JP2011170518A - State monitoring device and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a state monitoring device and method which is capable of properly setting a threshold for use in determining whether abnormality has occurred or not, with a small number of samples. <P>SOLUTION: Status data of a device is collected at intervals of a pre set first period, and a plurality of pieces of status data acquired at intervals of a prescribed second period longer than the first period, out of collected status data are statistically processed to calculate an average value and a standard deviation corresponding to the device, and the average value and the standard deviation are calculated at intervals of the first period. A calculated standard deviation value is corrected by filtering according with characteristics of the device, and a threshold for the device is calculated at intervals of the first period on the basis of the average value and the corrected standard deviation. During actual operation, the calculated threshold is used to determine whether or not abnormality has occurred in the device. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a state monitoring apparatus and method for detecting an abnormality or failure of a device incorporated in the apparatus.

  The quality of a computer or a system including a computer is represented by an index called RAS, taking three acronyms of reliability, availability, and serviceability. For example, in a computer that requires high reliability, a program (hereinafter referred to as a RAS program) for monitoring the presence or absence of an abnormal operation or failure of a device incorporated in its own device is monitored. ). The RAS program includes a program for restoring data and identifying the cause of failure when an abnormality or failure occurs. Examples of devices to be monitored include a central processing unit (CPU), a hard disk drive (HDD), a liquid crystal display (LCD), a battery, a cooling fan, and a peripheral component interconnect (PCI) device.

  A state monitoring device realized by a computer equipped with a RAS program includes various sensors for measuring temperature, voltage, current, and the like, and threshold values set in advance corresponding to the respective devices. Whether or not a device abnormality or failure has occurred is determined using an observed value (hereinafter also referred to as state data) and a corresponding threshold value.

  A technique for determining whether or not an abnormality or failure has occurred in various electronic devices such as a refrigeration / refrigerator, an air conditioner, and a vending machine using a predetermined threshold is described in Patent Document 1, for example. ing.

  Patent Document 2 describes a technique for processing state data indicating a state acquired from each device with an adaptive lattice filter in order to detect a steady state change of a device to be monitored.

  In Patent Document 3, RAS information is acquired by each computer connected to the network (indicated as “Station” in Patent Document 3), and RAS information of all computers connected to the network can be managed by each computer. The structure which was made is described.

JP 2003-172567 A JP 2007-201648 A JP-A-8-331125

  As described above, the threshold value used in the RAS program is an important index for determining whether or not a device is abnormal. However, since the optimum threshold value varies depending on the system configuration, the task to be processed, the usage environment, etc., there is a problem that it is difficult for the user, maintenance personnel, etc. to set the optimum value.

  In the state monitoring apparatus of the background art, the threshold value is basically a fixed value and does not change unless changed by the user or maintenance personnel. So, for example, if you set an upper threshold for the maximum expected variation and set a lower threshold for the minimum expected variation, the threshold margin for the observed value increases, There is a problem that even if an abnormality occurs, it cannot be detected unless the observed value at the time of the abnormality exceeds a threshold value.

  In Patent Document 1, state data (observation values) indicating the state of each device is collected every predetermined cycle, and a threshold necessary for failure determination is determined based on the normal distribution curve or the t distribution curve. The technique to do is shown. However, such a method requires a large number of state data to determine the threshold and may require a long learning period to determine the threshold. For example, in the case where observation values are collected regularly at a time of a predetermined day of the week, only about 4 to 5 samples can be obtained even after one month has passed since learning was started. In that case, because the uncertainty of the threshold is large, a larger number of samples is required, and it may take several months to determine the threshold. Therefore, it is desirable that an appropriate threshold value can be determined even when the number of samples is small.

  The present invention has been made to solve the above-described problems of the background art, and provides a state monitoring apparatus and method capable of appropriately determining a threshold value used for determining whether or not an abnormality has occurred even with a small number of samples. The purpose is to do.

