CN113574358B

CN113574358B - Abnormality detection device and abnormality detection method

Info

Publication number: CN113574358B
Application number: CN201980093996.6A
Authority: CN
Inventors: 上田宜史; 冈岛淳
Original assignee: Mitsubishi Electric Corp
Current assignee: Mitsubishi Electric Corp
Priority date: 2019-03-18
Filing date: 2019-03-18
Publication date: 2022-09-20
Anticipated expiration: 2039-03-18
Also published as: JPWO2020188696A1; KR20210114070A; WO2020188696A1; CN113574358A; JP6647473B1; KR102408756B1

Abstract

An abnormality detection device (100) according to the present invention includes: a data dividing unit (102) that divides the time-series data into a learning section and a test section; a subsequence generation unit (103) that generates a subsequence of the learning section in the time-series data as learning data; a prediction distribution calculation unit (104) that obtains a probability distribution corresponding to the data points in the test interval using the learning data; and an abnormality detection unit (107) that detects an abnormality using the probability distribution.

Description

Abnormality detection device and abnormality detection method

Technical Field

The present invention relates to an abnormality detection device and an abnormality detection method for determining an abnormality of an abnormality detection object represented by equipment such as a factory, a chemical plant, and a steel plant.

Background

In facilities such as factories and buildings, control systems for controlling devices such as air conditioners and electric lights in the facilities are introduced. In facilities such as power plants, chemical plants, and steel plants represented by thermal power, hydraulic power, and atomic energy, control systems for controlling processes have been introduced. In addition, a log recording system for recording the state of a plant facility, an automobile, a railway vehicle, or the like is often mounted on the facility. The state of the device includes a state of a machine included in the device, a state indicating an environment inside or outside the device, and the like. In the logging system and the control system, time series data indicating a state of the plant corresponding to the elapse of time measured by a sensor is usually accumulated.

Conventionally, the change in the time series data is analyzed to detect an abnormality in an abnormality detection target such as the device. For example, patent literature 1 discloses an abnormality detection method in which a feature is extracted from time-series data, and when a distance between the extracted feature and a feature extracted from training data not including an abnormality exceeds a threshold value, it is determined that the abnormality is present.

Patent document 1: japanese laid-open patent publication (JP 2015-11027)

Disclosure of Invention

On the other hand, the trend of time series data sometimes differs depending on the equipment in the apparatus or the sensor that measures the state. Therefore, when the determination is performed using the threshold value as in the method described in patent document 1, there is a problem that it is necessary to evaluate and verify the threshold value for each device and sensor. Further, since the evaluation and verification of the threshold value requires external information such as the knowledge of a skilled operator and the knowledge of a device designer, the load on the operator and the designer is high and time is required. Therefore, it is desirable to suppress the workload for setting the threshold value.

The present invention has been made in view of the above problems, and an object of the present invention is to provide an abnormality detection device capable of detecting an abnormality of an abnormality detection target object while suppressing a workload for setting a threshold value.

In order to solve the above problems and achieve the object, an abnormality detection device according to the present invention includes: a data dividing unit that divides the time-series data into a learning section and a test section; and a subsequence generation unit that generates a subsequence of the learning section in the time-series data as learning data. Further, the abnormality detection device includes: a prediction distribution calculation unit that obtains a probability distribution corresponding to a data point in the test section using the learning data; and an abnormality detection unit that detects an abnormality using the probability distribution.

ADVANTAGEOUS EFFECTS OF INVENTION

The abnormality detection device according to the present invention achieves the effect of being able to detect an abnormality of an abnormality detection target while suppressing a workload for setting a threshold value.

Drawings

Fig. 1 is a diagram showing an example of a functional configuration of an abnormality detection device according to an embodiment of the present invention.

Fig. 2 is a diagram showing a configuration example of a computer system that realizes the abnormality detection device.

Fig. 3 is a diagram showing an example of time-series data.

Fig. 4 is a diagram showing an example of time-series data.

Fig. 5 is a diagram showing an example of time-series data.

Fig. 6 is a flowchart showing an example of the flow of the abnormality detection processing of the abnormality detection device.

Fig. 7 is a diagram showing an example of a gaussian distribution.

Fig. 8 is a diagram showing an update situation of the learning section.

Fig. 9 is a diagram showing an example of the credit interval and the abnormality degree score at each time point of the test interval.

Detailed Description

Hereinafter, an abnormality detection device and an abnormality detection method according to an embodiment of the present invention will be described in detail with reference to the drawings. The present invention is not limited to this embodiment.

Provided is an implementation mode.

Fig. 1 is a diagram showing a functional configuration example of an abnormality detection device according to an embodiment of the present invention. As shown in fig. 1, the abnormality detection apparatus 100 of the present embodiment includes a data acquisition unit 101, a data dividing unit 102, a subsequence generation unit 103, a prediction distribution calculation unit 104, a credit interval calculation unit 105, an abnormality degree score calculation unit 106, and an abnormality detection unit 107.

