JPH11338848A - Data abnormality detector - Google Patents

Abstract

PROBLEM TO BE SOLVED: To easily and surely detect abnormality in unknown data. SOLUTION: As data for monitor in a normal state of an object plant P, normal data are previously collected and based on these normal data, the feature of the normal data is extracted while using a self-organized map. Based on this feature, a feature map expressing the relation of a distance between respective output units is formed and stored as a normal. state model. When unknown input data are inputted, based on these input data and the normal state model, an external distance dext expressing a distance between the input data and the weight vector of each output unit is found, and an internal distance dint is found as the minimum value of a distance between the output unit in this minimum external distance dext and the nearby output unit, and on the condition of internal distance dint < external distance dext , the possibility of abnormality in the input data is judged.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data abnormality detecting apparatus for detecting an abnormality in a target plant in a batch plant, a continuous plant or the like based on predetermined monitoring data in these plants.

[0002]

2. Description of the Related Art Conventionally, in the case of performing abnormality detection such as abnormality prediction and diagnosis in a batch plant, a continuous system plant, or the like, for example, monitoring data is collected from a sensor or the like provided in a plant to be monitored. Is analyzed and, for example, is compared with a preset threshold value for abnormality determination to determine whether an abnormality has occurred or whether it is a sign of the occurrence of an abnormality. .

[0003]

However, in the above-mentioned conventional method, it is often difficult to directly measure monitoring data to be detected. Therefore, in the method of performing abnormality detection based on the normal fixed threshold,
In order to reliably detect the abnormality, the threshold value is set strictly for each sensor. Therefore, even if the sensor is not actually abnormal, it may be detected as an abnormality, and the number of times the abnormality is detected increases. For this reason, it is difficult for the operator to make an appropriate determination, and there is a problem that an error check operation increases, and an error due to an erroneous check easily occurs.

In order to avoid this, it is necessary to develop a comprehensive judgment method including monitoring data related to each other, but even if the related monitoring data is grasped, judgment of each value itself is performed. It is difficult to define a clear criterion for comprehensively judging the target plant from these monitoring data.

Further, when setting the above-mentioned threshold value for abnormality detection, learning data for various abnormal states is collected and stored in advance, and a database created by analyzing the data is created. Therefore, for example, for a target plant for which it is difficult to prepare data of an abnormal state in advance, there is a problem that a method of performing abnormality detection based on a threshold cannot be used.

The present invention has been made in view of the above-mentioned conventional problems, and has as its object to provide a data abnormality detecting device capable of easily and surely detecting unknown data abnormalities. I have.

[0007]

In order to achieve the above object, a data abnormality detection device according to the present invention uses a neural network for performing unsupervised learning based on previously collected normal data. A feature extracting unit that extracts a feature and stores the feature in a model storage unit as a normal state model; and a normality determination reference value that can be regarded as normal based on the unknown input data and the normal state model. Based on the input data and the normal state model,
A judgment value calculating means for calculating a judgment value for judging an abnormality of the input data; and detecting an abnormal state deviating from a normal state based on the normal judgment reference value and the judgment value to thereby detect an abnormality of the input data. Abnormality detecting means for performing detection.

In the present invention, features of normal data are extracted by using a neural network that performs unsupervised learning, for example, by using a self-organizing map, based on normal data collected in advance, and based on the extracted normal data, A state model is formed and stored. Then, based on the unknown input data and the normal state model, which is unknown whether the data is normal data or abnormal data, a normality determination reference value that can be regarded as normal for the input data is detected, and A determination value for determining data abnormality is calculated. Then, an abnormality in the input data is detected by detecting an abnormal state deviating from the normal state based on the normality determination reference value and the determination value. Therefore, the normality criterion value corresponding to the input data is dynamically set based on the normal state model, and the abnormality is detected based on the reference value. Therefore, it is possible to dynamically determine the abnormality of the input data.