In order to achieve the above object, a state monitoring apparatus of the present invention is a state monitoring apparatus that determines whether or not an abnormality has occurred in a device based on whether or not state data indicating a state of a device to be monitored exceeds a predetermined threshold value. There,
Data collecting means for collecting the state data of the device every preset first period;
Of the state data collected by the data collection means, statistical processing is performed on a plurality of state data acquired in a predetermined second period longer than the first period, thereby obtaining an average value and a standard deviation corresponding to the device. Statistical data calculating means for calculating the average value and standard deviation for each of the first periods,
The value of the standard deviation calculated by the statistical data calculation means is corrected by filtering according to the characteristics of the device, and based on the average value and the standard deviation after the correction, the device corresponding to the device Threshold value determining means for calculating a threshold value for each first period;
Using the threshold value calculated by the threshold value determining means, operation monitoring means for determining the presence or absence of abnormality of the device;
Have

On the other hand, the state monitoring method of the present invention is a state monitoring method for determining whether or not an abnormality has occurred in the device based on whether or not the state data indicating the state of the device to be monitored exceeds a predetermined threshold value,
Collecting the device status data for each preset first period,
Among the collected state data, by statistically processing a plurality of state data acquired in a predetermined second period longer than the first period, an average value and a standard deviation corresponding to the device are calculated, An average value and a standard deviation are calculated for each first period,
The calculated standard deviation value is corrected by filtering according to the characteristics of the device, and the threshold value corresponding to the device is set based on the average value and the standard deviation after the correction. Calculate every cycle,
This is a method for determining whether or not an abnormality has occurred in the device by using the calculated threshold value.

  According to the present invention, it is possible to appropriately determine a threshold value used for determining whether or not an abnormality has occurred even with a small number of samples.

It is a perspective view which shows one structural example of the computer which implement | achieves the state monitoring apparatus of this invention. It is a block diagram which shows one structural example of the state monitoring apparatus of this invention. It is a flowchart which shows an example of a process of the state monitoring apparatus of 1st Embodiment. It is a table figure which shows an example of the status data acquired by the data collection means shown in FIG. It is a graph which shows an example of the status data acquired by the data collection means shown in FIG. It is a graph which shows an example of the status data acquired by the data collection means shown in FIG. It is a graph which shows a mode that the average value of CPU temperature computed from the state data shown in FIG. 6 changes. It is a table figure which shows the average value, standard deviation, and variation | change_quantity of CPU temperature computed from the state data shown in FIG. It is a graph which shows an example of distribution in the time of the predetermined day of the week of CPU temperature shown in FIG. It is a flowchart which shows an example of the filter process implemented with the state monitoring apparatus of 1st Embodiment. It is a graph which shows a mode that each standard deviation was arranged in ascending order in the observation period of the predetermined day of the week calculated by the threshold value determination means shown in FIG. It is a graph which shows a mode that the threshold value calculated | required by the threshold value determination means shown in FIG. 2 and an observation value change. It is a flowchart which shows an example of the filter process implemented with the state monitoring apparatus of 2nd Embodiment.

  Next, the present invention will be described with reference to the drawings.

In the present invention, state data for each device is collected at a predetermined collection cycle (first cycle), and a predetermined statistical processing cycle (such as a time of a predetermined day of the week or a time of a predetermined day) is selected. By statistically processing the plurality of state data acquired every second period), a threshold value for each device corresponding to the time of a predetermined day of the week or the time of each day is obtained. Further, threshold values for each device are obtained for each status data collection period, and during actual operation, these threshold values are used in chronological order according to the day of the week and time to determine whether or not an abnormality has occurred. The status data to be acquired includes monitoring items of the RAS program, such as CPU temperature, system temperature, HDD temperature, LCD temperature, battery temperature, HDDSMART error information, voltage, fan speed, PCI parity, energization time, and the like. In addition, in the present invention, the problem that the threshold uncertainty increases due to the small number of samples is subjected to the filtering process according to the characteristics of the monitored device with respect to the standard deviation σ value obtained by the statistical process. It suppresses by doing.
(First embodiment)
FIG. 1 is a perspective view showing a configuration example of a computer that realizes the state monitoring apparatus of the present invention.

  As illustrated in FIG. 1, a computer 100 includes a main body 101 including a motherboard including a CPU that executes predetermined processing according to various programs, an input device for inputting commands and data by a user, and operation results. For example, a laptop computer provided with an LCD unit 102 for displaying processing results and the like. A computer 100 illustrated in FIG. 4 includes a CPU, an HDD, an LCD, a power supply device, a cooling fan, a PCI device, and the like, similarly to a known personal computer.

  FIG. 2 is a block diagram showing a configuration example of the state monitoring apparatus of the present invention.

  As shown in FIG. 2, the state monitoring apparatus of the present invention includes a data collection unit 111, a statistical data calculation unit 112, a threshold value determination unit 113, an operation monitoring unit 114, a statistical data storage unit 200, and a threshold data storage unit. 210 and a monitoring log storage unit 220.