The abnormality detection device 100 of the present embodiment acquires time series data indicating the state of an abnormality detection target object, and detects an abnormality of the abnormality detection target object based on the acquired time series data. Examples of the object to be detected for the abnormality include facilities such as factories, chemical plants, steel works, water works, automobiles, railway vehicles, and data related to economy, business, and the like. The time-series data is a data sequence including data corresponding to a plurality of different times, and is a data sequence in which the change of data with time can be grasped. The time series data may be any data, and for example, may be a data series including data observed at a plurality of different times, or may be a data series including results obtained by performing data processing on data observed at a plurality of different times. The time-series data may be feedback data for control or the like. That is, the time series data includes a plurality of data points corresponding to different times. In the following, the data point corresponds to 1 point when time information indicating time and values such as sensor values corresponding to the time are shown in a 2-dimensional coordinate system. For example, the time-series data is data in which sensor values measured by a sensor at regular time intervals are arranged together with the acquisition timings of the sensor values. The sensor is, for example, a temperature sensor for measuring the temperature of equipment, or the like, a sensor for detecting the rotational position of a motor provided in a plant mechanical device or the like, a force sensor, a current sensor, a voltage sensor, or the like for measuring the acceleration or the like of a plant mechanical device. Time series data of exchange, stock price, and future price are exemplified as time series data related to economy, business, and the like. Examples of the abnormality of these data include an abnormality such as a sudden drop in price.

The time-series data may be stored in, for example, a processing machine, a manufacturing apparatus such as a robot pump, or the like, which is a machine in a production line of a factory, a machine such as an automobile or a railway vehicle, or may be stored in a control system such as an air conditioner, an electric lamp, lighting, water supply/discharge, or the like in a factory or a building. The time-series data may be data stored in a control system for controlling processes in a power plant such as a thermal power plant, a hydraulic power plant, or a nuclear power plant, a chemical plant, an iron and steel plant, a water supply plant, or a water supply plant. The time-series data may be data accumulated in an information system related to economy, business, or the like.

The explanation returns to fig. 1. The data acquisition unit 101 of the abnormality detection apparatus 100 receives input of data such as settings for abnormality detection processing. The data acquisition unit 101 may receive time-series data input. The data dividing unit 102 divides the time series data into a learning section and a test section, which will be described later. The subsequence generation unit 103 generates learning data, which is a subsequence of the learning section in the time series data.

The predicted distribution calculation unit 104 obtains a probability distribution corresponding to the data points in the test section based on the learning data. The credit interval calculation unit 105 calculates a credit interval corresponding to the data point of the test interval based on the probability distribution. The abnormality degree score calculation unit 106 calculates an abnormality degree score indicating a degree of deviation between the time series data of the credit interval and the test interval. The abnormality detection unit 107 detects an abnormality using the probability distribution calculated by the prediction distribution calculation unit 104. The abnormality detection unit 107 detects an abnormality based on the abnormality degree score, for example. The operation of each functional unit of the abnormality detection apparatus 100 will be described in detail later.

Here, a hardware configuration of the abnormality detection apparatus 100 will be described. The abnormality detection apparatus 100 is implemented by a computer system. Fig. 2 is a diagram showing a configuration example of a computer system that realizes the abnormality detection apparatus 100. The computer system includes a computer 20, an input device 209 connected to the computer 20, and a display 210.

The computer 20 includes a processor 201, an auxiliary storage device 202, a memory 203, an input interface (hereinafter abbreviated as I/F)204, a display I/F205, an alarm output device 206, and a network I/F207. The processor 201 is connected to the auxiliary storage device 202, the memory 203, the input I/F204, the display I/F205, the alarm output device 206, and the network I/F207 via signal lines 208. The processor 201 is, for example, a CPU (Central Processing Unit), an MPU (micro Processing Unit), or the like. The auxiliary storage device 202 and the memory 203 are ram (random Access memory), rom (read Only memory), hdd (hard Disk drive), and the like.

The input I/F204 is connected to an input device 209 via a cable 211. The input I/F204 is a circuit for exchanging data with the input device 209. The input device 209 is a device that receives an input from a user, and includes a keyboard, a mouse, and the like.

The display I/F205 is connected to a display 210 via a cable 212. The display I/F205 is a circuit for exchanging data with the display 210. The input device 209 and the display 210 may be integrated with each other and may be implemented as a touch panel. The display 210 is an example of an output device, but an output device such as a printer may be connected to the display 210 via an I/F of the output device.

The alarm output device 206 is a display lamp represented by an led (light Emitting diode) indicator lamp, a speaker, or the like. Note that, although fig. 2 shows an example in which the alarm output device 206 is provided in the computer 20, the present invention is not limited to this, and the alarm output device 206 may be provided outside the computer 20 similarly to the display 210 and connected to the computer 20 via a cable.

The network I/F207 is a communication circuit for communicating with the outside, and is connected to a network, not shown, via a wired line or a wireless line. Other devices such as a computer and a database server having a database, not shown, are connected to the network. The network I/F207 transmits and receives electronic mail to and from other devices, and the network I/F207 receives data stored in the database of the other device and transmits the data to the other device for storage in the database of the other device.

