JP2022066668A - Abnormality detection device and method - Google Patents

Abstract

To provide a technique capable of reducing errors of determination and detection of abnormalities by considering seasonal fluctuation regarding abnormality detection of a facility.SOLUTION: A server 10 constituting an abnormality detection device 1 is configured to: input a plurality of sensor signals 102 from a plurality of sensors 5 provided in a facility 101 in an environment; input an air temperature signal 104 in the environment; classify the plurality of sensor signals 102 into a first kind sensor signal which has a high correlation with the air temperature and a second kind sensor signal which has a low correlation with the air temperature; extract a feature vector per time from the plurality of sensor signals 102; calculate an abnormality measure per time using the feature vector in a specified learning period as learning data; determine whether a state of the facility 101 expressed by a plurality of sensor signals per time is normal or abnormal by comparing the abnormality measure with a threshold value; discriminate whether or not the determined abnormality is caused by seasonal fluctuation by using the first kind sensor signal; and create a detection result from which effects of the seasonal fluctuation are removed and output it if the abnormality is caused by the seasonal fluctuation.SELECTED DRAWING: Figure 3

Description

The present invention relates to an abnormality detection technique, and relates to a technique for early detection of anomalies based on a plurality of time-series sensor signals output by equipment such as a plant.

For example, an electric power company supplies hot water for district heating using waste heat of a gas turbine, and supplies high-pressure steam and low-pressure steam to factories. In this way, in equipment such as various plants that use gas turbines, anomaly detection and preventive maintenance technology that detects equipment malfunctions or signs of such malfunctions as abnormalities is to minimize damage to society. Is also extremely important. Target equipment is not limited to gas turbines and steam turbines, but also water turbines at hydropower plants, wind turbines at wind power plants, nuclear reactors at nuclear power plants, engines for aircraft and heavy machinery, railway vehicles and tracks, escalator, elevators, etc. And the level of various equipment and parts. Even in these facilities, problems may occur due to deterioration, life, etc. of the mounted battery, for example. Therefore, there is no time to list the equipment that requires the above-mentioned abnormality detection and preventive maintenance. The target equipment is provided with a plurality of sensors for acquiring various physical information. Each sensor outputs a time series sensor signal. The system for detecting an abnormality or the like determines and detects whether the state of the target equipment is normal or abnormal according to the monitoring standard for each sensor.

As an example of the prior art related to the above-mentioned abnormality detection and the like, Japanese Patent Application Laid-Open No. 2014-142697 (Patent Document 1) can be mentioned. Patent Document 1 discloses a method of detecting the presence or absence of an abnormality by comparing an abnormality measure calculated based on learning of past normal data with a threshold value. Further, Patent Document 1 describes a sensor related to an abnormality based on a two-dimensional distribution of sensor signals for the purpose of presenting information that supports the determination of the next action such as countermeasures / investigations for the detected abnormality. The method of identifying is disclosed.

Japanese Unexamined Patent Publication No. 2014-1426997

In the conventional technique for detecting the above abnormality, when there is a seasonal fluctuation such as the four seasons in Japan where the temperature etc. fluctuates according to the season in the environment including the equipment, the state of the equipment is erroneously detected due to the influence of the seasonal fluctuation. there's a possibility that. In the abnormality detection method of Patent Document 1, data deviating from the learned normal data is detected as an abnormality. Therefore, in this method, if the learning period is less than one year, the deviation of the sensor signal value due to the seasonal fluctuation is detected as an abnormality. That is, an erroneous detection occurs in which an abnormality is detected as an abnormality even though there is no actual abnormality in the equipment. Also, this method does not extract the true cause of equipment anomalies.

In the conventional learning for abnormality determination / detection, for example, a learning process is required with a period of at least one week or more as a learning period. If there is a change in temperature or the like as a seasonal change in a relatively long period beyond the learning period, an error may occur in the abnormality determination / detection.

It is also a good idea to deal with the above problems by lengthening the learning period. That is, in order to learn the influence of seasonal fluctuations, a period of length that reflects seasonal fluctuations (for example, one year or more) may be set as the learning period. However, if the learning period is so long, the load on the computer will be high and the amount of data will be large, so it is not realistic and it will be possible to perform highly accurate abnormality judgment and detection that can eliminate the effects of seasonal fluctuations. It takes a long time to prepare for it.

An object of the present invention is to provide a technique for reducing an error in abnormality determination / detection in consideration of seasonal fluctuations in the technique for detecting anomalies.

A typical embodiment of the present invention has the following configurations. The abnormality detection device of the embodiment inputs a plurality of sensor signals from a plurality of sensors provided in equipment in the environment, inputs signals of seasonal fluctuation values due to the temperature in the environment or other parameters, and the plurality of signals. The sensor signals of are classified into a type 1 sensor signal having a high correlation with the seasonal fluctuation value and a type 2 sensor signal having a low correlation with the seasonal fluctuation value, and a feature vector is extracted for each time from the plurality of sensor signals and designated. Using the feature vector in the learning period as training data, an abnormality measurement for each time is calculated, and the abnormality measurement is compared with a threshold value to obtain the equipment represented by the plurality of sensor signals for each time. When it is determined whether the state is normal or abnormal, and it is determined whether or not the determined abnormality is caused by the seasonal variation by using the type 1 sensor signal, and it is determined that the state is caused by the seasonal variation. , Creates and outputs a detection result that removes the influence of the seasonal fluctuation from the state of the equipment.

According to a typical embodiment of the present invention, it is possible to reduce errors in abnormality determination / detection in consideration of seasonal fluctuations in the above-mentioned techniques such as abnormality detection.

The configuration of the system including the abnormality detection apparatus of Embodiment 1 of this invention is shown. The first embodiment shows a configuration example of a server. In the first embodiment, an example of a functional block configuration of a server is shown. In the first embodiment, a sensor list table of a plurality of sensors is shown. In the first embodiment, the processing flow at the time of learning performed by the abnormality detection device is shown. In the first embodiment, the processing flow at the time of abnormality detection performed by the abnormality detection device is shown. In the first embodiment, the flow of the abnormality measure calculation process at the time of learning is shown. FIG. 1 is an explanatory diagram of an anomaly measure calculation process by the local subspace method in the first embodiment. In the first embodiment, the flow of the first distribution density image creation process is shown. It is explanatory drawing of the method of making the 1st distribution density image in Embodiment 1. FIG. In the first embodiment, an example of the first distribution density image is shown. In the first embodiment, an example of the first distribution density image is shown. In the first embodiment, the flow of the process of creating the second distribution density image is shown. In the first embodiment, an example of the second distribution density image is shown. In the first embodiment, the flow of abnormality detection processing is shown. In the first embodiment, the flow of the isolation degree calculation process is shown. It is explanatory drawing of the isolation degree calculation method in Embodiment 1. In the first embodiment, the flow of the related sensor identification process is shown. In the first embodiment, the flow of the seasonal fluctuation discrimination process is shown. In the first embodiment, the first flow of the seasonal variation removal process is shown. In the first embodiment, the second flow of the seasonal variation removal process is shown. In the first embodiment, the offline analysis condition setting screen is shown. In the first embodiment, the online analysis result display target designation screen is shown. In the first embodiment, the sensor classification result display screen is shown. In the first embodiment, the abnormality detection result overall display screen is shown. In the first embodiment, the abnormality detection result overall display screen is shown. In the first embodiment, the related sensor identification result display screen is shown. In the first embodiment, an example of an abnormal plot image is shown.

<Embodiment 1>
The abnormality detection device and the like according to the first embodiment of the present invention will be described with reference to FIGS. 1 to 28. The abnormality detection method of the first embodiment is a method having a step executed by the abnormality detection device of the first embodiment.

The abnormality detection device of the first embodiment can reflect seasonal fluctuations when determining and detecting the state (particularly abnormality) of the equipment based on a plurality of sensor signals of the equipment, for at least one week and less than one year. Judgment / detection is performed for the sensor signal of the period, taking into account the influence of seasonal fluctuations. The abnormality detection device of the first embodiment determines whether the state of the equipment represented by the plurality of sensor signal values is due to the influence of the seasonal fluctuations based on the correlation between the sensor signal values and the seasonal fluctuation values such as the temperature. However, if it is due to the influence of seasonal fluctuations, the result of removing the influence of seasonal fluctuations is created and output.