  The data collection unit 111, the statistical data calculation unit 112, the threshold value determination unit 113, and the operation monitoring unit 114 are processed by a CPU (not shown) included in the computer 100 shown in FIG. 1 according to the RAS program of the present invention. It is realized by executing. The statistical data storage unit 200, the threshold data storage unit 210, and the monitoring log storage unit 220 are realized by, for example, a nonvolatile storage device (HDD or the like) included in the computer 100 illustrated in FIG.

  The data collection unit 111 is a monitoring item corresponding to the device, such as temperature, voltage, fan rotation speed, detection error (HDD) by a self-diagnostic function, parity error (PCI device), observation value (state data), etc. Is acquired every preset collection cycle (first cycle: for example, every minute).

The statistical data calculation unit 112 statistically processes the observation values collected by the data collection unit 111 and calculates an average value and a standard deviation σ for each monitoring item. The average value and the standard deviation σ are the time of a predetermined day of the week or the time of a predetermined day,
Calculation is performed using a plurality of observation values acquired at a predetermined statistical processing period (second period) longer than the collection period. Further, the statistical data calculation means 112 obtains the average value and standard deviation σ for each collection period, and stores the obtained average value and standard deviation σ in the statistical data storage unit 200 in time series.

  The threshold value determination unit 113 calculates threshold values (upper limit value and lower limit value) for each monitoring item based on the average value and the standard deviation σ calculated by the statistical data calculation unit 112. In this embodiment, after performing a filtering process to be described later on the standard deviation σ of observation items that satisfy a preset condition, the average value + 3σ is set as the upper threshold value, and the average value −3σ is set as the lower threshold value. Set to threshold. The threshold value determination unit 113 stores the threshold value for each device obtained for each state data collection period in the threshold data storage unit 210 in time series.

  The operation monitoring unit 114 uses the thresholds (upper and lower thresholds) calculated for each collection cycle by the threshold determining unit 113 in time series according to the day of the week and time. The state of each device is monitored, and when the observed value exceeds the threshold value, it is determined that there is an abnormality. For example, the occurrence of the abnormality is displayed on the LCD unit 102 to notify the user.

  The statistical data storage unit 200 stores the observation values (state data) collected by the data collection unit 111.

  The threshold data storage unit 210 stores threshold values (upper limit value and lower limit value) for each monitoring item obtained by the threshold value determination unit 113.

  The monitoring log storage unit 220 stores the time of occurrence of an abnormality detected by the operation monitoring unit 114, the content of the abnormality, and the like.

  Next, the operation of the state monitoring apparatus according to the first embodiment will be described with reference to FIGS.

  FIG. 3 is a flowchart illustrating an example of processing of the state monitoring apparatus according to the first embodiment.

  As shown in FIG. 3, the state monitoring apparatus (computer 100) first collects state data (observed values) for each device by the data collecting unit 111 (step S1). In the present embodiment, since the threshold value during operation is determined based on the state data collected in step S1, the state data for each device is stored in the same state as during actual operation operating according to an application program or the like. collect. An example of the state data collected by the data collection unit 111 is shown in FIG.

  [TIM_RTC] illustrated in FIG. 4 indicates the acquisition time of the state data, [TMP_CPU] indicates the temperature of the CPU, and [TMP_SYS] indicates the internal temperature of the main body 101. Also, [TMP_HDD] shown in FIG. 4 indicates the temperature of the HDD, [TMP_BAT] indicates the temperature of the battery, [TMP_LCD] indicates the internal temperature of the LCD unit 102, and [VLT_1.8] indicates the power supply voltage (DC voltage). ).

  For example, the data collection unit 111 collects state data by logging observed values for each monitoring item at a predetermined collection period (see FIG. 5). The collected state data is stored in the statistical data storage unit 200. In addition, FIG. 5 has shown a mode that the observed value of each monitoring item changes in the same time slot | zone (9: 40-10: 40) of two days of November 23 and November 24, for example.

  Next, the state monitoring apparatus statistically processes the state data for each device collected in step S1 by the statistical data calculation unit 112, and calculates an average value and a standard deviation σ for each monitoring item (step S2).