The functions of the functional units of the abnormality detection apparatus 100 shown in fig. 1 are realized by software, firmware, or a combination of software and firmware. Software, firmware, or both software and firmware for realizing the functions of the functional units of the abnormality detection apparatus 100 are described as programs. The program is stored in the secondary storage device 202. The program causes the computer 20 to execute the flow or method of each functional unit. Specifically, the processor 201 executes a program to realize each functional unit of the abnormality detection apparatus 100 shown in fig. 1. The input device 209 is also used to realize the function of the data acquisition unit 101 among the functional units of the abnormality detection device 100 shown in fig. 1. In order to realize the function of the abnormality detection unit 107, at least 1 of the display 210 and the alarm output device 206 is used. The program may be provided by a recording medium or a communication medium, and may be stored in the auxiliary storage device 202.

The timing data is stored in the auxiliary storage device 202. For example, the timing data is transmitted from other devices, stored in the secondary storage device 202 via the network I/F207. Alternatively, the time series data may be recorded in a recording medium, read from the recording medium, and stored in the auxiliary storage device 202, or may be input by the user via the input device 209.

The program stored in the auxiliary storage device 202 is loaded from the auxiliary storage device 202 to the memory 203, and is read and executed by the processor 201. The functions of the functional units shown in fig. 1 are realized by executing the program. In addition, when the program is executed, data used when the program is executed, such as time series data, is also loaded from the auxiliary storage device 202 to the memory 203. The result of the execution of the program is written into the memory 203, and is stored in the auxiliary storage device 202, displayed on the display 210 via the display I/F205, or transmitted to another device on the network via the network I/F207 in accordance with the description of the program.

The input device 209 receives setting information used in the processing of the abnormality detection device 100, such as a data division ratio described later, from a user. The input device 209 receives an instruction related to a process, such as a start request and an end request of a time series data process, from a user. The setting information received by the input device 209 is stored in the auxiliary storage device 202 via the input I/F204. The instruction received by the input device 209 is input to the processor 201 via the input I/F204.

Next, the abnormality detection method of the present embodiment will be described. Next, as time series data, data measured by a plurality of types of sensors included in a manufacturing apparatus that continuously operates in a production line of a factory will be described as an example. That is, an example in which the abnormality detection object is a manufacturing apparatus will be described. Further, as described above, the time series data is not limited to the data measured by the sensor.

Fig. 3 to 5 are diagrams showing an example of time-series data. The sensor value 303 shown in fig. 3 to 5 is a sensor value that is data measured at a fixed cycle by a plurality of types of sensors included in a manufacturing apparatus continuously operating in a production line of a factory. The sensor value 303 is associated with time information 301 indicating the acquisition time of each data. In the examples shown in fig. 3 to 5, the set of time information 301 and sensor value 303 is time series data. In the example shown in fig. 3 to 5, the various sensors include an acceleration sensor a. The sensor value is not limited to the measurement value obtained by the acceleration sensor a, and may be, for example, a measurement value of a current, a voltage, vibration, acceleration, pressure, or the like of the manufacturing apparatus.

In fig. 3 to 5, time information 301 indicating the acquisition time of each data of the sensor value 303 and control information 302 indicating the control condition of the manufacturing apparatus are shown together with the sensor value 303. The control information 302 is, for example, recipe information that is an instruction value relating to the number of manufactured products, that is, the number of manufactured products, and manufacturing conditions. The command value is, for example, a command value of a speed of the motor in the case where the abnormality detection object is a mechanism for rotating, a command value of a temperature at the time of welding in the case where the abnormality detection object is a device for welding, and a command value of a laser output voltage in the case where the abnormality detection object is a laser processing machine. The scenario information is explained. Depending on the product, the instruction value may be changed in several stages. Here, a set of several instruction value change patterns, processing conditions, and the like are referred to as a recipe. An example of a mechanism for rotating is a vacuum pump in semiconductor manufacturing. In the vacuum pump, a vacuum state is formed by rotating a motor to discharge air. In the manufacture of semiconductors, chemicals, gases, and the like are applied to wafers. The types of drugs, gases, and the like are different depending on the types of products. The timing of application of a medicine, gas, or the like differs depending on the product, and the rotational speed of the motor differs depending on the product. For example, the rotational speed of the motor before gas introduction is set to a, the rotational speed of the motor when gas is introduced is set to B, and the rotational speed of the motor after gas introduction is set to C. The above flow is referred to as a scheme. The recipe information is information indicating the above-described flow. In the examples shown in fig. 3 to 5, the control information 302 contains an instruction value of 1. Here, the control information 302 is recorded as state information together with time information 301 and sensor values 303, which are time series data. The status information is recorded by, for example, a control device that controls the manufacturing apparatus, and the abnormality detection device 100 acquires the status information from the control device via a network.

In the examples shown in fig. 3 to 5, the time information 301 is represented by time, but the time information is not limited to the time itself, and may be a mechanically assigned continuous number or a numerical value such as a matrix row number. In the case where time-series data is periodically acquired and is apparently data having no defect, if data is arranged in the order of acquisition time, time information may not be added to each sensor. In this case, if the start time of the time-series data is separately stored by, for example, a file name or the like of a data file including the time-series data, and information indicating the acquisition interval of each sensor value is stored, the acquisition time of each data can be known from the start time and the number of data in which the data is the time-series data. The time information may be added to each data point indirectly, instead of being added to each data point.