The abnormality detection device of the first embodiment inputs and accumulates a plurality of time-series sensor signals output from a plurality of sensors installed in equipment in the environment, and also inputs and inputs a signal of the temperature in the environment. Multiple sensor signals are classified into those with high correlation with temperature and those with low correlation. The anomaly detection device extracts a feature vector for each time from a plurality of sensor signals, and uses the feature vector for a designated learning period as learning data to calculate an anomaly measure for each time. The abnormality detection device compares the calculated abnormality measure with the threshold value to determine whether the state of the equipment represented by the plurality of sensor signals for each time is abnormal or normal. The anomaly detection device uses a sensor signal that has a high correlation with the temperature to determine whether or not the detected anomaly is due to seasonal fluctuations. When the detected abnormality is caused by seasonal fluctuation, the abnormality detection device creates and outputs a detection result in which the influence of seasonal fluctuation is removed from the state of the equipment.

According to the abnormality detection device of the first embodiment, a sensor signal having a high correlation with the temperature is examined, and the sensor signal is used to automatically determine whether or not the detected abnormality is caused by seasonal fluctuation. Therefore, according to this anomaly detection device, even in a relatively short learning period of less than one year (for example, several weeks to several months), as equipment abnormalities, abnormalities caused by seasonal fluctuations and abnormalities not caused by seasonal fluctuations can be detected. Can be distinguished. Further, this abnormality detection device outputs a detection result in which the influence of the seasonal fluctuation is removed when the cause is the seasonal fluctuation. Therefore, according to this abnormality detection device, if there is no abnormality in the equipment, it can be judged as normal and false detection can be prevented, and if there is an abnormality, a true factor other than the cause of seasonal fluctuation can be found. ..

[system]
FIG. 1 shows the configuration of a system including the abnormality detection device of the first embodiment. The system of FIG. 1 (in other words, an abnormality detection system) has an abnormality detection device 1 and a plurality of facilities 101 that are targets of state determination including abnormality detection. The abnormality detection device 1 is connected to each facility 101 or a communication device 150 via a communication network 9. In the environment of each factory or the like, it has equipment 101 such as a plant. In the example of FIG. 1, the environment # 1, # 2, ... Is provided as a plurality of environments, but the target is not limited to this, and the target may be one facility 101 of one environment. The target equipment 101 is a plant including, for example, a gas turbine, a steam turbine, or the like. Equipment is a concept that includes a plant.

A plurality of sensors 5 are installed in the equipment 101 in the environment. The plurality of sensors 5 are a plurality of types of sensors for detecting a plurality of types of physical information. Each sensor 5 may be built in the equipment 101 or may be externally attached. Each sensor 5 outputs a time-series sensor signal 102. The sensor 5 outputs a sensor value representing the state of the equipment 101 including the measured value of predetermined physical information as a time-series sensor signal 102. Further, a temperature sensor 6 is provided in the environment. The air temperature sensor 6 detects the temperature of the environment of the equipment 101. The air temperature sensor 6 outputs a time-series temperature signal 104.

As shown by the balloon, the plurality of sensors 5 of the equipment 101 of the environment # 1 have sensors S1, S2, ..., Sm, for example, assuming that the number of the plurality of types of sensors 5 is m. It should be noted that the plurality of (m) sensors 5 {S1 to Sm} and the temperature sensor 6 are distinguished from each other. The plurality of (m) sensors 5 {S1 to Sm} may include a temperature sensor that measures the temperature of the target location.

The abnormality detection device 1 (in other words, the abnormality detection system) of FIG. 1 is mainly mounted on a computer such as a server 10. Hereinafter, the server 10 may be referred to as an abnormality detection device 10. The server 10 is connected to the client terminal 20 such as a PC used by the user U1 by communication. Further, the server 10 is connected to the communication device 50 of the equipment 101 of each environment by communication. User U1 is a person such as an administrator involved in abnormality detection and preventive maintenance of equipment 101.

The communication device 50 is provided for communication with the server 10. If a computer such as a server 10 is provided in the environment, the communication device 50 can be omitted. The communication device 50 acquires the sensor signal 102 from each sensor 5 of the equipment 101, and also acquires the air temperature signal 104 from the air temperature sensor 6. Then, the communication device 50 transmits data including the plurality of sensor signals 102 and the temperature signal 104 to the server 10 as the communication signal 150. The server 10 stores the data received / acquired from each communication device 50 in the database (DB). The communication device 50 may automatically transmit the communication signal 150 to the server 10 at the set timing. Alternatively, the server 10 may request data from the communication device 50, and the communication device 50 may transmit the communication signal 150 to the server 10 as a response to the data.

The server 10 is equipped with an abnormality detection processing function. The server 10 realizes the abnormality detection processing function according to the program held by itself or the program distributed from the external program distribution server. The server 10 stores and manages the data acquired from the equipment 101, various processing information, and the like in the DB. The server 10 provides the client terminal 20 of the user U1 with information such as a detection result (output information) 160 regarding a state such as an abnormality of the equipment 101. For example, the server 10 provides the client terminal 20 with a Web page including the detection result 160. The client terminal 20 displays the Web page on the display screen.

For example, the server 10 may constantly communicate with the communication device 10 and perform processing in real time. As a result, when the server 10 detects an abnormality in the equipment 101, the server 10 may immediately notify or alert a predetermined destination such as the client terminal 20 of the user U1. The server 10 may make a communication connection with the communication device 50 only for a predetermined time, such as when an instruction is input from the user U1 or when a preset setting is made.

The configuration is not limited to that shown in FIG. The abnormality detection device 1 is mounted on one or more computers or the like. One abnormality detection device 1 may be provided in one facility 101 in one environment. The communication device 50 may be the abnormality detection device. Each abnormality detection device provided in each environment may cooperate with each other via the communication network 9 to realize the function. The abnormality detection device 1 may be implemented in a cloud computing system or the like on the communication network 9 by a plurality of computers. A storage device, a DB server, or the like may be connected to the server 10.

[Abnormality detection device (1)]
FIG. 2 shows a configuration example of the server 10 of FIG. 1, which mainly constitutes the abnormality detection device 1, as a computer system. This computer system has a server 10 and an input device 205 and a display device 206 connected to the server 10. The server 10 is composed of a processor 201, a memory 202, a communication interface device 203, an input / output interface device 204, a bus connecting them to each other, and the like. An input device 205 and a display device 206 are connected to the input / output interface device 204. The input device 205 is, for example, a keyboard, a mouse, or the like. The display device 206 is, for example, a liquid crystal display or the like. Not limited to this, the input device 205 and the display device 206 may be integrated with the server 10 or may be omitted when the client terminal 20 is used. The communication interface device 203 communicates with the communication device 50, the client terminal 20, and the like shown in FIG. 1 using a predetermined communication interface.

The processor 201 is composed of, for example, a CPU, a ROM, a RAM, or the like, and constitutes a controller of the server 10. The processor 201 realizes an abnormality detection processing function or the like as a predetermined function based on software program processing. The processor 201 receives and acquires the data of the communication signal 150 from the communication device 50, and stores the sensor signal 102 and the temperature signal 104 included in the data in the memory 202 as the sensor signal data D1 and the temperature signal data D2. The processor 201 determines and detects a state such as an abnormality of each equipment 101 based on the data. In other words, the processor 201 performs learning and analysis based on the data. The processor 201 stores the learning data D3 and the analysis data D4 in the memory 202. The processor 201 creates a detection result of a state such as an abnormality as detection result data (in other words, output information) D5 and stores it in the memory 202. Processor 201 also creates various screen data. The processor 201 transmits information such as a detection result (for example, a Web page or an email) based on the detection result data D5 or the like to the client terminal 20.

