JP2020201890A - Abnormality detection device and abnormality detection method - Google Patents

Abstract

To improve abnormality detection sensitivity in an abnormality detection device, even for abnormality detection target equipment having many sensors.SOLUTION: An abnormality detection apparatus comprises: a first sensor signal input unit 104 to which a plurality of time-series sensor signals output from a plurality of sensors are input; a sensor group setting unit 105 which obtains a degree of similarity among the plurality of sensor signals input to the first sensor signal input unit and sets a sensor group on the basis of the degree of similarity; a second sensor signal input unit 107 to which a plurality of sensor signals output from the plurality of sensors are input; a characteristic vector extraction unit 108 which, for each sensor group, extracts a characteristic vector at each clock time from the plurality of sensor signals input to the second sensor signal input unit; an abnormality measure calculation unit 109 which, for each sensor group, calculates an abnormality measure at each clock time using, as learning data, a characteristic vector between specified leaning periods; and an abnormality detection unit 112 which, for each sensor group, determines whether a sensor signal at each clock time is normal or abnormal by comparing the abnormality measure with a predetermine threshold.SELECTED DRAWING: Figure 1

Description

The present invention relates to an abnormality detection device and an abnormality detection method.

Electric power companies use waste heat from gas turbines to supply hot water for district heating, and supply high-pressure steam and low-pressure steam to factories. Petrochemical companies operate gas turbines and other equipment as power supply equipment. In various plants and equipment using gas turbines and the like, abnormality detection for detecting equipment malfunctions or signs thereof is extremely important for minimizing damage to society.

Not only gas turbines and steam turbines, but also water turbines at hydropower plants, nuclear reactors at nuclear power plants, wind turbines at wind power plants, engines for aircraft and heavy machinery, railroad vehicles and tracks, escalator, elevators, equipment and parts level There is no time to list the equipment that requires the above preventive maintenance such as deterioration and life of the battery.

Therefore, a plurality of sensors for acquiring various physical information are attached to the target equipment or plant, and it is determined whether the target equipment or plant is normal or abnormal according to the monitoring standard for each sensor.

Patent Document 1 discloses an abnormality detection method for detecting the presence or absence of an abnormality by comparing an abnormality measure calculated based on learning of past normal data with a threshold value. Further, for the purpose of excluding the sensor that hinders the abnormality detection sensitivity, a method of excluding the sensor based on the evaluation value calculated based on the two-dimensional distribution of the sensor signal is disclosed. Here, the abnormality measure is an amount of deviation from the vector value in the normal state by expressing the value measured by a plurality of sensors as one vector value.

Japanese Unexamined Patent Publication No. 2016-240919

In Patent Document 1, it is possible to appropriately exclude the sensor that hinders the sensitivity, and it is possible to improve the abnormality detection sensitivity. However, if the number of sensors in the equipment is large, the influence of each sensor becomes small and the abnormality detection sensitivity decreases. If the number of sensors targeted for abnormality detection is reduced to about 30, the abnormality detection sensitivity of the target sensors will be improved. However, for example, if the original number of sensors is 100, about 70 are not targeted for abnormality detection, and the abnormality generated in those sensors cannot be detected, and the abnormality detection sensitivity is lowered.

An object of the present invention is to improve the abnormality detection sensitivity in an abnormality detection device even when the number of sensors in the equipment is large.

The abnormality detection device of one aspect of the present invention includes a first sensor signal input unit for inputting a plurality of time-series sensor signals output from a plurality of sensors mounted on the equipment, and the first sensor signal input. A sensor group setting unit that obtains the similarity between a plurality of the sensor signals input to the unit and sets a sensor group based on the similarity, and a plurality of the sensor signals output from the plurality of sensors are input. A second sensor signal input unit to be generated, a feature vector extraction unit that extracts a feature vector at each time from a plurality of the sensor signals input to the second sensor signal input unit for each sensor group, and the above. For each sensor group, the feature vector of the specified learning period is used as training data, and the abnormality measurement unit that calculates the abnormality measurement at each time is used, and the abnormality measurement is compared with a predetermined threshold value for each sensor group. It is characterized by having an abnormality detecting unit for determining whether the sensor signal at each time is normal or abnormal.

In the abnormality detection method of one aspect of the present invention, a plurality of time-series sensor signals output from a plurality of sensors mounted on the equipment are input, the similarity between the plurality of sensor signals is obtained, and the similarity is obtained. A sensor group is set based on the above, a feature vector is extracted from a plurality of the sensor signals for each time for each sensor group, and the feature vector for a specified learning period is used as training data for each sensor group. It is characterized in that an abnormality measurement at each time is calculated, and for each of the sensor groups, it is determined whether the sensor signal at each time is normal or abnormal by comparing the abnormality measurement with a predetermined threshold value.

According to one aspect of the present invention, even when the number of sensors in the equipment is large, it is possible to improve the sensitivity of abnormality detection for all the sensors and detect the abnormality generated in the sensors.

It is a figure which shows one configuration example of the abnormality detection apparatus of embodiment. It is a figure which shows the example which listed a plurality of sensor signals and represented them in a table format. It is a figure which shows the whole processing flow performed by the abnormality detection apparatus of embodiment. It is a figure which shows the flow of the sensor group setting process of Example 1. FIG. It is a figure which shows the flow of the two-dimensional frequency distribution calculation processing. It is a figure explaining the method of creating a two-dimensional frequency distribution image. It is a figure explaining the method of calculating the similarity between sensors. It is a figure which shows the example of the two-dimensional frequency distribution image. It is a figure which shows the example of the two-dimensional frequency distribution image. It is a figure which shows the example of the two-dimensional frequency distribution image. It is a figure which shows the flow of the sensor group setting process of Example 2. It is a figure which shows the flow of the sensor group setting process of Example 3. FIG. It is a figure which shows the flow of the abnormality measure calculation processing at the time of learning. It is a figure explaining the anomaly measure calculation process by a local subspace method. It is a figure which shows the flow of abnormality detection processing. It is a figure which shows the example of GUI which sets a sensor group setting condition. It is a figure which shows the example of the distribution image display screen. It is a figure which shows the example of the sensor signal display screen. It is a figure which shows the example of the GUI which sets the offline analysis condition. It is a figure which shows the example of the GUI which specifies the display target of the online analysis result. It is a figure which shows the example of the analysis result whole display screen. It is a figure which shows the example of the analysis result enlarged display screen.