In fig. 3, the status information is described as 1 table, but the form of the status information is not limited to the example shown in fig. 3. For example, the time information and the control information may be created as 1 table, and the time series data, that is, the set of the time information 301 and the sensor value 303 may be created as another table. In addition, the time series data may be similarly created as a different table for each category of sensor. As described above, the state information may be divided into a plurality of pieces as long as the correspondence between the pieces of information can be realized.

In addition, the time-series data may be a summarized value, not the measured value itself measured by the sensor. Depending on a factory, a production line, a manufacturing apparatus, and the like, values obtained by summarizing data measured by a sensor according to a certain rule may be recorded. The generalization described here means that data having a smaller data amount than the original data is generated by performing processing using the original data. The specific processing contents to be summarized are not particularly limited, and may be, for example, statistical processing, fourier transform processing, or the like. For example, the sensor obtains a measurement value in units of every second, and the control device of the manufacturing apparatus generates a representative value of one hour based on the measurement value. The representative value may be an average value of the measurement values for 1 hour, a median value of the measurement values for 1 hour, or a mode of the measurement values for 1 hour. The abnormality detection device 100 may acquire measurement values measured by sensors, and summarize the acquired measurement values to generate time series data.

In the example shown in fig. 3, the time-series data is data in units of 1 second. In the example shown in fig. 3, the value of the command value 1 is not changed. In the examples shown in fig. 4 and 5, the time-series data is data in units of 1 hour. In the example shown in FIG. 4, the instruction value 1 is at 2018/12/0114: 00: 00 changes from 20 to 40, at 2018/12/0116: 00: 00 changes from 40 to 80, at 2018/12/0117: 00: 00 was changed from 80 to 20. In this way, the command value may be changed according to the production status or the like. In the abnormality detection processing described later, data can be extracted in accordance with the command values, and the abnormality detection processing can be performed using time-series data of the respective command values so that the tendency of the time-series data can be easily predicted. In such a case, if the same operation condition, that is, data having the same value of the command value 1 is extracted, a defect occurs in the extracted data. For example, in the example shown in fig. 4, if data having a value of 20 for instruction value 1 is fetched, the defect is compared with the data from 2018/12/0114: 00: 00 to 2018/12/0116: 00: data corresponding to 3 time points up to 00.

Further, depending on the operating state and the power-on state of the equipment, there are cases where measurement values that should be obtained at a fixed period cannot be obtained, or where the measurement itself is not performed due to maintenance of the equipment, etc., and thus data is missing. Fig. 5 shows an example in which a miss is generated in time series data. In the example shown in fig. 5, the sum of 2018/12/0114: 00: 00 and 2018/12/0115: 00: 00 data corresponding to the 2 time points are missing.

In the case where a missing occurs in the time-series data, such as the case where data is extracted for each command value in the example shown in fig. 4 or the case where a missing occurs in the original data as shown in fig. 5, the abnormality detection apparatus 100 may interpolate the missing data by interpolation processing as will be described later.

Fig. 6 is a flowchart showing an example of the flow of the abnormality detection processing of the abnormality detection apparatus 100. First, the data acquisition unit 101 receives selection of time-series data to be processed (step S1). As described above, when the measurement values of a plurality of types of sensors are used as time series data, the time series data is generated for each sensor. In step S1, a selection of which of the time-series data is to be processed is received from the user. In this case, the data acquisition unit 101 may display information identifying the selectable time-series data, for example, a name indicating a sensor corresponding to the time-series data, on the display 210, and receive a selection by the user from the displayed name. Further, as the time series data to be processed, not only the type of the sensor but also the selection of the period to be processed may be received. The user selects a name corresponding to the time-series data to be processed from the displayed names by operating the input device 209. In addition, the data acquisition unit 101 may also receive an input of the processing condition in step S1. As the processing condition, for example, a process of specifying whether or not to extract data for each instruction value is performed as described above. When the processing for extracting data for each instruction value is designated, the processing condition is also set to which instruction value the data corresponding to is to be processed.

After step S1, the data acquisition unit 101 performs the preceding processing according to the processing conditions (step S2). When the processing conditions are not specified, the data acquisition unit 101 performs, as a preceding process, a process of extracting the time-series data specified as the processing target in step S1 from the state information. When the processing for extracting data for each command value is designated in step S1 as the processing condition, the data acquisition unit 101 extracts data corresponding to the command value designated in step S2 from the time-series data to be processed as the preceding processing. In addition, when there is a missing in the time-series data, the data acquisition unit 101 may compensate for the missing data by interpolation processing as a previous process.

The data acquisition unit 101 receives the ratio of the learning interval to the test interval (step S3). In the present embodiment, time series data is divided into a learning section and a test section as described later, and data of the test section is predicted using the time series data of the learning section. In step S3, the data acquisition unit 101 receives an input from the user of the ratio of the learning interval and the test interval used in the division. The learning interval and the test interval may be a ratio of a time length corresponding to data or a ratio of the number of data, but here, the ratio of the number of data is used in consideration of the case where there is a lack in time series data as described above.