  The computer 100 used for a normal business application is a time of a predetermined day of the week (for example, processing the result of the week at 18:00 (time) of every Friday (day of the week)) or a day of the day. In many cases, the processing amount of the computer is determined at a predetermined period, such as a predetermined time (for example, batch processing of daily sales at 18:00). Therefore, when the computer processing amount (load amount) is determined depending on the time zone of each day, statistical processing is performed on a plurality of state data acquired at the same time every day, and the computer processing amount is dependent on the day of the week and the time. When (load amount) is determined, statistical processing may be performed on a plurality of state data acquired at the same time on the same day of the week. For example, status data for each monitoring item (CPU temperature, fan speed, etc.) at the same time on the same day of the week is read from the statistical data storage unit 200 (see FIG. 6), and monitoring items are obtained from a plurality of status data at the same time on the same day of the week. The average value and standard deviation σ are calculated in units for each time, and the average value and standard deviation σ are calculated for each collection period. In the present embodiment, the state data acquisition cycle used in such statistical processing is referred to as a statistical processing cycle (second cycle). FIG. 6 shows the same day of the week (every Monday: November 2, 9th, 16th, 23, as the observation values change from 9:40 to 10:40 on Monday, November 23, for example. The CPU temperature changes at 9:40 to 10:40 on Sunday, 30th).

FIG. 7 is a graph showing how the average CPU temperature calculated from the state data shown in FIG. 6 changes. FIG. 8 shows the average CPU temperature calculated from the state data shown in FIG. It is a table which shows a deviation and change amount. The meanings of the variables shown in FIGS. 7 and 8 are as follows.
t ₁ , t ₂ ,..., t _n : State data acquisition times x ₁ , x ₂ ,..., x _n : t _{n in a} preset observation period (for example, 9:40 to 10:40 on every Monday) Status data (CPU temperature)

: Average state data acquired at t _n (CPU temperature)
Δx ₁ , x ₂ ,..., Δx _n-1 : change amount of state data in t _{1 to} t _n (CPU temperature)

[Delta] x _max: maximum value sigma _max amount of change in state data in _{t 1 ~t n (Δx 1 ~Δx} n-1): maximum statistical data calculating means 112 of the standard deviation sigma of t ₁ ~t _n is 6 Based on the state data shown in the above, the average value for every t _n

The standard deviation σ _n and the change amount Δx are calculated. FIG. 8 shows an example of the calculation result. At this time, the state data at a predetermined time every day has a normal distribution as shown in FIG.

Next, the state monitoring apparatus performs a filtering process on the value of each standard deviation σ obtained in step S2 by the threshold value determining means 113 (step S3). In the present embodiment, for example, when the condition of Δx _max ≧ 2σ _max is satisfied, the filtering process is performed on each standard deviation σ value in a preset observation period (t _{1 to} t _n ). This is because when the condition of Δx _max ≧ 2σ _max is satisfied, it is considered that the state data does not fall within the range of simple variation but increases or decreases rapidly, so the value of the standard deviation σ This is because it is necessary to optimize (with a large margin). For example, as shown in the graphs of FIGS. 5 and 6, the CPU temperature rapidly increases when the process is started, and rapidly decreases when the process is completed. By performing filtering on state data such as CPU temperature where the amount of change Δx is large, the average value and the standard deviation σ due to the small number of state data samples are obtained, and these values are obtained. Increase in threshold uncertainty is suppressed.

Note that execution condition of the filtering is not limited to the above [Delta] x _max ≧ 2 [sigma] _max, for _{example, Δx max ≧ σ max, Δx} max ≧ 3σ max, may be set to [Delta] x _max ≧ 4 [sigma] _max and the like. However, if the value multiplied by the maximum value σ _max of the standard deviation is reduced, the filtering process is performed even for a device with a small amount of change in the state data, so that the processing load of the threshold value determination unit 113 increases. . On the other hand, if the value multiplied by the maximum value σ _max of the standard deviation is increased, the processing load of the threshold value determination means 113 is reduced, but the filter is only generated when the state data changes greatly, which is less likely to occur during normal operation. Since the processing is performed, it becomes impossible to suppress an increase in uncertainties such as an average value, a standard deviation σ, and a threshold value due to a small number of state data samples. Therefore, it is preferable that the filter processing condition is about Δx _max ≧ 2σ _max .

  An example of the filter process applied to the standard deviation σ of the CPU temperature is shown in FIG.