Hereinafter, embodiments will be described with reference to the drawings.

An example of a configuration of the abnormality detection device of the embodiment will be described with reference to FIG.
The abnormality detection device 100 acquires sensor signals 102 output from a plurality of sensors mounted on the equipment 101 to be detected (periodically) at predetermined time intervals. The acquired sensor signal 102 is temporarily stored in the sensor signal storage unit 103. The signal input unit (first sensor signal input unit) 104 inputs the sensor signal 102 from the sensor signal storage unit 103 and sends it to the sensor group setting unit 105. The sensor group setting unit 105 sets the sensor group based on the similarity (similarity) between the sensor signals, and stores the result in the group information storage unit 106.

The signal input unit (second sensor signal input unit) 107 directly inputs the sensor signal 102 from the sensor signal storage unit 103 or from the sensor mounted on the equipment 101, and sends the sensor signal 102 to the feature vector extraction unit 108. The feature vector extraction unit 108 inputs sensor group information from the group information storage unit 106, extracts a feature vector based on the sensor signal 102 for each set group, and sends the feature vector to the abnormality measure calculation unit 109. The anomaly measure calculation unit 109 calculates an anomaly measure for each feature vector at predetermined time intervals (hereinafter, may be expressed as each time) by using the feature vector of the learning period designated in advance.

The threshold value calculation unit 110 calculates the threshold value based on the abnormality measure of the learning data by the abnormality measure calculation unit 109. The feature vector of the learning period extracted by the feature vector extraction unit 108, the threshold value calculated by the threshold value calculation unit 110, and other data required for abnormality detection are stored in the learning result storage unit 111 as learning results. .. The abnormality detection unit 112 detects an abnormality in the equipment 101 by comparing the abnormality measure of each feature vector sent from the abnormality measure calculation unit 109 with the threshold value calculated by the threshold value calculation unit 110. The detection result detected by the abnormality detection unit 112 is output to the output unit 113.

Here, a brief description of the terms used below will be given. The feature vector is a representation of the values measured by a plurality of sensors as one vector value. The anomalous measure is the amount of offset of the feature vector of interest from the feature vector over a specified time period. That is, the anomaly measure is an amount of deviation from the vector value in the normal state by expressing the value measured by a plurality of sensors as one vector value.

The equipment 101 to be detected for abnormality is, for example, equipment or a plant such as a gas turbine or a steam turbine. The equipment 101 outputs a sensor signal 102 indicating the state. The sensor signal 102 is stored in the sensor signal storage unit 103.

FIG. 2 is an example in which a plurality of sensor signals 102 are listed and represented in a table format.
The sensor signal 102 is a multidimensional time-series signal in which a plurality of physical information having different physical characteristics is acquired at predetermined intervals. The structure of the table shown in FIG. 2 shows the information of the date and time 201 and the sensor values 202 of the plurality of sensors in correspondence with each other. Sensors can range from hundreds to thousands, depending on their type, for example, temperature of cylinders, oil, cooling water, pressure of oil or cooling water, shaft speed, room temperature, operating time, etc. Is output as a sensor value. The sensor value not only represents the output or state of equipment or plant, but may also be a control signal for controlling the state of something to a certain value (for example, a target value).

For the operation of the abnormality detection device 100, a "sensor group setting" process for setting a sensor group using the data stored in the sensor signal storage unit 103 and learning data using the data stored in the sensor signal storage unit 103 are used. There is a phase of "learning" processing that generates and saves data, and "abnormality detection" processing that detects an abnormality based on an input signal. Basically, "sensor group setting" and "learning" are offline processing, and "anomaly detection" is online processing. However, it is also possible to make "abnormality detection" an offline process. In the following explanation, they are distinguished by the terms "at the time of sensor group setting", "at the time of learning", and "at the time of abnormality detection".

The operation of the abnormality detection device 100 of the embodiment will be described with reference to the processing flow of FIG.
Note that FIG. 3 shows an outline of the process.

(A) is a sensor group setting process, in which a sensor signal for a specified period is input (S301), the similarity between the sensor signals is calculated (S302), and the sensor group is set based on the similarity (S303).

(B) is the abnormality measure calculation process at the time of learning, in which the sensor signal of the learning period is input (S311), the feature vector is extracted (S312), the abnormality measure is calculated (S313), and the threshold value is calculated (S314). ..

(C) is an abnormality determination process at the time of abnormality detection, in which a sensor signal to be detected is input (S321), a feature vector is extracted (S322), and an abnormality measure is calculated (S323). Then, the normality / abnormality of the equipment is determined by comparing the calculated abnormality measure with the threshold value obtained in S314 (S324). Note that (b) and (c) are processes for each group set by the sensor group setting unit 105.

Hereinafter, the following will be described in the order of (a), (b), and (c), and the detailed flow of each will be described with reference to FIGS. 4, 5, 9A, 9B, 10A, and 11.

The sensor group setting process of the first embodiment will be described with reference to the flow of FIG.
First, the signal input unit (first sensor signal input unit) 104 inputs a sensor signal for a specified period among the sensor values stored in the sensor signal storage unit 103 (S401). Next, the sensor group setting unit 105 creates a two-dimensional frequency distribution image by brute force of the two sensors (S402). Next, the similarity between the sensor signals is calculated based on the two-dimensional frequency distribution image (S403).