Next, the data dividing unit 102 divides the time series data into the learning section and the test section based on the ratio of the learning section to the test section (step S4). Specifically, the data dividing unit 102 calculates the division position at which the time series data is divided into the learning section and the test section based on the ratio of the learning section to the test section. For example, the number of pieces of time-series data to be processed is N _all The ratio of the learning interval to the testing interval is the learning interval: test interval R _t ：R _d . At this time, the data dividing unit 102 divides N _all The first N in the data _all ×(R _t /(R _t +R _d ) Data of the time series after the learning interval is used as a test interval. In N _all ×(R _t /(R _t +R _d ) By pairing N in the case where N is not an integer _all ×(R _t /(R _t +R _d ) Rounding, carry, and the like are performed to determine the number of data in the learning section. The data length of the learning section thus obtained, i.e., the number of data is n, and the data length of the test section is m. N + m ═ N _all . Between the nth and n +1 th of the time series data, the division position of the learning section and the test section is set. In this way, the learning section is a section in which the time corresponding to the time series data is earlier than the test section. Hereinafter, the number of data in the learning section and the number of data in the test section are referred to as a learning data length and a test data length, respectively. The data dividing unit 102 notifies the subsequence generating unit 103 of the learning data length and the test data length.

Next, the subsequence generation unit 103 generates learning data, which is a subsequence of the learning section, based on the division result of step S4, i.e., the division position calculated in step S4 (step S5). That is, the subsequence generation unit 103 generates a subsequence of the learning section by extracting the first n pieces from the time series data, and generates a subsequence of the test section by extracting the remaining m pieces of the time series data. The subsequence generation unit 103 outputs the generated subsequence of the learning section to the predicted distribution calculation unit 104. The learning section is updated by the subsequent processing of step S9 as described later. Hereinafter, the learning section divided at step S5 is also referred to as an initial learning section.

Next, the prediction distribution calculation unit 104 obtains a probability distribution and a prediction value at j time point of the test segment based on the learning data that is the subsequence of the learning segment (step S6). j is a natural number indicating the number of data in the subsequence in the initial test interval, and the initial value is 1. The j time point indicates a time point corresponding to the j data point in the subsequence in the test interval, i.e., the j time point. Specifically, in first step S6, the prediction distribution calculation unit 104 calculates the probability distribution of the data at the jth time point of the test section corresponding to the (n +1) th point from the beginning, which is the next data point after the learning data, based on the learning data that is the subsequence of the initial learning section. Therefore, in step S6 at the 1 st time, j is 1. The predicted distribution calculation unit 104 calculates the strip piece distribution of the next point after the learning data based on the learning data using, for example, a model based on Gaussian Process Regression (GPR).

In the case of the Gaussian process, for a set of n data (x) ₁ ，x ₂ ，…，x _n ) Y ═ Y (Y) corresponding to these data ₁ ，y ₂ ，…，y _n ) The joint distribution p (y) in (a) follows a gaussian distribution. Applying a gaussian process to the regression problem, i.e. applying a gaussian process to the data set above, is a gaussian process regression. Thus, in the gaussian process regression, as described above, when n data points (X, Y) are provided, (X) is ₁ ，y ₁ )，(x ₂ ，y ₂ )，…，(x _n ，y _n ) When is taken as x _n+1 The predicted distribution of Y at the point(s) of (A) to obtain a tape distribution p (x) _n+1 | Y). When i is 1, 2, …, n, (x) _i ，y _i ) Ith data point, x, representing a learning interval _i Represents time information, y _i Is represented by the formula _i Corresponding sensor value or the like。

In the above conditional distribution p (x) _n+1 | Y), a joint distribution p (Y) shown in the following formula (1) is required for the calculation of | Y) _n+1 ). C in formula (1) _n+1 Is a covariance matrix of (n +1) × (n +1), and is expressed by the formula (2).

[ mathematical formula 1]

p(Y _n+1 )＝N(Y _n+1 |0，C _n+1 )…(1)

[ mathematical formula 2]

Here, C _n Is an n × n covariance matrix, a kernel function k (x) can be used _i ，x _j ) To be represented. In addition, j is n + 1. The kernel function being to represent x _i And x _j The degree of similarity of these two variables is a function of the correlation. In addition, K is a group having K (x) _n ，x _n+1 ) A vector of such elements. In addition, c is a scalar as shown in equation (3). Beta is a constant. Delta _ij Is a variable that is 0 when i ═ j. Further, it is assumed that Y has an error such as a measurement error, and the error follows a gaussian distribution. The error is related to the constant beta in equation (3) ^-1 And the variable delta _ij The multiplication result of (c) corresponds to (d).

[ mathematical formula 3]

c＝k(x _i ，x _j )+β ^-1 δ _ij …(3)

Here, as the kernel function, a gaussian kernel shown in equation (4) is used. Further, an exponential kernel or a linear kernel may also be used, and the kernel function is not limited to a gaussian kernel.