The memory 202 is composed of a non-volatile storage device or the like, and stores and holds various data and information used by the processor 201 and the like. The memory 202 stores the control program 202A, the setting information 202B, the sensor signal data D1, the temperature signal data D2, the learning data D3, the analysis data D4, the detection result data D5, and the like. The control program 201A is a program for realizing the function of the server 10. The setting information 202B is the setting information of the control program 201A and the user U1. The user U1 can operate the input device 205 of the client terminal 20 or the server 10 and set and confirm necessary information while looking at the screen of the client terminal 20 or the display device 206.

It is possible not only with the configuration example of the computer system of FIG. The server 10 may be installed by distributing a computer program such as the control program 201A from the outside. The computer program may be stored on a non-transient computer-readable recording medium.

Similarly, the client terminal 20 is composed of a processor by a CPU or the like, a memory, a communication interface, an input / output interface, an input device, a display device, a bus, and the like. The client terminal 20 realizes a function as a client application as a part of the abnormality detection processing function of the server 10 based on the processing of the program. The client terminal 20 communicates with the server 10 by a protocol such as HTTP, acquires a Web page such as a detection result 160 from the server 10, and displays it on the screen of the display device. The client terminal 20 receives the input of the user U1 to the GUI on the screen and transmits the input information to the server 10.

[Abnormality detection device (2)]
FIG. 3 shows an example of a functional block configuration of the server 10 which is an abnormality detection device. The functional block of FIG. 3 is realized by program processing or the like by the processor 201 of FIG. The server 10, which is an abnormality detection device, includes a data storage unit 103, a sensor classification unit 105, a signal input unit 106, a feature vector extraction unit 107, an abnormality measurement calculation unit 108, a threshold value calculation unit 109, and a distribution density image creation unit 110. It has a learning result storage unit 111, an abnormality detection unit 112, a related sensor identification unit 113, a seasonal variation determination unit 114, a seasonal variation removal unit 115, and a detection result output unit 116.

The server 10 inputs and acquires sensor signals 102 from a plurality of sensors 5 of the target equipment 101 as communication signals 150 through the communication device 50, for example, at predetermined time intervals, in other words, periodically. Further, the server 10 inputs and acquires the air temperature signal 103 from the air temperature sensor 6 in the environment of the target equipment 101 as the communication signal 150 through the communication device 50 at predetermined time intervals, in other words, periodically.

The server 10 inputs and acquires the communication signal 150 from the communication device 50 of the equipment 101 in substantially real time. The server 10 temporarily stores the sensor signal 102 and the temperature signal 104, which are time-series signals acquired based on the communication signal 150, in the data storage unit 103. The data storage unit 103 also functions as a buffer. The signal input unit 106 inputs the sensor signal 102 from the data storage unit 103. The sensor classification unit 105 inputs the sensor signal 102 and the temperature signal 104 from the data storage unit 103. The signal input unit 106 and the sensor classification unit 105 may directly input each signal from the communication signal 150.

The sensor classification unit 105 refers to the air temperature of the air temperature signal 104, and also refers to a plurality of sensor values of the plurality of sensor signals 102 of the equipment 101. Based on the determination of the correlation between the temperature and the sensor signal, the sensor classification unit 105 uses the plurality of sensor signals 102 to have a correlation between the sensor signal having a high correlation with the temperature (referred to as a type 1 sensor signal) and the temperature. It is classified as a low sensor signal (referred to as a type 2 sensor signal). This classification is relative.

The signal input unit 106 inputs a plurality of sensor signals 102 of the equipment 101, performs preprocessing and the like, and then sends them to the feature vector extraction unit 107. The feature vector extraction unit 107 extracts a feature vector based on a plurality of input sensor signals 102 and sends the feature vector to the anomaly measure calculation unit 108. The anomaly measure calculation unit 108 calculates an anomaly measure for each feature vector at predetermined time intervals (hereinafter, may be referred to as each time) using a feature vector of a learning period designated in advance. The learning period can be set by the user U1. The learning period may be a period of at least one week and less than one year as a period in which seasonal fluctuations are reflected. The threshold value calculation unit 109 calculates a threshold value (referred to as H) based on the abnormality measurement of the learning data by the abnormality measurement calculation unit 108. The threshold value H is one or more threshold values for determining an abnormality, and constitutes a condition such as a range.

The distribution density image creation unit 110 creates and stores a distribution density image (referred to as a first distribution density image) in a round-robin combination of two sensors 5 as a pair, based on the sensor signal 102 during the learning period. .. Further, the distribution density image creation unit 110 acquires a type 1 sensor signal having a high correlation with the temperature from the sensor classification unit 105, and has a distribution density image (second) with the horizontal axis as the temperature and the vertical axis as the sensor signal. Create a distribution density image).

The learning result storage unit 111 includes a feature vector of the learning period extracted by the feature vector extraction unit 107, a threshold value H calculated by the threshold value calculation unit 109, and a distribution density image created by the distribution density image creation unit 110. , And other data required for abnormality detection are saved as a learning result (learning data D3 in FIG. 2).

The abnormality detection unit 112 compares the abnormality measurement of each feature vector in the abnormality detection target period from the abnormality measurement calculation unit 108 with the threshold value calculated by the threshold value calculation unit 109, so that the equipment 101 can be used. Judge and detect abnormal conditions. In other words, the abnormality detection unit 112 outputs information indicating the presence / absence of an abnormality in the equipment 101, the degree of possibility of the abnormality, and the like.

When the abnormality detection unit 112 detects an abnormality, the related sensor identification unit 113 identifies the abnormality-related sensor for each abnormality section by using the first brute force distribution density image created by the distribution density image creation unit 110. do. The abnormality-related sensor is a sensor 5 that is presumed to be related to an abnormality. The related sensor identification unit 113 creates an image in which the abnormality is plotted on the distribution density image for the abnormality-related sensor.

The seasonal variation determination unit 114 uses the second distribution density image whose horizontal axis is the temperature created by the distribution density image creation unit 110, and whether or not the detected abnormality is caused by the seasonal variation for each abnormality section. To determine. In other words, the seasonal variation determination unit 114 distinguishes the abnormality into an abnormality caused by the seasonal variation and an abnormality not caused by the seasonal variation, and outputs the abnormality as the seasonal variation determination result.

The seasonal variation removing unit 115 processes so as to remove the influence of the seasonal variation for each abnormal section based on the abnormality measure, the presence / absence of abnormality, the abnormality-related sensor identification result, the seasonal variation determination result, and the like. The seasonal variation removing unit 115 outputs the processing result after removing the influence of the seasonal variation as a detection result including the abnormality-related sensor information and the like. Specifically, among the anomaly-related sensors before removal, the sensor determined to be caused by seasonal fluctuation is removed together with the output to the effect that it is caused by seasonal fluctuation, and information on the presence or absence of abnormality other than that caused by seasonal fluctuation is output.

The detection result output unit 116 creates detection result data D5 (FIG. 2) for output to the user U1 based on the above detection result, and displays, for example, a Web page displaying the detection result after removing seasonal fluctuations. It is provided to the client terminal 20 of the user U1. The detection result output unit 116 transmits, for example, a Web page based on the detection result data D7 to the client terminal 20. When the state of the equipment 101 is abnormal, the detection result output unit 116 may immediately output an alert or the like to a predetermined destination. The output is not limited to the screen display, and may be audio output, lamp emission, or the like by using a predetermined output device.

[Glossary]
I will briefly explain the terms. The feature vector is a vector value, in other words, a measured value (values s1, s2, ..., Sm) of each physical information which is a plurality of sensor values by a plurality of sensors 5. It is expressed as a one-dimensional array. Expressed as a symbol, V = {s1, s2, ..., sm}, where V is the feature vector.

Abnormally measure is the amount or distance of the feature vector of interest (in other words, the vector to be judged) from the feature vector (in other words, the vector that serves as the judgment criterion) in a specified period. be. The anomalous section is a section in which anomalies are considered to be continuously detected.

In the case of the first distribution density image, the distribution density image is an image showing a two-dimensional histogram of two sensor signal values in a combination of two paired sensors 5. Each pixel value of this image is a pixel value corresponding to a frequency value. Similarly, in the case of the second distribution density image, the two-dimensional histogram of the combination of the air temperature and the sensor signal value is represented by the image.