Next, hierarchical clustering based on similarity is performed (S404). All input sensor signals are assigned to each cluster without duplication, which is a sensor group. Finally, the group information is stored in the group information storage unit 106 (S405). The output format output to the output unit 113 is a list of sensor names or numbers of used sensors or sensor names or numbers of unused sensors for each sensor group.

Here, the two-dimensional frequency distribution calculation process (S402) will be described with reference to FIG. FIG. 5 is a diagram showing a flow of a two-dimensional frequency distribution calculation process.
First, the sensor signal for the specified period is input (S501). The processing from steps S503 to S506 is repeated for each sensor signal (S502, loop 1). First, the maximum value (MAX) and the minimum value (MIN) of the data of the learning period are obtained (S503). Next, the step size S when dividing the range from the minimum value to the maximum value by a designated number N is calculated (S504). It can be calculated by S = (MAX-MIN) / N. Next, the processing range for calculating the two-dimensional frequency distribution is calculated (S505), but here, MAX is used as it is from the MIN calculated in step S503.

Next, for all the data in the learning period, the bin number (BNO) is calculated from the sensor signal value (F) by the following equation (S506).
BNO = INT (N * (F-MIN) / (MAX-MIN))
However, the function INT (X) represents the integer part of X. By using the bin number (BNO), each signal value is converted into an integer value in (N + 1) steps from the minimum value to the maximum value N.

Next, two sensors are taken out from the plurality of sensors, and the two-dimensional frequency distribution is calculated based on the combination of the respective sensor signals. This repeats the processes from steps S508 to S510 for all sensor combinations (S507, loop 2). Here, the combination of the same sensor is included in the combination of the two sensors. Therefore, the number of sensor combinations (repetition number) is (number of sensors) × (number of sensors + 1) / 2.

First, a two-dimensional array for calculating the two-dimensional distribution is secured, and 0 is set for all the elements (S508). The size of the array is N. For all the data in the learning period, 1 is added to the elements of the array corresponding to the bin numbers BNO of the two sensor signals (S509). That is, the bin number of one sensor signal corresponds to a column element, and the bin number of the other sensor signal corresponds to a row element. By this process, a two-dimensional frequency distribution (histogram) of the signal by the two sensors is calculated. This frequency distribution is converted into an image and saved (S510). The conversion method will be described later. FIG. 6 is a diagram showing the relationship between the time series sensor signal and the two-dimensional frequency distribution image.

An example of the image conversion method in step S510 will be described.
First, find the maximum value of the array elements, that is, the maximum frequency. The image size is the same as the array size, and the pixel value of the corresponding coordinates from the value of each element is, for example, 255 × the element value of the array / the maximum frequency. The numerical value 255 is the maximum value when the pixel value is represented by 8 bits, and if this value is used, it can be saved as it is in the bitmap format. Alternatively, the pixel value is 255 × LOG (array element value + 1) / LOG (maximum frequency +1). However, the function LOG (X) represents the logarithm of X. By using such a conversion formula, it is possible to associate a non-zero pixel value with a non-zero frequency even when the maximum frequency is high.

The method of creating the frequency distribution image is not limited to the above method. For example, instead of a simple frequency distribution, a Gaussian distribution or another weighted filter may be assigned to one data and superposed on the data. Alternatively, the image obtained by the above method may be filtered with a maximum value of a predetermined size, an average filter, or another weighted filter. Further, it may be converted to 16 bits instead of 8 bits. Further, it is not always necessary to save in the image format, and the two-dimensional array may be saved in the binary or text format without conversion.

Next, the similarity calculation process (S403) between the sensor signals will be described.
Here, the similarity between the sensor signals represents a quantification of whether or not the signal values influence each other. Therefore, the similarity is calculated using the two-dimensional frequency distribution image calculated in step S402.

FIG. 7 is a diagram illustrating the calculation of the similarity between the sensor a and the sensor b. From the left, it is a two-dimensional frequency distribution image of sensors a to each other, sensors b to each other, and sensors a and b.

These images obtained by the processing of FIG. 5 are represented by high pixel values where the density is high in the two-dimensional feature space. Here, unlike a normal shading image, the pixel value 0 is white and 255 is black, which is a grayscale image. From these images, first, non-zero pixels are counted and used as Count (a, a), Count (b, b), and Count (a, b), respectively. The similarity (a, b) is calculated by (Equation 1). However, if Count (b, b)> Count (a, a), the calculation is performed by exchanging a and b in the following equation.

This formula was designed based on the idea that the smaller the range of values of the other sensor, the higher the similarity when determining the value of the sensor with the larger number of states. When only the diagonal line is used, the similarity is 1. When the entire surface is filled, the similarity becomes 0.

8A-8C are diagrams showing some examples of two-dimensional frequency distribution images. The horizontal axis shows the signal value (bin number) of the sensor a, and the vertical axis shows the signal value (bin number) of the sensor b.

In the two-dimensional frequency distribution image, the pattern of the image changes according to the strength of the correlation between the two sensors. 8A and 8B show a case where the correlation is strong, and FIG. 8A shows a case where there is a time lag in the state transition. FIG. 8C shows a case where the correlation is weak. Here, the similarity in the two-dimensional frequency distribution image of FIG. 8A is 0.893, the similarity in the two-dimensional frequency distribution image of FIG. 8B is 0.838, and the similarity in the two-dimensional frequency distribution image of FIG. 8C. Is 0.084.

The correlation coefficient is known as a numerical value representing the relationship between data, but this is a measure of linearity and cannot cover all cases where they affect each other. FIG. 8A shows an example in which the mutual influence between the sensors is strong but the correlation coefficient is low.