[0009]

Embodiments of the present invention will be described below. FIG. 1 shows an example of a data abnormality detection device according to the present invention.
Is a preset observation data such as a detection signal from a sensor provided in the target plant P, which is collected when the target plant P of the data abnormality detection target such as a batch plant or a continuous plant is in a normal state. A feature of normal data is extracted by using a self-organizing map based on an observation value storage device 1 such as a database for storing the normal data and a normal data stored in the observation value storage device 1, and a normal state model is And a feature extraction device 2 for storing the same in the normal state model storage device 3, and an abnormality detection of predetermined monitoring data of the target plant P based on the normal state model stored in the normal state model storage device 3. The apparatus comprises an abnormality detection device 4 for performing the operation and a display device 5 such as a CRT display for displaying an abnormality when the abnormality detection device 4 detects an abnormality.

The feature extraction device 2 is composed of a microcomputer or the like, and uses, for example, a neural network for performing unsupervised learning using a Kohonen self-organizing map or the like, and adapts the internal structure to the outside world based on only observation data. Perform a self-organization process that causes Then, in the output layer formed by this processing, it is examined which output unit causes the maximum response of the multidimensional monitoring data to characterize each output unit.

The self-organizing map is basically a two-layer network composed of an input layer and an output layer, as shown in FIG. 2, so that the input layer and the output layer are connected by a weight vector w. Has become. The feature extraction device 2 performs processing according to the known Kohonen network algorithm shown in FIG.

That is, first, in step S1, the initial value of the weight vector w between the input layer and the output layer is set to a small value using random numbers. Next, in step S2, the normal data that is the normal monitoring data stored in the observation value storage device 1 is converted into the input vector x (x = (x ₁ , x ₂ ,
x ₃ ,... x _n )) are input to the input layer.

[0013] Next, in step S3, calculates the distance between the weight vector w _j and the input vector x of the output units n _j in the output layer. The distance d _j between the weight vector w _j and the input vector x of the j-th output unit n _j of the output layer is given by the following equation (1). Note that w _ij in the expression represents the weight between the i-th input unit in the input layer and the j-th output unit in the output layer. Further, t is a discrete time coordinate.

[0014] ^{i = 1} Then, in step S4, selects the output unit distance d _j between the weight vector w _j and the input vector x is minimized, this is the winner unit n _{j *.}

Next, in step S5, according to the following equation (2), an output unit and an input unit near the winner unit n _{j *} defined by the winner unit n _{j *} and the neighborhood function N _{j *} (t). _Is updated.

[0016] _{w ij (t + 1) =} w ij (t) + η (t) _{[x i (t) -w ij (} t) ] .... (2) In addition, the vicinity region defined by the neighborhood function N _{j *} is As shown in FIG. 4, the initial stage of the learning is wide and narrows as the learning progresses. Also, η in equation (2)
(T) is η when detecting the distance with respect to the output unit in the neighborhood area specified by the neighborhood function N _{j *} (t).
(T) = α (t), when detecting the distance with respect to the output unit outside the neighborhood area specified by the neighborhood function N _{j *} (t), the value becomes η (t) = 0, that is, Function N _{j *}
The weight vector is not updated for an output unit outside the neighborhood specified by (t). Further, α (t) (0 <α (t) <1) is a learning coefficient, which is monotonously reduced as learning progresses.

Then, when predetermined processing is completed for the normal data stored in the observation value storage device 1 (step S6), the processing is terminated. As a result, a self-organizing map representing the characteristics of normal data is formed by unsupervised learning. In this self-organizing map, the neighboring units specified by the winner unit n _{j *} and the neighboring function N _{j *} all approach the input vector at that time.
At the beginning of learning, many output units are regarded as neighboring units by the neighborhood function N _{j *} , and a rough map is formed. However, as the learning progresses, the neighborhood unit N _{j *} determines the winner unit n _{j *} . The number of output units regarded as neighboring units is reduced, and local fine adjustment is advanced to improve spatial resolution.

Further, in the feature extracting device 2, based on the self-organizing map corresponding to the normal data obtained as a result of learning according to the algorithm shown in FIG. 3, based on the weight vector w _j of each output unit, calculates the distance relationship between the output units, forming a characteristic map representing the distribution form of the normal data indicating the distance relationship between the output units, the normal state feature map as a normal state model with weight vector w _j of each output unit It is stored in the model storage device 3.
FIG. 5 is a diagram illustrating learning based on 33 pieces of normal data according to the algorithm of unsupervised learning shown in FIG. 3, calculating a distance between output units of a self-organizing map as a normal state model, and determining the distance relationship. Is represented by the gradation of the gradation. When the average distance between adjacent weight vectors is small, a light color is used, and when the average distance is large, a dark color is used, so that the gorge between clusters is clearly shown.