The isolation index is a parameter indicating how much the sensor signal value deviates from the learning data, and indicates the strength of the relationship with the abnormality. The greater the degree of isolation, the stronger the association with the abnormality. The degree of isolation will be described later, but there are multiple types. The degree of isolation of the sensor signal value (eg, sx) of a single sensor 5 (eg, Sx) is IA (eg, Ix), and the degree of isolation of a pair of two sensors 5 (eg, Sx, Sy) is IB (eg, Ixy). And. In addition, regarding these concepts of isolation degree I (IA, IB), before and after removal of the influence of seasonal fluctuations are distinguished.

Anomaly-related sensors (also referred to as related sensors) are sensors that are presumed to be highly related to anomalies. Specifically, anomalies are detected when the anomaly measure of the feature vector exceeds the threshold value H. This is the sensor 5 that caused the problem.

The anomaly plot image is an image in which a color representing an abnormality (for example, red) different from the color indicating normality (for example, gray) is plotted on a pixel at a position corresponding to the sensor signal value in the abnormality section, superimposed on the distribution density image. Is.

The abnormality detection device of the first embodiment determines at least normal (no abnormality) or abnormality (abnormality) as the state of the equipment 101, but the state is not limited to this, and the state of the equipment 101 is three or more. It may be determined as the state or degree of.

[Sensor list table]
FIG. 4 shows a data example (may be referred to as a sensor list table) in which a plurality of sensor signals 102 of the plurality of sensors 5 are listed and represented in a tabular format. The server 10 holds such a sensor list table 400. The sensor list table 400 of FIG. 4 has a date and time 401 and a sensor 402 as items, and data for each date and time is stored for each row. The sensor 402 item has an item of each sensor 5, and a sensor value is stored for each item. The plurality of sensor signals 102 as shown in FIG. 1 and the like are multidimensional time-series signals in which a plurality of physical information having different physical characteristics are acquired at predetermined time intervals.

The number (m) of the sensors 5 may be as many as hundreds to thousands. There may be a plurality of sensors for each type of sensor. Depending on the type of the sensor 5, for example, the temperature of the cylinder, oil, cooling water, etc., the pressure of the oil, cooling water, the rotation speed of the shaft, the operating time, and the like can be obtained as sensor values. The sensor value not only represents the output or state of each part of the equipment 101, but may also be a control signal for controlling some state to a certain value (for example, a target value). For example, a plant controller may perform plant control using a certain sensor value as a control signal. The server 10 or the communication device 50 may acquire such a sensor value from the controller of the equipment 101 or the like.

The operation of the abnormality detection device 1 includes a "sensor classification" process for classifying the sensor 5 using the sensor signal 102 and the temperature signal 104 stored in the data storage unit 103, and the data stored in the data storage unit 103 and the like. There are phases of "learning" processing in which learning data is generated and stored using the data, and "abnormality detection" processing in which an abnormality in the equipment 101 is detected by comparison with the training data based on an input signal. In the first embodiment, basically, "sensor classification" and "learning" are performed as "offline" processing, and "abnormality detection" is performed as "online" processing. The "offline" process corresponds to once acquiring and storing learning and analysis target data for the state of the equipment 101, and then collectively executing abnormality determination and detection. The "online" process corresponds to executing abnormality determination / detection in substantially real time based on the learning data learned in advance for the state of the equipment 101. However, it is also possible to set "abnormality detection" to "offline" processing. In the following description, these may be roughly classified into "at the time of learning" and "at the time of abnormality detection".

[Processing flow (1)]
FIG. 5 shows a flow of an outline of processing during learning performed by the abnormality detection device 1, particularly the server 10. The flow of FIG. 5 is roughly classified into (a) a sensor classification process 500 during learning and (b) an abnormality measure calculation process 510 during learning. In the sensor classification process 500 at the time of learning in (a), first, in step S501, the server 10 inputs the sensor signal 102 in the designated learning period. In step S502, the server 10 inputs the data of the temperature signal 104 in the learning period. In step S503, the server 10 calculates the correlation between the temperature and the sensor signal as a correlation value. In step S504, the server 10 sets a plurality of sensors 5 (for example, S1 to Sm in FIG. 1) and sensor signals 102 (s1 to sm) as a first-class sensor signal value and a second-class sensor signal value according to the correlation. Classify as. Specifically, the server 10 classifies the sensor 5 whose correlation value exceeds a predetermined reference value as a first-class sensor having a high correlation with the air temperature.

In the abnormality measurement calculation process 510 during learning in (b), first, in step S511, the server 10 inputs the sensor signal 102 during the learning period. In step S512, the server 10 extracts the feature vector using the sensor signal 102. In step S513, the server 10 calculates an anomaly measure for the feature vector. In step S514, the server 10 calculates the threshold value H. In step S515, the server 10 creates a brute force distribution density image (first distribution density image) for each pair of two sensors. Then, in step S516, the server 10 creates a distribution density image (first distribution density image) whose horizontal axis is the temperature.

[Processing flow (2)]
FIG. 6 shows a flow of an outline of processing when an abnormality is detected, particularly performed by the server 10 of the abnormality detection device 1. The flow of FIG. 6 has an abnormality determination process 600 at the time of abnormality detection in (c). In the abnormality determination process 600, first, in step S601, the server 10 inputs the sensor signal 102 to be detected in the target period. In step S602, the server 10 extracts the feature vector using the sensor signal 102. In step S603, the server 10 calculates an anomaly measure for the feature vector. In step S604, the server 10 determines the normal / abnormal state of the target equipment 101 by comparing the calculated abnormality measure with the threshold value H calculated in step S514 of FIG. In step S605, the server 10 extracts the abnormal section. In step S606, the server 10 calculates the isolation degree vector for each abnormality section as the isolation degree. In step S607, the server 10 identifies the anomaly-related sensor based on this degree of isolation. In step S608, the server 10 creates an abnormality plot image in which the horizontal axis is the temperature and the vertical axis is the sensor signal value. In step S609, the server 10 determines seasonal fluctuations as to whether or not the abnormality is due to the influence of seasonal fluctuations. In step S610, the server 10 performs seasonal variation removal to remove the influence of seasonal variation from the detection result.

[Processing details]
Hereinafter, the abnormality measurement calculation process 510 at the time of learning in FIG. 5 (b) and the abnormality determination process 600 at the time of abnormality detection in FIG. 6 (c) will be described in order. The detailed flow of each process is shown in FIGS. 7 and later.

[Details of abnormality measure calculation processing during learning]
FIG. 7 shows a detailed processing example of the abnormality measurement calculation processing 510 at the time of learning in FIG. 5 (b). First, in step S701, the server 10 inputs the sensor signal of the designated learning period among the sensor values stored in the data storage unit 103 in the signal input unit 106 of FIG. Here, as the learning period, it is assumed that the user U1 previously designates a period during which the equipment 101 is in a normal state. Next, in step S702, the server 10 normalizes the input sensor signal in the feature vector extraction unit 107 of FIG. This normalization is a process performed to handle a plurality of sensor signals having different units and scales in the same manner. Specifically, in this canonicalization, each sensor signal is converted so that the mean is 0 and the variance is 1 by using the mean and standard deviation of the learning period of each sensor signal. The server 10 stores the average and standard deviation of each sensor signal so that the same conversion can be performed when an abnormality is detected. Alternatively, in this canonicalization, each sensor signal is converted so that the maximum is 1 and the minimum is 0 by using the maximum and minimum values of the learning period of each sensor signal. Alternatively, in this canonicalization, preset upper and lower limit values may be used instead of the maximum and minimum values. In this case, the server 10 stores the maximum value and the minimum value, or the upper limit value and the lower limit value of each sensor signal in the learning result storage unit 111 so that the same conversion can be performed when an abnormality is detected.

Next, in step S703, the server 10 extracts the feature vector at each time in the feature vector extraction unit 107 of FIG. This feature vector is an array in which the normalized sensor signal values are arranged as they are as elements. Alternatively, in this process, a window such as ± 1, ± 2, ... Is provided for a certain time (set to 0), and the feature vector is the window width (3, 5, ...) x the number of sensors (m). Therefore, a feature representing the time change of the sensor signal may be extracted. For example, window width = 3 refers to the time width of three times (-1, 0, + 1). Further, the feature vector may be extracted by subjecting it to a discrete wavelet transform (DWT) and decomposing it into frequency components.