Next, the hierarchical clustering process (S404) will be described.
Hierarchical clustering starts with assigning individual data to each cluster and recursively joins similar clusters. Depending on the criteria for selecting the clusters to be joined, there are methods such as the shortest distance method, the longest distance method, and the group averaging method. In each method, the similarity between clusters is defined by the maximum, minimum, and average values of similarity between data across clusters. The groups with the highest similarity between clusters are sequentially combined into one cluster, and when the similarity between all clusters falls below a predetermined similarity reference value, the combination is stopped. However, if the total number of data contained in the two clusters of interest is greater than the predetermined maximum number of sensors, the similarity is regarded as 0 so that the number of data contained in one cluster does not exceed the maximum number. To do so. The similarity reference value is a parameter and specifies a real number between 0 and 1. The maximum number of sensors is also a parameter.

The second embodiment sensor group setting process will be described with reference to the flow of FIG. 9A. The second embodiment is a process of designating sensors to be in the same group in advance.

First, the signal input unit (first sensor signal input unit) 104 inputs a sensor signal for a specified period among the sensor values stored in the sensor signal storage unit 103 (S901). Next, the sensor group setting unit 105 creates a two-dimensional frequency distribution image by brute force of the two sensors (S902). Next, the similarity between the sensor signals is calculated based on the two-dimensional frequency distribution image (S903). Next, an instruction regarding the sensor group setting is input (S904). It doesn't matter how you input from the GUI or read the file, but it is assumed that the sensors you want to have in the same sensor group are specified. There may be a plurality of specified combinations.

Next, the similarity between the same sensor group and the designated sensor is set to 1 regardless of the value calculated in step S903 (S905). Next, hierarchical clustering based on similarity is performed (S906). The same sensor group and designated sensors have a similarity of 1, so they are combined at the beginning of hierarchical clustering, and unspecified sensors are combined according to their similarity. Similar to step S404, the maximum number of sensors and the similarity reference value are specified in advance, and if the maximum number of sensors is exceeded, the coupling is not performed, and if the distance between all clusters is less than the similarity reference value, the coupling is stopped. To do. Finally, the group information is stored in the group information storage unit 106 (S907).

The sensor group setting process of the third embodiment will be described with reference to the flow of FIG. 9B. The third embodiment is a process in which sensors similar to the sensors designated in advance as the core of the group are grouped in the same group.

First, the sensor signal input (S911), the two-dimensional frequency distribution image creation (S912), and the sensor signal similarity calculation (S913) are the same as in the second embodiment.

Next, an instruction regarding the sensor group setting is input (S914). Here, it is assumed that a sensor group consisting of one or a plurality of sensors to be the core of the sensor group is specified. The number of instructions may be plural, and the following processing is performed independently for each instruction (S915).

First, a new cluster is created and the designated sensor group is put into the cluster (S916). Next, the degree of similarity between the undesignated sensor and the sensor group is calculated (S917). The similarity between the sensor and the cluster is, for example, the average of the similarity between the sensor of interest and the sensor in the sensor group. Alternatively, it is set to the minimum value or the maximum value.

Next, the sensors are put into the same cluster in descending order of the calculated similarity (S918). However, it shall be the case within the maximum number of sensors specified in advance and the similarity reference value or more specified in advance. When the processing of steps S916 to S918 for the number of instructions is completed, next, one new cluster is created and sensors that are not included in any cluster are inserted (S919). Finally, the group information is stored in the group information storage unit 106 (S920).

Further modifications of the sensor group setting process described with reference to FIGS. 4 and 9A and 9B will be described.

In the first example, the sensors to be included in all the groups are specified in advance, and after the group is set by any of the above methods, the process of putting the specified sensors into the previous group is added. In the second example, after the sensor signal is input (S401), the data cleansing process based on the sensor signal is performed. This is a process for removing noise data such as missing values and error values that adversely affect the analysis. Specifically, based on the histogram for each sensor, data that deviates from the main distribution and has a low occurrence ratio is deleted. The data cleansing process can improve the accuracy of calculating the similarity between sensors.

Next, the abnormality measure calculation process during learning of FIG. 3B will be described with reference to the flow of FIG. 10A. This is the processing for each sensor group set in S303.

First, the signal input unit (second sensor signal input unit) 107 inputs the sensor signal for a specified period (learning period) among the sensor values stored in the sensor signal storage unit 103 (S1001). As the learning period, the period during which the equipment was in a normal state shall be specified. Next, the feature vector extraction unit 108 normalizes the input sensor signal (S1002). The feature vector extraction unit 108 acquires the information of the sensors included in the group of interest from the group information storage unit 106, and the normalization and the feature vector extraction described later target the sensors included in the group.

Normalization of sensor signals is performed in order to handle a plurality of sensor signals having different units and scales in the same manner. Specifically, each sensor signal is converted so that the average is 0 and the variance is 1 by using the average and standard deviation of the learning period of each sensor signal. The average and standard deviation of each sensor signal are stored so that the same conversion can be performed when an abnormality is detected. Alternatively, each sensor signal is converted so that the maximum is 1 and the minimum is 0 by using the maximum and minimum values of the learning period of each sensor signal. Alternatively, preset upper and lower limit values may be used instead of the maximum and minimum values. In this case, the maximum value and the minimum value or the upper limit value and the lower limit value of each sensor signal are stored in the learning result storage unit 109 so that the same conversion can be performed when an abnormality is detected.

Next, the feature vector extraction unit 108 extracts the feature vector at each time (S1003). The feature vector is a canonicalized sensor signal arranged as an element as it is. Alternatively, a window of ± 1, ± 2, ... For a certain time is provided, and the time change of the sensor signal is represented by setting the window width (3, 5, ...) × the feature vector of the number of sensors. Features can also be extracted. Further, the discrete wavelet transform (DWT: Discrete Wavelet Transform) may be performed to decompose into frequency components.

