A process control apparatus comprising: a hypervisor configured to operate on a hardware in place of hardware; a means for executing a controller including an operating system (23a, 23b) configured to run on the hypervisor, and an application (24a, 24b) configured to communicate with a field apparatus, which is configured to perform at least one of measurements and operations required for controlling an industrial process implemented in a plant, so as to control the industrial process; a storage storing first operation information indicating operations in a first state, defined as a normal operation; a first collector (52, C11, C12) configured to collect traces of interactive motions between the hardware and the operating system (23a, 23b); and a determiner configured to compare the first operation information stored in the storage with traces of interactive motions collected by the first collector (52, C11, C12) to determine the normality of the operation; wherein at least the first collector (52, C11, C12) and the determiner are provided in the virtual device; the storage stores an operation model, which is information establishing operation specifications derived from specifications of the controller, or first data, which are traces of interactive motions between the controller and hardware in a normal state, as the normal operation information, and the operation model and the first data includes at least one of input/output direction, which is information indicating input/output direction of data, target for system call, which is information indicating a target that is transmitting or receiving data, and devices used in apparatus, which is information indicating the device used during data input or output. a hypervisor configured to operate on a hardware in place of hardware; a means for executing a controller including an operating system (23a, 23b) configured to run on the hypervisor, and an application (24a, 24b) configured to communicate with a field apparatus, which is configured to perform at least one of measurements and operations required for controlling an industrial process implemented in a plant, so as to control the industrial process; a storage storing first operation information indicating operations in a first state, defined as a normal operation; a first collector (52, C11, C12) configured to collect traces of interactive motions between the hardware and the operating system (23a, 23b); and a determiner configured to compare the first operation information stored in the storage with traces of interactive motions collected by the first collector (52, C11, C12) to determine the normality of the operation; wherein at least the first collector (52, C11, C12) and the determiner are provided in the virtual device; the storage stores an operation model, which is information establishing operation specifications derived from specifications of the controller, or first data, which are traces of interactive motions between the controller and hardware in a normal state, as the normal operation information, and the operation model and the first data includes at least one of input/output direction, which is information indicating input/output direction of data, target for system call, which is information indicating a target that is transmitting or receiving data, and devices used in apparatus, which is information indicating the device used during data input or output.