In the filter process, for example, the standard deviation σ calculated in the observation period t ₁ , t ₂ ,..., T _{n of} the same day of the week in which the same process is repeatedly executed (for example, 9: 00 to 17:00 on Monday). The values are sorted in ascending order (see FIG. 11). Here, when the value of the standard deviation σ is large, it means that the obtained state data varies greatly. In addition, when the value of the standard deviation σ is small, it means that the variation of the acquired state data is small, and it is considered that the uncertainty of the standard deviation σ due to the small number of state data samples is large. Therefore, when the standard deviation σ is large, the value is used as it is. Alternatively, when the value of the standard deviation σ is large, the value of the standard deviation σ is corrected to a slightly large value. On the other hand, when the value of the standard deviation σ is small, the value of the standard deviation σ is corrected to a large value. That is, the value of each standard deviation σ is corrected by increasing the value multiplied by the value of the standard deviation σ as the value of the standard deviation σ decreases. Such a filtering process is set individually for each monitoring item because the amount of change of the monitoring item varies depending on the device characteristics.

  For example, in the case of the filter processing for the CPU temperature, when the minimum value to the maximum value of the standard deviation σ is 100% (see FIG. 11), the standard deviation σ value of 80% or more is used as it is as shown in FIG. The value of the standard deviation σ from 60% to 80% is 1.1 times, the value of the standard deviation σ of 30% to 60% is 1.25 times, and the value of the standard deviation σ of 30% or less is 1.5 Double.

  The threshold value determination unit 113 performs the above filtering process on each standard deviation σ, and then sets the average value + 3σ as the upper limit threshold value and sets the average value −3σ as the lower limit value for each collection period. The threshold value is set (step S4).

  The reason why the average value ± 3σ is set as the upper threshold value and the lower threshold value is that, during normal operation, the state data falls within the range of these thresholds with a probability of 99.74%. This is because when the state data exceeds the threshold value, it can be regarded as abnormal. Actually, since each standard deviation σ is filtered in step S3, it is considered that the state data falls within a set threshold range with a higher probability. FIG. 12 shows how the observed value (measured value) of the CPU temperature and the obtained threshold value change.

  The threshold value determination unit 113 obtains threshold values for each device for each collection period of state data, and stores these threshold values in the threshold data storage unit 210 in time series in accordance with the day of the week and time.

  When the state monitoring apparatus obtains the threshold value for each device, the operation monitoring unit 114 determines whether the state data is within the range of the corresponding upper threshold value and lower threshold value. The presence / absence of abnormality in each device is monitored (step S5). When the status data exceeds the upper limit or lower limit threshold, it is determined as abnormal, and notification of the occurrence of an abnormality is made, and the name of the device where the abnormality occurred, the time of occurrence of the abnormality, the content of the abnormality, etc. Save to 220 (step S6).

  When device monitoring is started by the operation monitoring unit 114, it is not necessary to update the threshold value for each device unless the operation conditions of each device are changed. However, even after the start of operation, the threshold value for each device may be updated as needed by executing the processing of steps S1 to S4 in FIG.

  According to the present embodiment, since the threshold value for each device is calculated based on statistical processing, an optimum threshold value is set even if the user, maintenance personnel, or the like does not set the threshold value.

  In addition, a device corresponding to the time of a predetermined day of the week or the time of every day by statistically processing the state data in units of a predetermined statistical processing cycle, such as a time of a predetermined day of the week or a time of a predetermined day Since each threshold value is obtained and each threshold value is obtained for each state data collection period, the threshold value varies along the time axis for each collection period in accordance with the day of the week and time (see FIG. 12). . Therefore, a threshold having a useless margin for the observed value is not set, and an abnormality that cannot be detected by a background art computer having a fixed threshold can be detected.

Further, by filtering the value of the standard deviation σ, an increase in threshold uncertainty due to a small number of state data samples is suppressed. Therefore, a more appropriate threshold value can be set.
(Second Embodiment)
Next, a computer according to the second embodiment will be described with reference to the drawings.

  In the first embodiment, an example in which the filter process is performed on the standard deviation σ of the CPU temperature has been described. In the second embodiment, filter processing that can be applied to other devices is proposed. Since the configuration of the state monitoring apparatus and other processes are the same as those in the first embodiment, description thereof is omitted.

  FIG. 13 is a flowchart illustrating an example of filter processing performed by the state monitoring apparatus according to the second embodiment.