[ mathematical formula 4]

k(x _i ，x _j )＝exp(-||x _i -x _j || ² )…(4)

The prediction distribution calculation unit 104 uses the above expressions (1) to (4) and uses the time series data of the learning section as (x) ₁ ，y ₁ )，(x ₂ ，y ₂ )，…，(x _n ，y _n ) Thus, y can be obtained from the equations (5) and (6) _n+1 Is a conditional distribution p (x) of the Gaussian distribution _n+1 Y) mean value μ and variance σ ² . Conditional distribution p (x) _n+1 Y) can be represented by formula (7).

[ math figure 5]

[ mathematical formula 6]

[ math figure 7]

And x _n+1 The probability distribution at the corresponding time point, i.e., the j time point, is the mean value μ and the variance σ ² A gaussian distribution of (a). Fig. 7 is a diagram showing an example of a gaussian distribution. Here, the predicted value of the time series data at the j time point can be an average value of the gaussian distribution. When the credit interval is, for example, a 95% credit interval, the range excluding 2.5% on the left and right sides in the gaussian distribution is the credit interval at the time j. The 95% credit interval is an interval in which the probability that a true value exists in the credit interval is 95%.

Returning to the description of fig. 6, the prediction distribution calculation unit 104 calculates the probability distribution, and then calculates the average value of the gaussian distribution, which is the prediction value, based on the probability distribution. The prediction distribution calculation unit 104 also transmits the calculated probability distribution to the credit interval calculation unit 105. The credit interval calculation unit 105 calculates the credit interval at the j time point based on the probability distribution (step S7). The credit interval calculation unit 105 stores the calculated credit interval in the secondary storage device 202.

The credit interval calculation unit 105 determines whether or not the credit intervals of all the points of the test interval have been calculated (step S8). When there is a time point at which the credit interval has not been calculated in the test interval (step S8 No), the credit interval calculator 105 instructs the subsequence generator 103 to perform the learning interval, and the subsequence generator 103 updates the learning interval (step S9). Specifically, in step S9, the subsequence generation unit 103 updates the learning interval by moving the learning interval backward, that is, by 1 data point to the test interval side, generates a subsequence of the updated learning interval, and outputs the subsequence to the predicted distribution calculation unit 104. After step S9, the processing from step S6 is repeated using the subsequence corresponding to the updated learning section as learning data. Since the learning section is updated in step S9, in step S6 at the 2 nd time and thereafter, processing corresponding to the next data point after the updated learning section is performed. Therefore, the value of j at the j time point of step S6 is incremented by 1 each time the learning interval is updated.

Fig. 8 is a diagram showing an update situation of the learning section. FIG. 8 shows the number N of data to be time-series data _all Set to 20, the ratio of the learning interval to the test interval is set to R _t ：R _d 7: example 3. That is, fig. 8 shows an example in which the time-series data is divided at a rate of 70% learning intervals and 30% testing intervals. In this example, the number of data in the learning section is 14, and the number of data in the test section is 6. In step S5, as shown in the uppermost part of the figure, 14 time-series data from the left among the input time-series data are subsequences of the learning section, and 6 time-series data from the right are subsequences of the test section. In fig. 8, the rightmost point indicates the most recent data. In fig. 8, a sensor value is described as time series data.

In prediction 1 of layer 2 in fig. 8, a case where a predicted value is calculated in step S6 of the first, i.e., 1 st loop is shown. In fig. 8, the circles shaded with dark color represent measured values in the learning section, and the circles shaded with light color represent measured values in the test section. The actual measurement value is data input as time-series data. In addition, although the time-series data may be a summarized value or the like instead of the actually measured value as described above, the time-series data is described as an actually measured value because a sensor value is exemplified here. When the time-series data is a summary value, the actual measurement value in fig. 8 is a summary value. In prediction 1, based on an initial learning section that is a learning section at 14 points from the left in the time series data, a predicted value corresponding to an initial time point of a test section that is the next point after the initial learning section indicated by a quadrangle symbol is calculated.

The prediction 2 at the layer 3 in fig. 8 shows a case where the predicted value is calculated in step S6 of the 2 nd round after the learning interval is updated in step S9 of the 1 st round. In step S9 of the 1 st loop, the learning section is updated so as to be shifted 1 point to the left. That is, the subsequence generation unit 103 updates the learning section so that the corresponding time shifts to a later time, and generates a subsequence corresponding to the updated learning section as updated learning data. In the updated learning interval, the predicted value is used instead of the actual measurement value for the time point shifted 1 point to the left side and entering the test interval. That is, in the layer 3 of fig. 8, the updated learning interval includes 13 measured values from the 2 nd to the 14 th from the left in the time series data and 1 predicted value of the test interval. The learning interval thus updated includes the predicted value of the test interval calculated in accordance with the probability distribution. In prediction 2, using the subsequence of the updated learning section, a probability distribution of an update point that is a data point next to the updated learning section, which is a time point next to the updated learning section, is calculated, and a prediction value based on the probability distribution is calculated. Based on 13 actual measurement values from the 2 nd to the 14 th from the left in the time series data, and an initial learning section which is a learning section, a predicted value corresponding to an initial data point of a test section which is a next data point after the initial learning section indicated by a quadrangle symbol is calculated.