Next, the server 10 calculates the abnormality measure during the learning period in the abnormality measure calculation unit 108 of FIG. Therefore, in step S704, the server 10 first divides the learning period into a plurality of sections. This section division is, for example, a daily section. Alternatively, this section division may be performed for each batch in the case of batch processing such as a chemical plant, for each individual to be processed in the case of a processing device, or in the case of a medical device such as MRI. May be for each person to be inspected. The server 10 repeats the following processing for all the extracted feature vectors in the loop from step S705. In step S706, the server 10 uses the feature vector sequentially selected corresponding to the plurality of sections as the attention vector, and the data in the learning period excluding the feature vector in the same section as the attention vector as the training data. In step S707, the server 10 calculates an anomaly measure using the attention vector and the training data. A local sub-space classifier (LSC) or a projection distance method (PDM) can be used for the calculation process of this anomaly measure.

[Abnormal measure calculation process (1)]
FIG. 8 shows an explanatory diagram of an abnormality measure calculation process when the local subspace method is used for step S707. The local subspace method is a method of selecting k neighborhood vectors with respect to the attention vector q and measuring the projection distance when the attention vector q is projected onto the k-1 dimensional affine subspace spanned by the selected k neighborhood vectors. Is. FIG. 8 shows a case where the affine subspace 801 is formed by k = 3 neighborhood vectors x1, x2, x3. The neighborhood vectors x1 to x3 shown by the gray square points are in the plane of the affine subspace 801. The other vectors, indicated by the white squares, are spaced above and below the plane of the affine subspace 801. The attention vector q indicated by the circle dots has a distance 802 above the plane of the affine subspace 801. Then, the black point Xb on the affine subspace 801 closest to the attention vector q becomes a projection point (also referred to as a reference vector). The distance 802, which is the projected distance from the attention vector q to the reference vector Xb, is an anomaly measure.

A specific calculation method for anomalous measures will be described. Let the attention vector q be the evaluation data q. The server 10 creates a matrix Q in which k pieces of evaluation data q are arranged and a matrix X in which k pieces of neighborhood vectors xi are arranged from the evaluation data q and k neighborhood vectors xi (i = 1, ..., k). do. The server 10 obtains the correlation matrix C between the two from the following equation 1. The symbol ^T indicates a transposed matrix.
Equation 1: C = (QX) ^T (QX)

Next, the server 10 calculates the coefficient vector b representing the weighting of the neighborhood vector xi from the following equation 2.
Equation 2: b = (C ^-1 1 _n ) / (1 _n ^{TC -1} 1 _n )

Assuming that the anomaly measure is d, the anomaly measure d is calculated by the norm of the vector (q—Xb) or the square of the norm thereof. The norm is an operation such as √ (X1 ² + …… + Xm ² ).

In FIG. 8, the case where k = 3 is shown as the number of neighboring vectors, but this number may be any number as long as it is sufficiently smaller than the number of dimensions of the feature vector. When k = 1, the process is equivalent to the nearest neighbor method.

[Abnormal measure calculation process (2)]
The anomaly measure calculation process when the projection distance method is used is as follows. The projection distance method is a method of creating a subspace having its own origin for the selected feature vector, that is, an affine subspace (which is the space with the largest variance). The server 10 selects a plurality of feature vectors corresponding to the attention vectors by some method, and calculates the affine subspace by the following method.

First, the server 10 calculates the average μ of the selected feature vectors and the covariance matrix Σ. Next, the server 10 solves the eigenvalue problem of the covariance matrix Σ, and sets the matrix U in which the eigenvectors corresponding to the r eigenvalues specified in advance from the largest value are arranged as the orthonormal basis of the affine subspace. .. The number r is smaller than the dimension of the feature vector and smaller than the number of selected data. Alternatively, the number r may not be a fixed number, but a value when the cumulative contribution rate from the larger eigenvalue exceeds a predetermined ratio may be used as the number r. As shown in FIG. 8, the point on the affine subspace closest to the attention vector is the reference vector. Further, the vector obtained by subtracting the reference vector from the vector of interest (q—Xb) is the residual vector. The norm of the residual vector or the square of the norm is an anomalous measure.

Here, as a method of selecting a plurality of feature vectors, there is a method of selecting a predetermined number of tens to hundreds of feature vectors in order of proximity to the attention vector. There is also a method in which the feature vectors to be learned are clustered in advance and the feature vectors included in the cluster closest to the attention vector are selected. Alternatively, a method such as a local average distance method in which the distance to the average vector of k neighboring vectors of the attention vector q as an anomalous measure, a Gaussian process, or the like may be used.

In FIG. 7, the server 10 calculates the threshold value H in the threshold value calculation unit 109 of FIG. 3 in step S708 after the abnormality measure calculation processing for all the feature vectors in the loop. This threshold value H is used for determining normality / abnormality of the equipment 101 in comparison with the abnormality measure input to the abnormality detection unit 112. The threshold value calculation unit 109 calculates the threshold value H so as not to determine that the normal learning data is abnormal. In other words, the threshold value calculation unit 109 calculates the maximum value of the abnormality measure obtained from the normal learning data as the threshold value H. Alternatively, the threshold value calculation unit 109 may calculate a threshold value H for determining that the normal learning data is normal more than a predetermined ratio. In this case, the anomaly measure obtained from the normal learning data is sorted, and the anomaly measure that reaches the predetermined ratio described above from the one with the lower anomaly measure is adopted as the threshold value H.

In the learning process of FIG. 7 (abnormality measure calculation process at the time of learning), the server 10 stores the learning result in the learning result storage unit 111 of FIG. The data saved as the training result includes at least parameters for feature vector extraction, parameters for abnormality measurement calculation, parameters for sensor signal normalization, extracted all feature vector data, and abnormality determination. Includes threshold values. The parameters for feature vector extraction and the parameters for anomaly measure calculation are the same as those specified at the time of training. The parameters for sensor signal normalization are the average, standard deviation, maximum value, minimum value, and the like of each sensor signal calculated by the signal input unit 107 in the process of step S702.

[Creation process of first distribution density image]
Next, the details of the process of creating the brute force distribution density image in step S515 of FIG. 5 by the distribution density image creation unit 110 of FIG. 3 will be described. FIG. 9 shows the flow of the brute force distribution density image creation process during learning. First, in step S901, the server 10 inputs the sensor signal for the designated learning period. The server 10 repeats the processes of steps S903 to S906 for each sensor signal in the first loop from step S902.

First, in step S903, the server 10 calculates the maximum value MAX and the minimum value MIN of the data. Next, in step S904, the server 10 calculates the step size S when dividing the range from the minimum value MIN to the maximum value MAX by a designated number N. This can be calculated by S = (MAX-MIN) / N. Next, in step S905, the server 10 expands the range from the minimum value MIN to the maximum value MAX to the outside, and calculates the processing range of the two-dimensional histogram calculation. Here, the expansion of the range includes, for example, changing the minimum value MIN to (MIN-S × M) and the maximum value MAX to (MAX + S × M). M is a predetermined integer of 1 or more.

Next, in step S906, the server 10 calculates the bin number (referred to as BNO) from the sensor signal value (referred to as F) for all the data in the learning period by the following equation 3. However, the following function INT (X) represents the integer part of X. By using the bin number BNO, each sensor signal value F is converted into an integer value in (N + 1) steps from the minimum value 0 to the maximum value N.
Equation 3: BNO = INT (N * (F-MIN) / (MAX-MIN))

Next, the server 10 takes out a combination of two sensors 5 from the plurality of sensors 5 as a pair, and creates a first distribution density image in a roundabout manner based on the combination of the respective sensor signals. That is, in the second loop from step S907, the server 10 repeats the processes of steps S908 to S910 for all the combinations of sensors 5 (all pairs). Here, it is assumed that the combination of the same sensor 5 is included in the combination of the two sensors 5. Therefore, the number of sensor combinations (corresponding number of repetitions) is m × (m + 1) / 2, where m is the number of sensors.