Next, the abnormality measure calculation unit 109 calculates the abnormality measure during the learning period. First, the learning period is divided into a plurality of sections (S1004), and the following processing is repeated for all the extracted feature vectors (S1005). The attention vector, which is a feature vector sequentially selected corresponding to a plurality of sections, and the data of the learning period excluding the same section as the attention vector are used as training data (S1006). The anomaly measure is calculated using the attention vector and the training data (S1007). The division of the section in step S1004 is, for example, every day. Alternatively, in the case of batch processing such as a chemical plant, it may be for each batch, in the case of a processing device, it may be for each individual to be processed, and in the case of a medical device such as MRI, it may be for each inspection target. A local sub-space method (LSC: Local Sub-space Classifier) or a projection distance method (PDM) can be used for the anomaly measure calculation process in step S1007.

FIG. 10B is a diagram illustrating an abnormality measure calculation process by the local subspace method.
The local subspace method is a method of selecting k neighborhood vectors with respect to the attention vector q and measuring the projection distance when the attention vector q is projected onto the k-1 dimensional affine subspace stretched by the selected k neighborhood vectors. Is. In FIG. 10B, the affine subspace is formed by k = 3 neighborhood vectors x1 to x3. Then, the point Xb on the affine subspace closest to the attention vector q becomes the projection point (reference vector), and the distance from the attention vector q to the reference vector Xb is an anomalous measure.

A specific calculation method will be described. From the evaluation data q and its k neighborhood vectors xi (i = 1, ..., K), a matrix Q in which k qs are arranged and a matrix X in which xis are arranged are created, and both of them are obtained from (Equation 2). Find the correlation matrix C. Next, the coefficient vector b representing the weighting of the neighborhood vector xi is calculated from (Equation 3). The anomaly measure d is calculated by the norm of the vector (q-Xb) or its square.

Although the case of k = 3 has been described in FIG. 10B, any number may be used as long as it is sufficiently smaller than the number of dimensions of the feature vector. When k = 1, the process is equivalent to the nearest neighbor method.

The projection distance method is a method of creating a subspace having a unique origin for the selected feature vector, that is, an affine subspace (space with the maximum variance). A plurality of feature vectors corresponding to the attention vector are selected by some method, and the affine subspace is calculated by the following method.

First, the mean μ of the selected feature vectors and the covariance matrix Σ are obtained, then the eigenvalue problem of Σ is solved, and the matrix U in which the eigenvectors corresponding to the r eigenvalues specified in advance are arranged from the largest value is obtained. Let it be an orthonormal basis of the affine subspace. r is a number smaller than the dimension of the feature vector and smaller than the number of selected data. Alternatively, r may not be a fixed number, but may be a value when the cumulative contribution rate from the larger eigenvalue exceeds a predetermined ratio. The point on the affine subspace closest to the attention vector is the reference vector. Further, the vector obtained by subtracting the reference vector from the vector of interest is the residual vector, and the norm of the residual vector or the square of the norm is the anomalous measure.

Here, as a method of selecting a plurality of feature vectors, there is a method of selecting a predetermined number of tens to hundreds of feature vectors in order of proximity to the attention vector. Further, the feature vector to be learned may be clustered in advance, and the feature vector included in the cluster closest to the attention vector may be selected. Further, a local average distance method in which the distance of the k-nearest neighbor vector of the attention vector q to the average vector is used as an anomalous measure, a Gaussian process, or the like may be used.

After the anomaly measure calculation process for all feature vectors, the threshold value calculation unit 110 calculates the threshold value (S1008). This threshold value is compared with the abnormality measure input to the abnormality detection unit 113, and is used to determine the normality / abnormality of the equipment. The threshold value calculation unit 107 calculates a threshold value that does not determine normal learning data as abnormal. In other words, the maximum value of the anomalous measure obtained from normal learning data is calculated as the threshold value.

Alternatively, the threshold value for determining normal learning data as more than a predetermined ratio may be calculated. In this case, the anomaly measure obtained from the normal learning data is sorted, and the anomaly measure at which the anomaly measure reaches the predetermined ratio from the one with the lowest anomaly measure is adopted as the threshold value.

In the learning process of FIG. 10A, the learning result is stored in the learning result storage unit 111. The data saved as the training result includes at least parameters for feature vector extraction, parameters for anomaly measurement calculation, parameters for sensor normalization, all extracted feature vector data, anomaly determination threshold, and features. The parameters for vector extraction and the parameters for calculating the anomaly measure are the same as those specified at the time of learning. The parameters for sensor normalization are the average, standard deviation, maximum value, minimum value, and the like of each sensor signal calculated by the sensor signal input unit 107 in the process of step S1002.

Next, with reference to FIG. 11, the abnormality determination process at the time of abnormality detection in FIG. 3C will be described. FIG. 11 is a diagram showing a flow of abnormality detection processing (S321 to S324) by the abnormality detection unit 112. Here, of the data accumulated in the sensor signal storage unit 103, the data for a specified period or the newly observed data is extracted with a feature vector (feature vector extraction unit 108) and anomaly measurement is calculated (anomaly measurement). The calculation unit 109) is performed, and this is compared with the threshold value (threshold value calculation unit 111), and the abnormality detection unit 112 determines whether it is normal or abnormal.

The abnormality detection unit 110 reads the learning result saved at the time of learning from the database (S1101). At that time, the user selects an appropriate processing number based on the abnormality measure and the threshold value at the time of learning, and the learning result associated with the processing number is used. The signal input unit (second sensor signal input unit) 107 inputs the sensor signal 102 from the sensor signal storage unit 103 or the equipment 101 (S1102), and normalizes each sensor signal (S1103). At this time, the parameters used in the normalization process of step S1002 are used. Next, the feature vector extraction unit 108 extracts the feature vector from the selected sensor signal by the same method as the process of step S1003 (S1104).