On the other hand, the abnormality detection device 4 receives multidimensional monitoring data from various sensors provided in the operating target plant P, and stores the monitoring data and the normal state model storage device 3. Based on the normal state model, the abnormality of the monitoring data is detected according to the flowchart shown in FIG.

That is, first, in step S11, multidimensional monitoring data from various sensors provided in the target plant P is converted into input data (input vector) x for abnormality detection.
(X = (x ₁ , x ₂ , x ₃ ,..., X _n )).

Next, in step S12, an external distance d _ext which is a distance between the input vector x and the weight vector w _jM of each output unit n _j of the normal state model is calculated according to the following equation (3). Note that w _ij-M in the equation is a weight between the input unit and the output unit in the normal state model.

[0022] Then, in step S13, searches the output unit n _j to the external distance d _ext of each output unit n _j calculated in step S12 is minimum is assumed this as a winner unit n _{j *} '.

Next, in step S14, in the normal state model, for example, for all output units in the first neighboring area of the winner unit n _{j *} 'shown in FIG. Calculate _int . That is, in the normal state model, the average distance between the weight vector w _{j * -M} of the winner unit n _{j *} ′ and the weight vector w _jM of the adjacent output unit is calculated. _Is set as the internal distance d _int .

[0024] Next, in step S15, it is determined whether or not the external distance d _ext is greater than the internal distance d _int . If d _ext <d _int , the process proceeds to step S16, and a message indicating that an abnormality has occurred is displayed on the display device 5 or the like. After performing the processing at the time of the predetermined abnormality detection, the process proceeds to step S17. On the other hand, if d _ext <d _int in step S15, the process directly proceeds to step S17. For example, it is determined whether or not an operator or the like has issued an instruction to end the abnormality detection processing. Returning to S11, processing is performed on the next monitoring data in the same manner as described above. Then, when an instruction to end the abnormality detection processing is issued in step S17, the processing ends.

Here, the normal state model storage device 3 corresponds to the model storage device, the feature extraction device corresponds to the feature extraction device 2, the internal distance d _int corresponds to the normality determination reference value, and step S14 in FIG. Corresponds to the normal determination reference value detection means, the external distance d _ext corresponds to the determination value, the processing in step S12 in FIG. 6 corresponds to the determination value calculation means, and the processing in step S15 in FIG. It corresponds to the means.

Next, the operation of the above embodiment will be described.
Now, assuming that the abnormality detection is to be performed on the target plant P, monitoring data from various sensors and the like installed in the target plant P is collected in advance while the target plant P is operating normally. Then, based on the collected normal data, the feature extraction device 2 performs feature extraction using the self-organizing map according to the flowchart of FIG. 3, and based on the feature extraction distance between weight vectors as shown in FIG. A feature map representing the relationship is formed and stored in the normal state model storage device 3 as a normal state model.

When detecting an abnormality in the target plant P, first, unknown monitoring data that is unknown as to whether it is normal or abnormal is input as an input vector x from various sensors provided in the target plant P. (Step S11),
The external distance d _ext is calculated based on the equation (3) based on the normal state model stored in the normal state model storage device 3 and the input vector x. And this external distance d
_The output unit n that minimizes _ext is the winner unit n _{j *} ′
Then, the internal distance d _int is calculated based on the equation (4). Then, as shown in FIG. 7, for example, when a first neighborhood area including eight output units surrounding the winner unit n _{j *} ′ is set as the neighborhood area, the weight vector w _{j of} these eight output units and the winner unit n The average distance between _{j *} 'and the weight vector _{wj *} is calculated, and the maximum value of the average distance is set as the internal distance _dint .

Here, if the input vector x is normal data, the input vector x has the same characteristics as the normal state model. Therefore, the weight vector of each output unit of the normal state model and the input vector x The distance relationship between the winner unit n _{j *} ′ in which the external distance d _ext is the minimum and the output unit in the vicinity thereof satisfies the distance relationship in the feature map indicating the distance relationship between the output units in FIG. Will be.