First, in step S908, the server 10 secures a two-dimensional array for calculating the two-dimensional histogram, and sets 0 to all the elements of the array. The size of this array is assumed to be N. In step S909, the server 10 adds 1 to the elements of the array corresponding to the bin number BNO of the two sensor signals in the pair for all the data in the learning period. That is, the server 10 maps the bin number of one sensor signal to a column element and the bin number of the other sensor signal to a row element. By this processing, a two-dimensional histogram of the signal by the two sensors 5 is calculated. In step S910, the server 10 converts this histogram into an image and saves it. This conversion method will be described later. The bin number is a unit for creating a histogram and an image, and is a value classified / converted from a sensor signal value. In this unit, the sensor signal value is used in a broad sense, and the bin number is used as an implementation example.

[Sensor signal and first distribution density image]
FIG. 10 is an explanatory diagram showing the relationship between the time-series sensor signal and the first distribution density image. In FIG. 10, the signals of the two sensors 5 of the sensor X and the sensor Y on the left side are shown with the horizontal axis as the sensor X and the vertical axis as the sensor Y in the distribution density image 1000 on the right side. The distribution density image 1000 is one of the brute force distribution density images, in other words, a two-dimensional histogram. Each pixel value of the distributed density image 1000 is a frequency value of a set of a signal value of the sensor X and a signal value of the sensor Y, and corresponds to a density in a two-dimensional distribution. The frequency value is represented as a pixel value, for example, in gray gradation. Such a distribution density image is created for each combination (corresponding pair) of the sensors 5.

[Image conversion method (S910)]
An example of an image conversion method in creating a distribution density image in step S910 of FIG. 9 will be described. First, the server 10 finds the maximum value of the array elements, that is, the maximum frequency. The image size is the same as the array size, and the pixel value of the corresponding coordinate from the value of each element is, for example, 255 × [element value of the array] / [maximum frequency]. The numerical value 255 is the maximum value when the pixel value is represented by 8 bits, and if this value is used, it can be saved as it is in the bitmap format. Alternatively, the pixel value may be 255 × LOG ([array element value] +1) / LOG ([maximum frequency] +1). However, the function LOG (X) represents the logarithm of X. By using such a conversion formula, it is possible to associate a non-zero pixel value with a non-zero frequency even when the maximum frequency is high.

[Example of first distribution density image]
11 and 12 show an example of a brute force distribution density image (first distribution density image). In this distribution density image, the horizontal axis is the signal value (corresponding bin number) of the sensor A which is one sensor 5, and the vertical axis is the signal value of the sensor B which is the other sensor 5 (corresponding bin number). It is an image taken. The image obtained by the process of FIG. 9 is represented by a high pixel value where the density is high on the two-dimensional feature space. Here, this distribution density image is a gray scale image in which the pixel value 0 is white and 255 is black. In this distribution density image, the pattern such as the shape of the distribution density of the image changes according to the strength of the correlation between the two sensors 5. FIG. 11 is an image example when the correlation is strong, and FIG. 12 is an image example when the correlation is weak. In the image of FIG. 11, the high-density region has a linear shape, whereas in the image of FIG. 12, the high-density region is widely distributed.

The method of creating the distribution density image is not limited to the above method. For example, instead of a simple frequency distribution, a Gaussian distribution or another weighted filter may be assigned to one piece of data and superposed on the data. Alternatively, a method of applying a maximum value filter of a predetermined size to the image obtained by the above method, a method of applying an average filter, or another weighted filter may be used. Further, the method is not limited to 8 bits, and a method of converting to 16 bits or the like may be used. Further, it is not always necessary to save in the image format, and a method of saving in the binary or text format without converting the two-dimensional array may be used.

[Creation process of second distribution density image]
Next, FIG. 13 shows a flow of a second distribution density image creation process (step S516 in FIG. 5) in which the horizontal axis during learning by the distribution density image creation unit 110 in FIG. 3 is the temperature. The process of steps S1302 to S1305 of FIG. 13 is performed in the same manner as the process of steps S903 to S906 of FIG. First, in step S1301, the server 10 inputs the temperature signal for the designated learning period. In step S1302, the server 10 calculates the maximum value MAX and the minimum value MIN of the temperature signal, and in step S1303, the step size when dividing the range from the minimum value MIN to the maximum value MAX by a specified number N. Calculate S. Next, in step S1304, the server 10 expands the range from the minimum value MIN to the maximum value MAX to the outside, and calculates the processing range of the two-dimensional histogram calculation. Next, in step S1305, the server 10 calculates the bin number (BNO) from the sensor signal value (F) for all the data in the learning period. By these processes, the temperature data is converted into an integer value in (N + 1) steps from the minimum value 0 to the maximum value N.

Next, in the loop from step S1306, the server 10 repeats the processes of steps S1307 to S1309 for the first-class sensor signals having a high correlation with the air temperature classified in step S504, and the respective sensor signals and the air temperature are combined. Create a distribution density image based on the combination.

First, in step S1307, the server 10 secures a two-dimensional array for calculating a two-dimensional histogram, and sets 0 to all the elements. The size of the array is N. In step S1308, the server 10 adds 1 to the elements of the array corresponding to the temperature and the bin number of the sensor signal for all the data in the learning period. That is, the temperature bin number corresponds to the column element, and the sensor signal bin number corresponds to the row element. Here, as the bin number of the sensor signal, the one calculated in step S906 of FIG. 9 is used. In step S1309, the server 10 converts the two-dimensional histogram obtained by the above process into an image (second distribution density image) and stores it. This conversion method is the same as in step S910. Finally, in step S1310, the server 10 determines and sets the range of correlation maintenance.

[Example of second distribution density image]
FIG. 14 shows an example of a second distribution density image in which the horizontal axis is air temperature. The vertical axis of the image 1400 is a signal value (corresponding bin number) of the sensor 5 having a high correlation with the air temperature. Therefore, in this image 1400, the normal data represented by the dense gray is distributed on the inclined band. Correlation maintenance means that the data is within the range of the extension of the normal data distribution in the longitudinal direction (in this example, diagonally upward to the right as shown by the arrow in the figure). The range 1401 represented by the broken line rectangle is the range for maintaining the correlation. The server 10 automatically calculates such a correlation maintenance range 1401 based on the second distribution density image whose horizontal axis is air temperature. The method of calculating the correlation maintenance range is, for example, to calculate the central axis from the original data by linear approximation by the least squares method or Hough transform, and to the left and right so that the data of the predetermined ratio is included for all the data. The method of expanding can be applied. Alternatively, a method of rotating the axis within a few degrees, doing the same, and choosing the narrowest one can be applied.

As a modification, the abnormality detection device 1 may allow the user U1 to set the correlation maintenance range for the distribution density image. For example, the user U1 confirms a distribution density image as shown in FIG. 14 displayed on the screen of the client terminal 20, and shifts or enlarges a basic figure such as a rectangle or an ellipse on the image by operating a mouse or the like. Set the correlation maintenance range based on rotation, designation of arbitrary points and lines, etc.

In the processing of FIGS. 9 and 13, the server 10 determines the size of the two-dimensional array, the processing target range and the step size of each sensor signal calculated in steps S904, S905, S1303, and S1304, and the learning result storage unit 111. Record in. Further, the server 10 also records the first distribution density image and the second distribution density image and the correlation maintenance range set in step S1310 in the learning result storage unit 111.

[Abnormality judgment processing when anomaly is detected]
Next, the details of the abnormality determination process 600 at the time of abnormality detection in FIG. 6C will be described with reference to FIGS. 15 to 21. FIG. 15 shows a detailed flow of the abnormality detection process (steps S601 to S604) of FIG. 6 by the abnormality detection unit 112 of FIG. Here, the server 10 extracts the feature vector by the feature vector extraction unit 107 (S602) and measures the abnormality for the data of the specified period or the newly observed data among the data stored in the data storage unit 103. The calculation unit 108 calculates the abnormality measure (S603). Then, the server 10 compares the abnormality measure with the threshold value H by the threshold value calculation unit 109, and determines normality / abnormality by the abnormality detection unit 112 (S604).