Next, the processes of steps S1106 and S1107 are performed for all feature vectors (S1105, loop). The anomaly measure calculation unit 109 calculates the anomaly measure using the attention vector and the learning data (S1106). This process is performed in the same manner as in step S1007 of FIG. 10A, but all the training data is used. The abnormality detection unit 112 compares the threshold value read in step S1101 with the abnormality measure calculated in step S1106. If the anomaly measure is equal to or less than the threshold value, the equipment is determined to be "normal", and if the anomaly measure is greater than the threshold value, it is determined to be "abnormal" (S1107).

Next, an example of the user interface (GUI) of the abnormality detection device 100 for realizing the above operation will be described.

FIG. 12 is an example of a GUI that sets analysis conditions including a target period and processing parameters for performing sensor group setting. It is assumed that the past sensor signal 102 is stored in the sensor signal storage unit 103 in association with the equipment ID and the time.

On the sensor group setting screen 1201, the target equipment, the target period, the data cleansing parameter, the sensor group setting parameter, the sensor group setting method, the group instruction file name, and the recipe name are input. In the equipment ID input window 1202, the ID of the target equipment is input. By pressing the equipment list display button 1203, a list of device IDs of data stored in the sensor signal storage unit 103 is displayed, and a list is selected and input from the list. If there is only one equipment 101 connected to the abnormality detection device 100, the equipment ID input window 1202 is not displayed. Here, the sensor group setting screen 1201 is displayed on the output unit 113 of FIG. 1, for example.

In the target period input window 1204, the start date and end date of the processing target period are input. Check the data cleansing check box 1205 if you want to perform the data cleansing process before the sensor group setting process. In that case, the cleansing ratio is input to the cleansing ratio input window 1206. If the sensor signal value is far from the main distribution and the rate of occurrence is lower than the input value, the data will be deleted.

The sensor group setting parameters referred to in step S404 of FIG. 4, step S906 of FIG. 9A, and S918 of FIG. 9B are input to the maximum number of sensors input window 1207 and the similarity reference value input window 1208. The sensor group setting method selection button 1209 selects one of the methods. In the example of this figure, the method according to the processing flow of FIG. 4, FIG. 9A, and FIG. 9B corresponds, respectively. When "same group instruction" or "nuclear sensor instruction" is selected, the instruction file name is input in the instruction file input window 1210. In the instruction file, for example, a set of sensor names in the same group or one or more sensor names at the core of the group are described.

When the information on the above conditions is confirmed, the sensor group setting process is executed by pressing the execute button 1211. First, when the data cleansing check box 1205 is checked, the data cleansing process is performed on the sensor signal of the target period. Next, according to the selection by the sensor group setting method selection button 1209, the sensor group is set according to the processing flow of any one of FIGS. 4, 9A, and 9B, and the group information is saved.

After the processing is completed, the result display screen described later is displayed. When the confirmation by the user is completed, the sensor group setting screen 1201 is returned. By pressing the redisplay button 1212 button, the result display screen can be displayed sideways. By inputting the registered name in the registered name input window 1213 and pressing the registration button 1214, the sensor group information is saved in association with the equipment ID and the registered name, and the process ends. When the end button 1215 is pressed, the process ends without doing anything. In this case, the sensor group information once saved is deleted.

13A and 13B are examples of GUIs for showing the sensor group results to the user. When the user selects a tab displayed at the top of each screen, the screen switches to either the distribution image display screen 1301 or the sensor signal display screen 1302. Here, the distribution image display screen 1301 and the sensor signal display screen 1302 are displayed, for example, on the output unit 113 of FIG.

FIG. 13A is an example of a distribution image display screen. On the distribution image display screen 1301, distribution images among sensors belonging to the groups are displayed according to the display order selected in the display order selection window 1304 for the group selected in the group selection window 1303.

In the group selection window 1303, a list consisting of the sensor group number set by pressing the list display button and "others" is displayed, and the group to be displayed is specified by selecting one of them. Group 1 is selected before the selection by the user. In the display order selection window 1304, either "sensor number" or "similarity" can be selected by pressing the list display button. When "sensor number" is selected, the sensor numbers are displayed in ascending order, and when "similarity" is selected, the average similarity is displayed in descending order. The average similarity is the average value of the similarity between one sensor and another sensor in the group.

The sensor number and the corresponding sensor name are displayed in the sensor number column 1305 and the sensor name column 1306, respectively. The move destination selection window 1307 and the move button 1308 are displayed on each line. The action will be described later. In the distribution image display window 1309, the two-dimensional frequency distribution image of the sensor corresponding to the row and the sensor corresponding to the column and the similarity are displayed in a matrix. Even if the vertical and horizontal axes of the sensor numbers are exchanged, the distribution image only changes symmetrically, and the similarity is the same. Therefore, in this embodiment, the distribution image is on the lower left side of the matrix and the similarity is on the upper right side. Is displayed. When the display order is switched in the display order selection window 1304, both the rows and columns are exchanged, and when the similarity comes to the lower left side, the distribution image on the opposite side is exchanged. An image in which the vertical axis and the horizontal axis are exchanged is created from the image and replaced.

You can also edit groups on this screen. By selecting the move destination in the move destination selection window 1307 and pressing the move button 1308, the sensor in the corresponding row can be moved to another group. Select the destination from groups other than the current group and either "Other". The corresponding sensor is deleted from the displayed group, and the corresponding row and column are deleted and displayed in the top and left. The average similarity is recalculated.

In the operation selection window 1310, it is selected whether to register or discard the group. After selecting all the groups, pressing the OK button 1311 saves the group information of the group for which registration is selected, and returns to the sensor group setting screen 1201. When the cancel button 1311 is pressed, the sensor group is returned to the state before editing and the sensor group setting screen 1201 is returned. While the OK button 1311 has never been pressed, the registration button 1214 cannot be pressed on the sensor group setting screen 1201.