Variables a ₁ ~a n + ₁ and x ₁ ~x shown in FIG. 13 _n is set for each device according to the policies of the abnormality detection by the user or the like has determined in advance. For example, if the interval between the upper limit threshold and the lower limit threshold is to be narrowed, that is, the possibility of erroneous detection is increased, but the sensitivity of abnormality detection is to be increased, the value of the variable a is set small. Further, when it is desired to widen the interval between the upper limit threshold value and the lower limit threshold value, that is, when it is desired to reduce the sensitivity of abnormality detection and reduce the possibility of erroneous detection, the value of the variable a is set large.

  The value of the variable x may be increased if the variation of the sorted standard deviation σ is large, and may be decreased if the variation of the standard deviation σ is small. For example, if the variation of the standard deviation σ is large, the variable x is set to 90%, 80%, 70%, 60%, 50%, 40%, 30%, 20%, 10%, etc., and the standard deviation σ is corrected. If the variation of the standard deviation σ is small, the variable x may be set to 70%, 30%, etc., and the standard deviation σ may be corrected in three steps.

Variables a ₁ ~a n + ₁ and x ₁ ~x _n used in the filtering process shown in FIG. 13, the software / hardware engineers or SE (System Engineer) may be set experts like, provided in the RAS software As a part of the function, the user may be able to set by a GUI (Graphical User Interface) operation.

  According to this embodiment, the same effects as those of the first embodiment can be obtained, and filter processing that can be applied to more devices and observation items can be realized.

DESCRIPTION OF SYMBOLS 100 Computer 101 Main body part 102 LCD part 111 Data collection means 112 Statistical data calculation means 113 Threshold value determination means 114 Operation monitoring means 200 Statistical data storage part 210 Threshold data storage part 220 Monitoring log storage part

Claims (8)

A state monitoring device that determines whether or not an abnormality has occurred in a device based on whether or not state data indicating a state of a device to be monitored exceeds a predetermined threshold value,
Data collecting means for collecting the state data of the device every preset first period;
Of the state data collected by the data collection means, statistical processing is performed on a plurality of state data acquired in a predetermined second period longer than the first period, thereby obtaining an average value and a standard deviation corresponding to the device. Statistical data calculating means for calculating the average value and standard deviation for each of the first periods,
The value of the standard deviation calculated by the statistical data calculation means is corrected by filtering according to the characteristics of the device, and based on the average value and the standard deviation after the correction, the device corresponding to the device Threshold value determining means for calculating a threshold value for each first period;
Using the threshold value calculated by the threshold value determining means, operation monitoring means for determining the presence or absence of abnormality of the device;
A state monitoring device. When the maximum value of the change amount of the state data collected in a preset observation period is Δx _max and the maximum value of the standard deviation calculated in the observation period is σ _max ,
The threshold value determining means includes
The state monitoring apparatus according to claim 1, wherein when the condition of Δx _max ≧ 2σ _max is satisfied, the filtering process is performed on each standard deviation obtained in the observation period. The threshold value determining means includes
The state monitoring apparatus according to claim 1 or 2, wherein, as the filtering process, correction is performed to increase a value multiplied by the standard deviation value as the standard deviation value decreases. The threshold value determining means includes
When the standard deviation is σ,
The state monitoring apparatus according to claim 1, wherein the average value + 3σ is an upper threshold value and the average value −3σ is a lower threshold value. A status monitoring method for determining whether or not an abnormality has occurred in a device based on whether or not status data indicating a status of a device to be monitored exceeds a predetermined threshold value,
Collecting the device status data for each preset first period,
Among the collected state data, by statistically processing a plurality of state data acquired in a predetermined second period longer than the first period, an average value and a standard deviation corresponding to the device are calculated, An average value and a standard deviation are calculated for each first period,
The calculated standard deviation value is corrected by filtering according to the characteristics of the device, and the threshold value corresponding to the device is set based on the average value and the standard deviation after the correction. Calculate every cycle,
A state monitoring method for determining whether or not an abnormality has occurred in the device using the calculated threshold value. When the maximum value of the change amount of the state data collected in a preset observation period is Δx _max and the maximum value of the standard deviation calculated in the observation period is σ _max ,
The state monitoring method according to claim 5, wherein when the condition of Δx _max ≧ 2σ _max is satisfied, the filtering process is performed on each standard deviation obtained in the observation period.   The state monitoring method according to claim 5 or 6, wherein, as the filtering process, correction is performed to increase a value multiplied by the standard deviation value as the standard deviation value decreases. When the standard deviation is σ,
The state monitoring method according to claim 5, wherein the average value + 3σ is an upper threshold value and the average value −3σ is a lower threshold value.

Images