In step S1501, the feature vector extraction unit 107 reads out the learning result saved at the time of learning from the DB of the learning result storage unit 111. At that time, the user U1 selects an appropriate processing number based on the abnormality measure and the threshold value at the time of learning, and the server 10 uses the learning result associated with the processing number. In step S1501, the signal input unit 106 inputs the sensor signal 102 from the data storage unit 103 or the equipment 101, and in step S1503, the sensor signal is normalized for each sensor signal. At this time, the parameters used in the normalization process in step S702 in FIG. 7 are used. Next, in step S1504, the feature vector extraction unit 107 extracts a feature vector from the selected sensor signal by the same method as the process of step S703 of FIG.

Next, in the loop from step S1505, the server 10 performs the processes of steps S1506 to S1508 for all the feature vectors. In step S1506, the anomaly measure calculation unit 108 calculates an anomaly measure using the attention vector and the learning data. This process is performed in the same manner as in step S707 of FIG. 7, but all the training data are used. In step S1507, the abnormality detection unit 112 compares the threshold value H read in step S1501 with the abnormality measure calculated in step S1506. The abnormality detection unit 112 determines that the state of the equipment 101 is "normal" when the abnormality measure is equal to or less than the threshold value H, and determines "abnormality" when the abnormality measure is larger than the threshold value H. do. Subsequently, in step S1508, the server 10 calculates the residual vector. The residual vector is the square of each element of the difference vector between the attention vector and the reference vector when calculating the anomaly measure. In the case of the local subspace method of FIG. 8, the attention vector is q, the reference vector is Xb, and the difference vector is (q—Xb). Anomalous measures are defined as the square of the norm of the difference vector (q-Xb). By this definition, the sum of the elements of the residual vector is an anomalous measure. The residual vector will be used in the subsequent seasonal variation removal process.

[Isolation calculation process]
FIG. 16 shows a detailed flow of the isolation degree calculation process (steps S605 to S607) of FIG. 6 by the related sensor identification unit 113 of FIG. Here, the server 10 extracts an abnormality section considered to be continuously detected, calculates an isolation degree vector indicating that the abnormality deviates from the learning data for each abnormality section, and is based on this isolation degree vector. Identify anomaly-related sensors.

In step S1601, the abnormality detection unit 111 inputs the sensor signal to be processed, and in step S1602, the bin number corresponding to each sensor signal is calculated for all the data. At the time of this calculation, the server 10 determines the parameters for creating the distribution density image read in step S1501 of FIG. 15, specifically, the size of the two-dimensional array, the processing target range for each sensor, and the step size. Using the same method as in step S906 of FIG. 9, the bin number is calculated. Next, in step S1603, the abnormality detection unit 111 inputs the calculated abnormality measurement data, and in step S1604, extracts an abnormality section in which the abnormality is continuously detected based on the abnormality measurement data. When calculating this abnormal section, interruptions (no abnormalities are detected) that are less than or equal to the allowable gap of a predetermined length are regarded as continuous abnormal sections. On the contrary, at a predetermined data break such as when the date changes, even if the abnormality detection continues, another abnormality section is set.

Next, in the first loop from step S1605, the server 10 repeats the process of calculating the degree of isolation and specifying the related sensor in steps S1606 to S1613 for each abnormal section. First, in step S1601, the server 10 resets the degree of isolation for all combinations of the two sensors 5 to zero. It is assumed that one sensor of the pair is represented by i and the other sensor of the pair is represented by j. In the second loop from step S1607, the server 10 calculates the degree of isolation (referred to as Ii) for all of the sensors i. In the third loop from step S1608, the server 10 calculates the degree of isolation (referred to as Ij) for all of the sensors j. Each degree of isolation (Ii, Ij) is the degree of isolation in the unit of the single sensor 5 described above.

In each of the second loop and the third loop, the server 10 processes all the data in the abnormal section of interest in the fourth loop from step S1609. In step S1610, the server 10 reads the pixel values (corresponding frequency values) of the coordinates corresponding to the bin numbers of the sensors i and j calculated in step S1602 from the distribution density image of the sensors i and j of the pair of interest. .. In step S1611, when the pixel value is 0, the server 10 adds 1 to the degree of isolation (referred to as Iij) of the sensors i and j of interest. The degree of isolation (Iij) of the sensors i and j is the degree of isolation in the unit of the above-mentioned pair.

By the above processing, the degree of isolation of the abnormal section of interest is calculated for each combination of the two sensors 5. The degree of isolation becomes high when the combination of the signal values of the two corresponding sensors 5 on the two-dimensional histogram is not present in the training data. Here, the fourth loop, the second loop, and the third loop may be in the reverse order.

In step S1612, the server 10 calculates the degree of isolation (Ii, Ij) for each sensor 5 based on the degree of isolation (Iij) of each combination of the two sensors 5. For example, the isolation degree Ii of the sensor i is calculated by fixing the sensor i and summing the isolation degrees (Iij) of the sensors i and j for all the sensors j. The isolation degree Ij of the sensor j is calculated by fixing the sensor j and summing the isolation degrees (Iij) of the sensors i and j for all the sensors i. The server 10 sets the isolation degree (Ii, Ij) of each sensor 5 for all sensors as an isolation degree vector. For example, for the sensors S1 to Sm, the isolation degree vector = {I1, I2, ..., Im}.

Next, in step S1613, the server 10 identifies the anomaly-related sensor based on the isolation degree vector. The abnormality is detected because the evaluation target data deviates from the learning data. For this reason, the server 10 extracts the sensor 5 having a high degree of isolation of the sensor signal at the time when the abnormality is detected as the abnormality-related sensor.

Details of the calculation of the degree of isolation during the above processing (S1610, S1611) and the identification of the abnormality-related sensor (S1613) will be described below.

[Isolation]
FIG. 17 is an explanatory diagram of a more specific isolation degree calculation method. FIG. 17A shows, for example, sensor signals input from three sensors S1 to S3 when an abnormality is detected. The circles are sensor signal values at a certain time. The server 10 calculates an abnormality measure from the feature vector of each sensor signal, and determines and detects the time point when the abnormality measure exceeds the threshold value H (for example, the time indicated by the broken line) as "abnormality". FIG. 17B is a first distribution density image created in advance from the learning data, and the sensor signal value distribution of the learning data is represented by pixel values for all combinations of the two sensors 5. Assuming that the horizontal axis is the signal value of the sensor i and the vertical axis is the signal value of the sensor j, in this example, i = 1 to 3, j = 1 to 3, and 3 × 3 = 9 combinations as shown in the figure. Image {images g11, g12, ..., G33} exists.

The server 10 plots the signal values of the sensors S1 to S3 at the time of abnormality detection obtained in (A) at the corresponding coordinate positions of the corresponding distribution density image in (B). The server 10 reads the pixel value at the plot position, and when the pixel value is 0, sets the isolation degree Iij of the combination of the sensors (i, j) to 1. A cross mark indicates a place where the degree of isolation Iij is 1. For example, in the image G13 with the combination of the sensors (i = 1, j = 3), the pixel value is 0 at the plot position, so that the isolation degree Iij is 1. When the pixel value is other than 0, the server 10 sets the isolation degree Iij to 0 as indicated by a circle. The server 10 calculates the degree of isolation (for example, I1, I2, I3) for each sensor 5 by summing the degree of isolation Iij for which the combination partner is changed for each sensor 5 in this way. For example, the degree of isolation I1 of the sensor S1 is I11 + I12 + I13 = 0 + 0 + 1 = 1. Similarly, the isolation degree I2 of the sensor S2 is 0, and the isolation degree I3 of the sensor S3 is 1. In this example, only the combination of the sensor S1 and the sensor S3 (I13, I31) is isolated, that is, the degree of isolation is 1 (x mark).

[Identification of abnormality-related sensors]
FIG. 18 shows a flow of processing for identifying an abnormality-related sensor based on the degree of isolation. This flow is the first loop from step S1801 and is a repetitive process until a predetermined number of times or a condition is satisfied. First, in step S1802, the server 10 is the sensor corresponding to the sensor 5 having the maximum isolation degree, that is, the sensor corresponding to the maximum element (the one having the maximum isolation degree for each sensor) in the isolation degree vector calculated in step S1612 of FIG. Search for 5. The sensor 5 found as a result of the search, in other words, the sensor with the maximum isolation degree, is referred to as sensor A here.