After prediction 2, the updating of the learning section in step S9 and steps S6 to S8 are performed in the same manner in the processing from prediction 3 to prediction m until the credit sections for all the points in the test section are calculated, that is, until the mth prediction m, which is the number of data in the test section, is performed. In the updating of the learning section in step S9, the learning section is sequentially shifted to the left, and 1 predicted value is added to the learning section at a time.

Returning to the description of fig. 6. If it is determined at step S8 that Yes is present, the credit interval calculation unit 105 transmits the data of the credit interval at each point of the test interval to the abnormality degree score calculation unit 106. Thus, the abnormality degree score calculation unit 106 calculates the abnormality degree score of the test section (step S10). The abnormality degree score is a value representing the degree of deviation between the learning data and the time series data of the test section. That is, the abnormality degree score is a value representing the degree of relative deviation between the behavior of the time-series data in the learning section and the behavior of the time-series data in the test section. The abnormality degree score is expressed by a numerical value from 0.0 to 1.0, for example, and approaches 1.0 as the degree of deviation increases. Therefore, if the behavior of the time-series data in the learning section and the behavior of the time-series data in the test section are similar, the abnormality degree score is low. In addition, the definition of the abnormality degree score is not limited thereto as long as the degree of deviation between the behavior of the time-series data in the learning section and the behavior of the time-series data in the test section is expressed.

Here, as a specific calculation method of the abnormality degree score, a method is used in which the abnormality degree score calculation unit 106 determines at each point whether or not the measured value of the test section falls within the credit section, and calculates a value obtained by dividing the number of data in which the measured value falls within the credit section by the total number of data in the test section as the abnormality degree score. That is, the abnormality degree score calculation unit 106 calculates the abnormality degree score based on the credit interval corresponding to the plurality of data points in the test interval and the time series data of the test interval.

Fig. 9 is a diagram showing an example of the credit interval and the abnormality degree score at each time point of the test interval. In fig. 9, in the test interval, the number of actually measured values that do not exist in the credit interval indicated by the broken line is 5, and the number of data in the test interval is 6. Therefore, the abnormality degree score was 5/6 ═ 0.833 … …. The 3 rd position of the point of the anomaly score is rounded in FIG. 9 and the anomaly score is reported as 0.83. Further, in the case where there is a deletion in a subsequence serving as learning data, the variance σ ² The larger the value of (a), the wider the skirt of the probability distribution, the wider the confidence interval, and the lower the prediction accuracy. In order to solve such a problem of low accuracy of prediction, weighting is applied when calculating the abnormality degree score, whereby the influence of data with low accuracy of prediction on abnormality determination can be suppressed. For example, in the variance σ ² When the value of (b) is a predetermined value abnormal, a weighting method may be conceived in which the corresponding point is set to 0.5 point instead of 1 point in the calculation of the abnormality degree score. As described above, the abnormality degree score calculation unit 106 may calculate the abnormality degree score based on the variance of the probability distribution calculated by the prediction distribution calculation unit 104.

Returning to the explanation of fig. 6, after step S10, the abnormality detection unit 107 outputs the result of abnormality determination in accordance with the abnormality degree score (step S11). For example, the abnormality detection unit 107 determines that the abnormality is normal when the abnormality degree score is 0.0 or more and less than 0.5, determines that the abnormality requires attention when the abnormality degree score is 0.5 or more and less than 0.7, and determines that the abnormality requires warning when the abnormality degree score is 0.7 or more. Note that, although a part of the abnormality is also set to be paid attention to the necessity, only the abnormality requiring warning may be defined as the abnormality. The abnormality detection unit 107 transmits the result of the determination of the abnormality to another device via the network I/F207 by e-mail, or displays the result on the display 210 via the display I/F205. In addition, the abnormality detection unit 107 may issue an alarm through the alarm output device 206 when the determination result is an abnormality requiring a warning. The abnormality detection unit 107 may treat the transition of the abnormality degree score as time series data, and display the time series data on the display 210 via the display I/F205.

In the above example, the abnormality detection unit 107 determines an abnormality using the abnormality degree score, but the method of determining an abnormality is not limited to the above example as long as it is a method of determining an abnormality using a calculated credit interval or predicted value, in other words, a method of determining an abnormality using a probability distribution. For example, the abnormality detection unit 107 may determine that there is an abnormality if there are 1 measured values that deviate from the confidence interval in the test interval. That is, the abnormality detection unit 107 may determine an abnormality based on the probability distribution calculated by the prediction distribution calculation unit 104.

In the above example, the predicted value of the number of test segments is obtained because the number of test segments is plural, but if the number of test segments is 1, the learning segment is not updated because Yes is obtained in the first step S8. That is, updating of the learning section is not essential, and the subsequence generation unit 103 may generate a subsequence of the learning section in the time-series data as the learning data. When there are a plurality of test intervals, the subsequence generation unit 103 updates the learning interval as described above.

The abnormality detection unit 107 may display information including the credit segment and the abnormality degree score shown in fig. 9 on the display 210 via the display I/F205. Further, data such as the credit period and the abnormality degree score may be transmitted to an external display via the network I/F207 and displayed on the external display. By always displaying these pieces of information on the display 210 or an external display, an operator can check whether or not an abnormality or an abnormality sign is present in real time in a production line of a factory or the like.