The results of group selection, display order selection, sensor group movement, and operation selection operated on the distribution image display screen 1301 are all reflected on the sensor signal display screen 1302. The result of moving the sensor group is also reflected on the display screen when another group is selected.

FIG. 13B is an example of the sensor signal display screen 1302. On the sensor signal display screen 1302, for the group selected in the group selection window 1303, a time-series sensor signal graph of the sensors belonging to the group is displayed according to the display order selected in the display order selection window 1304. The display period can be changed by inputting to the period input window 1312. This change is made for all sensors at once. In the sensor signal display window 1313, a time series graph of the sensor signal corresponding to each line is displayed.

On the sensor signal display screen 1302, group selection, display order selection, sensor group movement, and operation selection can be performed in the same manner as the distribution image display screen 1301, and the result is reflected on the distribution image display screen 1301. It is also possible to press the OK button 1311 and the cancel button 1311.

FIG. 14A is an example of a GUI for setting a learning period for performing offline analysis and analysis conditions including processing parameters. On this screen, it is also possible to register the calculated learning result as a recipe. Further, it is assumed that the past sensor signal 102 is stored in the database in association with the equipment ID and the time.

On the offline analysis condition setting screen 1401, the target equipment, learning period, test period, and abnormality measure calculation parameters are input. In the equipment ID input window 1402, the ID of the target equipment is input. By pressing the equipment list display button 1403, a list of device IDs of data stored in the sensor signal storage unit 103 is displayed, and a list is selected and input from the list. If there is only one equipment 101 connected to the abnormality detection device 100, the equipment ID input window 1402 is not displayed. Here, the offline analysis condition setting screen 1401 is displayed on the output unit 113 of FIG. 1, for example.

In the learning period input window 1404, the start date and end date of the period for which the learning data is to be extracted are input. In the test period input window 1405, enter the start date and end date of the period to be analyzed.

In the anomaly measure calculation parameter input window 1406, the parameters used in the anomaly measure calculation are input. The figure is an example when a local subspace is adopted as a method, and the number of neighboring vectors and the regularization parameter are input. The regularization parameter is a small number to be added to the diagonal component in order to prevent the inverse matrix of the correlation matrix C from being obtained in Eq. (2).

In the sensor group registered name input window 1407 and the group number input window, the registered name and group number of the sensor group set and registered on the screens of FIGS. 13A and 13B are input. When the above analysis condition information is confirmed, the offline analysis is executed by pressing the execute button 1409.

First, learning is executed according to the processing flow of FIG. 10A using the sensor signal during the learning period. As the learning result, the average and standard deviation for each sensor signal calculated in step S1002, all the feature vector data of the learning period extracted in step S1003, and the threshold value calculated in step S1008 are saved.

Further, using the sensor signals of the learning period and the test period, the abnormality measure is calculated according to the processing flow of FIG. 11, it is judged whether it is normal or abnormal, and the judgment result is saved together with the abnormality measure and the threshold value. .. However, with respect to the data of the learning period, it is determined whether it is normal or abnormal by using the abnormality measure calculated in step S1007.

After the analysis is completed, the result display screen described later is displayed. When the confirmation by the user is completed, the screen returns to the offline analysis condition setting screen 1401. By inputting the recipe name in the recipe name input window 1410 and pressing the registration button 1411, the learning result and the analysis result are saved in association with the equipment ID and the recipe name, and the process ends. Here, the learning result includes the data created and saved by the execution of the learning, as well as the abnormality measurement calculation parameters, the sensor group registration name, and the group number input in the input windows 1406 to 1408. When the end button 1412 is pressed, the process ends without doing anything. In this case, the learning result created and saved by learning and the analysis result created and saved by the subsequent abnormality detection process are deleted or overwritten by the analysis executed next.

The registered learning results are labeled as active or inactive and managed, and then online analysis is performed. In the online analysis, the newly input data is subjected to the processing shown in FIG. 11 using the information of the active learning result whose device ID matches, and the result is saved in association with the recipe name and the processing date and time. .. These processes are performed on a regular basis, for example, daily. For equipment with a short sampling interval or equipment that requires real-time performance, the execution interval should be shorter.

FIG. 14B is an example of a GUI for designating a display target of the online analysis result.
The user specifies the equipment, recipe, and period to be displayed from the display target designation screen 1421. First, the equipment ID is selected by the device ID selection window 1422. Next, the recipe name selection window 1423 selects the recipe to be displayed from the list of recipes for the equipment ID 1422. The data recording period display unit 1424 displays the start date and end date of the period in which the record is left, which is processed by using the input recipe. In the result display period specification window 1425, enter the start date and end date of the period for which the result is to be displayed. When the display button 1426 is pressed, the result of the abnormality detection process is displayed. When the end button 1427 is pressed, the process of specifying the display target is terminated. Here, the display target designation screen 1421 is displayed, for example, on the output unit 113 of FIG.

15A and 15B are examples of GUI for showing the analysis result to the user. When the user selects a tab displayed at the top of each screen, the user switches to either the analysis result overall display screen 1501 or the analysis result enlarged display screen 1502. Here, the analysis result overall display screen 1501 and the analysis result enlarged display screen 1502 are displayed, for example, on the output unit 113 of FIG.

FIG. 15A is an example of the analysis result overall display screen 1501. The analysis result overall display screen 1501 displays an abnormality measure, a threshold value, a determination result, and a time series graph of the sensor signal for a specified period. When displaying the result of the offline analysis, the period display window 1503 displays the learning period and the test period specified in FIG. 14A. When displaying the result of the online analysis, although not shown, the result display period specified in FIG. 14B is displayed.

