900. Alternatively, recording media such as hard disks or RAM provided within a server system connected to a dedicated communication network or the Internet can be used as computer-readable media, thereby providing programs to computer 9900 via the network.

[0245] Although the present invention has been described above using embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments. It will be apparent to those skilled in the art that various modifications or improvements can be made to the above embodiments. It will be clear from the claims that such modified or improved forms may also be included in the technical scope of the present invention.

[0246] It should be noted that the execution order of operations, procedures, steps, and stages in the apparatus, systems, programs, and methods shown in the claims, specifications, and drawings is not explicitly stated as "before," "prior to," etc., and that these can be implemented in any order unless the output of a previous process is used in a later process. Even if the operation flow in the claims, specifications, and drawings is described using phrases such as "first," "next," etc. for convenience, it does not mean that it is essential to perform the operations in that order. [Explanation of Symbols]

[0247] 10 Equipment 15. Controlled object 20 Control device 30 Simulators 40 Evaluation Models 100 Apparatus according to the first embodiment 110 Status data acquisition unit 120 Detection unit 130 Target Data Determination Unit 140 Simulated Data Acquisition Unit 150 Recovery Operation Determination Unit 190 Warning section 510 Control Unit 610 Index acquisition part 1000 Apparatus according to the second embodiment 170 Evaluation Department 180 Search Department 1500 Apparatus according to the third embodiment 1510 First recovery processing unit 1520 Second recovery processing unit 1530 Priority storage unit 1540 Recovery Processing Selection Section 1550 Hochi Department 1560 User Input Section 9900 Computer 9901 DVD-ROM 9910 Host Controller 9912 CPU 9914 RAM 9916 Graphics Controller 9918 Display Device 9920 Input / Output Controller 9922 Communication Interface 9924 Hard Disk Drive 9926 DVD drive 9930 ROM 9940 Input / Output Chip 9942 Keyboard

Claims

1. A first recovery processing unit executes a first recovery process that determines a recovery operation to restore the equipment from an abnormal state to normal based on the simulation results using a simulator, A second recovery processing unit that performs a second recovery process to search for the recovery operation through trial operations using the actual device, When an abnormality occurs in the aforementioned equipment, a recovery process selection unit selects which recovery process to execute from the first recovery process and the second recovery process according to predetermined rules, A device equipped with the following features.

2. The apparatus according to claim 1, wherein the recovery process selection unit selects the other recovery process from the first recovery process and the second recovery process if the equipment fails to recover normally from an abnormality within predetermined conditions while one of the recovery processes from the first recovery process and the second recovery process is selected.

3. The apparatus according to claim 2, wherein the recovery process selection unit selects the other recovery process when the number of times the controlled object has been controlled while the one recovery process is selected exceeds a predetermined threshold.

4. The apparatus according to claim 2, wherein the recovery process selection unit selects the other recovery process when the elapsed time exceeds a predetermined threshold while one of the recovery processes is selected.

5. The system further includes a priority storage unit that stores a first priority for prioritizing the first recovery process and a second priority for prioritizing the second recovery process, The apparatus according to claim 1, wherein the recovery process selection unit selects a recovery process to be executed according to the first priority and the second priority.

6. The apparatus according to claim 5, wherein the recovery process selection unit increases the priority of the first recovery process if the equipment recovers from an abnormality to normal operation while the first recovery process is selected, and increases the priority of the second recovery process if the equipment recovers from an abnormality to normal operation while the second recovery process is selected.

7. The apparatus according to claim 5, wherein the recovery process selection unit lowers the priority of the first recovery process if the equipment does not recover normally from an abnormality while the first recovery process is selected, and lowers the priority of the second recovery process if the equipment does not recover normally from an abnormality while the second recovery process is selected.

8. The apparatus according to claim 1, wherein the recovery process selection unit selects both the first recovery process and the second recovery process for at least a portion of the period.

9. The apparatus according to claim 8, wherein the second recovery processing unit performs the second recovery process while the simulation in the first recovery process is being performed.

10. The apparatus according to any one of claims 1 to 9, further comprising a notification unit that notifies that the equipment cannot be automatically restored if the equipment fails to recover normally from an abnormality by either the first recovery process or the second recovery process.

11. The apparatus according to claim 10, further comprising a user input unit that accepts input from a user for the restoration operation when the apparatus is notified that it cannot be automatically restored.

12. Computers Based on the simulation results using the simulator, a first recovery process is performed to determine the recovery operation required to restore the equipment from an abnormal state to normal operation. A second recovery process is performed to search for the recovery operation through trial operations using the actual device, In the event of an abnormality in the aforementioned equipment, the system selects which of the first and second recovery processes to execute, according to predetermined rules. A method that includes [a certain feature].

13. It is executed by a computer, and the computer, A first recovery processing unit executes a first recovery process that determines a recovery operation to restore the equipment from an abnormal state to normal based on the simulation results using a simulator, A second recovery processing unit that performs a second recovery process to search for the recovery operation through trial operations using the actual device, When an abnormality occurs in the aforementioned equipment, a recovery process selection unit selects which recovery process to execute from the first recovery process and the second recovery process according to predetermined rules, A program that makes something work.

Images