Therefore, the external distance d, which is the minimum value of the deviation between the input vector x and the weight vector of the normal state model,
_{If ext} is equal to or less than the internal distance d _int which is the maximum value of the average distance between the winner unit n _{j *} 'and the output unit in the vicinity (internal distance d _int ≧ external distance d _ext ), the input vector x is normal It can be considered that the input vector x has the same characteristics as the state model, and the input vector x is determined to be normal (step S15).

Conversely, when the internal distance d _int <the external distance d _ext , the external distance d _ext is calculated based on the normal state model and is the upper limit value at which the input vector x can be regarded as normal. since will exceed the internal distance d _int is, i.e., are deemed likely to not have a normal state model equivalent features, it is determined that the input vector x is the possibility of abnormality (Step S1
5). Then, the display device 5 is notified that an abnormality has occurred in the data.

Therefore, as described above, a normal state model representing the characteristics of normal data is formed by unsupervised learning based on various normal data collected in advance, and abnormality detection is performed based on the normal state model. Therefore, it is not necessary to set a threshold value of an abnormality judgment criterion for each of a plurality of types of monitoring data, and even when a plurality of types of monitoring data, that is, multi-dimensional monitoring data, these can be comprehensively evaluated. it can. In addition, since the criterion value can be dynamically changed according to the monitoring data input by using the normal state model, an accurate criterion can be set according to the operation state of the target plant. In addition, comprehensive abnormality detection relating to multidimensional input can be realized in real time.

In order to form a normal state model, only normal data is required. For example, it is necessary to reliably detect an abnormality even in a plant where monitoring data in an abnormal state cannot be collected. it can.

In the above embodiment, the case has been described in which the external distance d _ext is calculated with respect to the output unit in the first neighboring area which is the output unit adjacent to the winner unit n _{j *} '. However, the present invention is not limited to this, and the calculation may be performed for an output unit in an area wider than the first neighborhood area. Will increase, for example,
It is effective to set the range of the neighborhood area according to the target plant P.

Further, in the above-described embodiment, the case where the abnormality of the plant is detected has been described. However, the present invention is not limited to this, and is applied to, for example, the case of detecting the abnormality of the exchanged data between the computers. You can also.

Here, the processing at the time of unsupervised learning in the feature extracting device 2 and the abnormality detecting device 4 in the above embodiment.
The processing at the time of abnormality detection is electronically stored in a storage medium such as a ROM, a flexible disk, a compact disk, or a hard disk, and the feature extraction device 2 and the abnormality detection device 4 execute these processing programs from this storage medium. This is read out and executed.

[0036]

As described above, according to the data abnormality detecting device of the present invention, the normality judgment reference value corresponding to the input data is dynamically determined based on the normal state model formed by the unsupervised learning based on the normal data. And abnormality detection is performed based on this, so that abnormality determination of input data can be performed dynamically.

[Brief description of the drawings]

FIG. 1 is a configuration diagram illustrating an example of a data abnormality detection device to which the present invention has been applied.

FIG. 2 is an example of a self-organizing feature map.

FIG. 3 is a flowchart showing Kohonen's network algorithm.

FIG. 4 is an explanatory diagram illustrating an example of a neighborhood function.

FIG. 5 is an example of a feature map representing a distance relationship between output units.

FIG. 6 is a flowchart illustrating an example of a processing procedure of the abnormality detection device.

FIG. 7 is an explanatory diagram illustrating a first neighborhood area.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Observation value storage device 2 Feature extraction device 3 Normal state model storage device 4 Abnormality detection device 5 Display device

Claims (1)

[Claims] 1. A feature extracting unit that extracts features of normal data using a neural network that performs unsupervised learning based on previously collected normal data, and stores the features in a model storage unit as a normal state model. Based on unknown input data and the normal state model, a normality criterion value detecting means for dynamically detecting a normality criterion value capable of regarding the input data as normal, the input data and the normal state model A determination value calculating means for calculating a determination value for determining an abnormality in the input data, and detecting an abnormal state deviating from a normal state based on the normal determination reference value and the determination value. A data abnormality detection device comprising: abnormality detection means for detecting abnormality of input data.