In the abnormality measure display window 1504, the abnormality measure 1504a, the threshold value 1504b (broken line), and the determination result 1504c in the designated learning period / test period or result display period are displayed. In addition, a circle 1504d is displayed in the section used for learning. In the sensor signal display window 1505, the time series sensor signal 1505a is displayed for the designated sensor in the designated learning period / test period or result display period.

In the sensor selection window 1506, the sensor is specified by the input of the user. However, before the user specifies it, the first sensor used is selected. The cursor 1507 represents the starting point at the time of enlarged display, and can be moved by the user's mouse operation. The number of days from the start point to the end point of the enlarged display on the analysis result enlarged display screen 1502 is displayed in the display days designation window 508, and can be input on this screen. The date at the cursor position is displayed in the date display window 1509. By pressing the end button 1510, both the analysis result overall display screen 1501 and the analysis result enlarged display screen 1502 are erased, and the analysis result display ends.

FIG. 15B is an example of the analysis result enlarged display screen 1502. On the analysis result enlarged display screen 1502, the anomaly measurement, the threshold value, and the determination within the period of the number of days specified by the display days designation window 1509, starting from the date indicated by the cursor 1507 on the analysis result overall display screen 1501. The result and the time series graph of the sensor signal are displayed. That is, on the abnormality measure display window 1504 and the sensor signal display window 1505, the same information as the analysis result overall display screen 1501 is enlarged and displayed.

The scroll bar 1511 and the scroll bar area 1512 are additionally displayed on the analysis result enlarged display screen 1502. The length of the scroll bar 1511 corresponds to the number of days specified in the display days designation window 1508, and the total length of the scroll bar area 1511 corresponds to the period displayed on the analysis result overall display screen 1501. Further, the left end portion of the scroll bar 1511 corresponds to the starting point of the enlarged display. The user can also change the starting point of the display by operating the scroll bar 1511, and this change is reflected in the position of the cursor 1507 on the analysis result overall display screen 1501 and the display of the date display window 1509.

In the above embodiment, in the abnormality detection based on a plurality of time-series sensor signals, all the sensors are divided into appropriate sensor groups so as to improve the sensitivity, and the abnormality is detected for each sensor group. According to the above embodiment, all the sensors are divided into a sensor group consisting of an appropriate number based on the similarity (similarity) between the sensor signals, so that the abnormality detection sensitivity can be improved and which sensor is used. The abnormalities that have occurred can also be detected.

100 Abnormality detection device 101 Equipment 102 Sensor signal 103 Sensor signal storage unit 104 Signal input unit (first sensor signal input unit)
105 Sensor group setting unit 106 Group information storage unit,
107 Signal input unit (second sensor signal input unit)
108 Feature vector extraction unit 109 Anomaly measure calculation unit 110 Threshold calculation unit 111 Learning result storage unit 112 Anomaly detection unit 113 Output unit

Claims (9)

A first sensor signal input unit that inputs a plurality of time-series sensor signals output from a plurality of sensors mounted on the equipment, and a first sensor signal input unit.
A sensor group setting unit that obtains the similarity between a plurality of the sensor signals input to the first sensor signal input unit and sets a sensor group based on the similarity.
A second sensor signal input unit into which the plurality of sensor signals output from the plurality of sensors are input, and
For each sensor group, a feature vector extraction unit that extracts a feature vector for each time from a plurality of the sensor signals input to the second sensor signal input unit, and a feature vector extraction unit.
For each sensor group, an abnormality measure calculation unit that calculates an abnormality measure at each time using the feature vector of the designated learning period as learning data,
For each sensor group, an abnormality detection unit that determines whether the sensor signal at each time is normal or abnormal by comparing the abnormality measure with a predetermined threshold value.
Anomaly detection device characterized by having. The sensor group setting unit
The first aspect of claim 1, wherein the sensor group is set using a value from 0 to 1 calculated based on the two-dimensional distribution of two sensors among the plurality of sensors as the similarity. Anomaly detection device. The sensor group setting unit
The abnormality detection device according to claim 2, wherein the sensor group is set by hierarchical clustering based on the similarity. The sensor group setting unit
When executing the hierarchical clustering, the maximum number of sensors per the sensor group and the similarity reference value of the similarity are set in advance.
When the total number of sensors of the two clusters to be combined exceeds the maximum number of sensors and when the similarity between the two clusters is less than the similarity reference value, the two clusters are not combined. The abnormality detection device according to claim 3, wherein the abnormality detection device is characterized. The sensor group setting unit
When executing the hierarchical clustering, the sensors to be in the same sensor group are specified in advance.
The abnormality detection device according to claim 3, wherein the similarity between the same sensor group and the sensor signal output from the designated sensor is 1. The sensor group setting unit
A sensor group having at least one of the sensors as a core, a maximum number of sensors per the sensor group, and a similarity reference value of the similarity are specified in advance.
The sensor group is set by adding to the same sensor group in order from the sensor having the highest similarity with the sensor group within a range not exceeding the maximum number of sensors and not falling below the similarity reference value. The abnormality detection device according to claim 2. The sensor group setting unit
A claim characterized in that the sensors to be included in all the sensor groups are designated in advance, the sensor groups are set based on the similarity, and then the designated sensors are included in all the sensor groups. The abnormality detection device according to 1. The sensor group setting unit
The abnormality detection device according to claim 1, wherein a data cleansing process for deleting outliers deviating from the distribution of the histogram of the sensor signal is performed before setting the sensor group. Input multiple time-series sensor signals output from multiple sensors installed in the equipment,
Find the similarity between the plurality of sensor signals
Sensor groups are set based on the similarity,
For each sensor group, feature vectors are extracted from a plurality of the sensor signals for each time.
For each sensor group, the anomaly measure at each time is calculated using the feature vector of the designated learning period as learning data.
An abnormality detection method for each sensor group, which determines whether the sensor signal at each time is normal or abnormal by comparing the abnormality measure with a predetermined threshold value.

Images