As described above, when a plurality of time-series data exist, the processing shown in fig. 6 may be performed for each time-series data, or the processing shown in fig. 6 may be performed for specific time-series data. In the case where the processing shown in fig. 6 is performed by extracting time series data for a control condition such as a value of each command value, the processing shown in fig. 6 may be performed for a value of each command value, or the processing shown in fig. 6 may be performed for a specific command value.

In addition, when real-time performance is not required, the information may be recorded and displayed as a graphic periodically. In the present embodiment, when there is a defect in the time series data, since the calculation of the abnormality degree score can be dealt with by weighting or the like, even when a plurality of kinds of instruction values are switched in accordance with the production plan in the same equipment, the processing shown in fig. 6 can be performed for each value of the instruction values.

The abnormality detection method of the present embodiment does not pay attention to the types of devices, sensors, and the tendency of time series data of a plant or the like as an abnormality detection target. Therefore, it is not necessary to perform evaluation for setting the threshold value for determining abnormality for each abnormality detection object, and the like, and thus the workload for setting the threshold value can be suppressed. In addition, in the present embodiment, since it is possible to detect an abnormality based on the tendency of a change such as an abnormality in which the tendency changes gradually or abruptly, it is possible to cope with the detection of a plurality of kinds of abnormalities as compared with a method of detecting an abnormality by simple comparison between time-series data and a threshold value. Further, for example, by associating detailed information such as the type and cause of an abnormality with the abnormality degree score before and after the occurrence of the abnormality, it is possible to diagnose the cause of the abnormality. This can improve the accuracy of abnormality detection and reduce the load of investigation of the cause of an abnormality.

The configuration shown in the above embodiment is an example of the contents of the present invention, and may be combined with other known techniques, and a part of the configuration may be omitted or modified within a range not departing from the gist of the present invention.

Description of the reference numerals

100 abnormality detection means, 101 data acquisition means, 102 data division means, 103 subsequence generation means, 104 prediction distribution calculation means, 105 credit interval calculation means, 106 abnormality degree score calculation means, 107 abnormality detection means, 201 processor, 202 auxiliary storage means, 203 memory, 204 input I/F, 205 display I/F, 206 alarm output means, 207 network I/F, 209 input means, 210 display.

Claims

1. An abnormality detection device is characterized by comprising:

a data dividing unit that divides the time-series data into a learning section and a test section;

a subsequence generation unit that generates a subsequence of the learning section in the time series data as learning data;

a prediction distribution calculation unit that obtains a probability distribution corresponding to the data point of the test section using the learning data; and

an abnormality detection unit that detects an abnormality using the probability distribution,

the learning interval is an interval before the test interval,

the prediction distribution calculation unit obtains a probability distribution corresponding to a data point next after the learning section as the probability distribution,

the subsequence generation unit updates the learning section so that the corresponding time shifts to a later time, generates a subsequence corresponding to the updated learning section as updated learning data,

the prediction distribution calculating unit calculates a probability distribution of an update point that is a next data point after the updated learning section using the updated learning data,

the updated learning interval includes a predicted value of the test interval calculated based on the probability distribution.

2. The abnormality detection device according to claim 1, characterized by comprising:

a credit interval calculation unit that calculates a credit interval corresponding to the data point of the test interval based on the probability distribution; and

an abnormality degree score calculation unit that calculates an abnormality degree score indicating a degree of deviation between the learning data and the time series data of the test section using the credit section,

the abnormality detection unit detects an abnormality based on the abnormality degree score.

3. The abnormality detection device according to claim 2,

the credit interval calculation unit calculates a credit interval of the update point based on the probability distribution of the update point,

the abnormality degree score calculation unit calculates the abnormality degree score based on the credit segment corresponding to a plurality of data points of the test segment and the time series data of the test segment.

4. The abnormality detection device according to claim 3,

the abnormality degree score calculation unit calculates the abnormality degree score based on the number of data that does not exist in the corresponding credit interval in the time series data of the test interval.

5. The abnormality detection device according to any one of claims 2 to 4,

the abnormality degree score calculation section calculates the abnormality degree score based on the variance of the probability distribution calculated by the prediction distribution calculation section.

6. An abnormality detection method in an abnormality detection device,

the abnormality detection method is characterized by comprising:

1, dividing time series data into a learning interval and a testing interval;

a step 2 of generating a subsequence of the learning section in the time series data as learning data;

step 3, calculating probability distribution corresponding to the data points of the test interval by using the learning data; and

a 4 th step of detecting an abnormality using the probability distribution,

the learning interval is an interval before the test interval,

in the 3 rd step, a probability distribution corresponding to a next data point after the learning section is found as the probability distribution,

the abnormality detection method includes:

a 5 th step of updating the learning section so that the corresponding time shifts to a later time, and generating a subsequence corresponding to the updated learning section as updated learning data; and

a 6 th step of obtaining a probability distribution of an update point which is a next data point after the updated learning section using the updated learning data,