Next, in step S1803, the server 10 searches for the other sensor 5 having the maximum isolation degree (Iij) in combination with the sensor A. The sensor 5 found as a result of the search is referred to as sensor B here. The search target here is the degree of isolation (Iij) for the combination of the two sensors 5 calculated at the end of the processing of the second loop in step S1607 of FIG. Further, the value of the degree of isolation (Iij) in the combination of the found sensors A and B is taken as ISO here.

In step S1804, the server 10 proceeds to step S1805 when the ISO is larger than 0 (Y), and exits the first loop when the ISO is not (N), that is, when the ISO is 0, and this flow. End the process. In step S1805, the server 10 extracts the sensor A and the sensor B as anomaly-related sensors. Further, in step S1806, the server 10 creates an image in which the abnormality data is plotted on the second distribution density image of each of the sensor A and the sensor B as an abnormality plot image. At that time, the server 10 represents the normal data in gray scale in the image, while the abnormal data is represented by, for example, a highly saturated color (for example, red) so as to be easy to distinguish. Further, the server 10 expresses the pixels that do not overlap with the normal data and the pixels that overlap with each other in different colors.

Next, in the second loop from step S1807, the server 10 repeats the processes of steps S1808 to S1811 for all the sensors i. In step S1808, the server 10 subtracts the isolation degree (IiA) of the combination of the sensors i and A from the isolation degree (Ii) of the sensor i. Further, in step S1809, the server 10 proceeds to step S1810 when the sensor A and the sensor B are different (Y), and omits step S1810 when they are the same (N).

In step S1810, the server 10 also subtracts the isolation degree (IiB) of the combination of the sensors i and B from the isolation degree (Ii) of the sensor i. Further, in step S1811, the server 10 sets the degree of isolation between the sensor A and the sensor B to 0.

The processes of steps S1807 to S1811 are processes performed to remove the influence of the sensors A and B extracted as the abnormality-related sensors in step S1805. After that, the server 10 repeats the first loop in the same manner, and extracts the sensors A and B having the maximum isolation degree from the remaining isolation degree vectors as new abnormality-related sensors. In this way, a plurality of abnormality-related sensors can be extracted without omission.

[Seasonal fluctuation discrimination processing]
FIG. 19 shows a detailed flow of the seasonal variation determination process (steps S608 to S609 in FIG. 6) by the seasonal variation determination unit 114 of FIG. This process is a process of repeating the sensor having a high correlation with the temperature in the first loop from step S1901 and in the second loop from step S1902 for each abnormal section. First, in step S1903, the server 10 acquires a second distribution density image of the temperature on the horizontal axis created in step S1309 of FIG. In step S1904, the server 10 plots the anomaly data on the second distribution density image and creates an anomaly plot image in which the horizontal axis is the temperature. Subsequently, in step S1905, the server 10 determines which of the following three statuses is based on the correlation state. Specifically, when the abnormal data is included in the normal data distribution, the server 10 determines that the status is "no abnormality". If the abnormal data is outside the normal data distribution and is included within the correlation maintenance range set in step S1310, the server 10 determines that the status is "seasonal variation". If the abnormal data is out of the correlation maintenance range, the server 10 determines that the status is "abnormal". The "seasonal variation" status indicates that the abnormality is due to seasonal variation.

In the example of FIG. 14, in the image 1400, the point A is included in the normal data distribution shown in gray, so that the status is "no abnormality". Point B is outside the correlation maintenance range 1401 and is therefore given an "abnormal" status. Since the point C is included in the region other than the normal data distribution in the correlation maintenance range 1401, it is regarded as the “seasonal variation” status. The server 10 includes the presence / absence of an abnormality (“normal” / “abnormal”) determined by the abnormality detection unit 112 of FIG. 3 regarding the state of the equipment 101 due to the combination of a plurality of sensor signals, and further includes the “seasonal variation” status 3. Determine to one status.

[Seasonal fluctuation removal processing]
20 and 21 show a detailed flow of the seasonal variation removing process (step S610 of FIG. 6) by the seasonal variation removing unit 115 of FIG. This process is the first loop from step S2001, and is a process of repeating the calculation of the degree of isolation from which the influence of the seasonal fluctuation is removed, the identification of the abnormality-related sensor, the calculation of the abnormality measure, and the abnormality determination for each abnormality section. When the server 10 creates the detection result from which the influence of the seasonal fluctuation is removed, the server 10 creates the detection result from which the data value corresponding to the "seasonal fluctuation" status is removed.

In step S2002, the server 10 isolates all combinations of the two sensors 5 created by the end of the second loop of step S1607 of FIG. 16 for calculating the degree of isolation from which the effects of seasonal variation are removed. Obtain the degree (Ii, Ij). In the second loop from step S2003, the server 10 repeats the processes of steps S2004 to S2008 for all the sensors i. First, in step S2004, the server 10 sets the degree of isolation of the sensor i to 0. Next, in step S2005, the server 10 determines that the sensor i is not determined to have a "seasonal variation" status in step S1905 of FIG. 19 (Y), that is, "no abnormality" or "abnormality". In the case, the process proceeds to step S2006, and if it is determined (N), the process proceeds to the end of the second loop. In the third loop from step S2006, the server 10 processes all the sensors j. In step S2007, the server 10 proceeds to step S2008 if the sensor j has not been determined to have a "seasonal variation" status in step S1905 of FIG. 19 (Y), and if it has been determined (N), step S2008. Omit. In step S2008, the server 10 adds the isolation degree (Iij) of the combination of the sensors (i, j) to the isolation degree (Ii) of the sensor i. After that, the second loop and the third loop end. After calculating the degree of isolation of all the sensors 5, in step S2009, the server 10 identifies the abnormality-related sensor by the flow of FIG.

In the process of step S2008 or the like, the server 10 performs an overwrite update process with respect to the degree of isolation. This provides a degree of isolation with the effects of seasonal fluctuations removed. The degree of isolation before removing the effect has been erased. It is possible not only in such a processing example. That is, the server 10 may calculate and store and output both the degree of isolation before removing the influence of seasonal fluctuation and the degree of isolation after removing the influence of seasonal fluctuation. Similarly, with respect to the anomaly measure and the like, the values before and after removing the influence of the seasonal fluctuation may be stored or output.

21 is a continuation of FIG. 20. In the fourth loop from step S2010, the server 10 repeats the processes of steps S2011 to S2016 for all the data in the section in order to calculate the anomaly measure excluding the influence of seasonal fluctuations. In step S2011, the server 10 sets the anomaly measure to 0. In the fifth loop from step S2012, the server 10 processes all the sensors i. In step S2013, the server 10 proceeds to step S2014 if the sensor i has not been determined to have a "seasonal variation" status in step S1905 of FIG. 19 (Y), and if it has been determined (N), step S2014. Omit. In step S2014, the server 10 adds the residual calculated in step S1508 of FIG. 15 to the anomaly measure. After that, the fifth loop ends.

In step S2015, the server 10 steps (Y) if the isolation degrees calculated after the end of the second loop of step S2003 in FIG. 20 are all 0 or the anomaly measure is less than or equal to the threshold value (Y). The process proceeds to S2016, and if not (N), step S2016 is omitted. In step S2016, the server 10 changes the determination state to the "no abnormality" status. After that, the fourth loop and the first loop are terminated, and this flow is terminated. By the above processing, the server 10 can output the result of removing the influence of the seasonal fluctuation.

[GUI (1)]
Next, a configuration example of a user interface, particularly a graphical user interface (GUI), provided in the abnormality detection device 1 in connection with the above processing / operation will be described. The user U1 (FIG. 1) of the abnormality detection device 1 browses and operates each screen displayed on the client terminal 20 based on the data provided from the server 10. For example, a screen made of a Web page is configured by using GUI elements such as windows, buttons, scroll bars, and list boxes.

FIG. 22 shows a screen 2201 which is an offline analysis condition setting screen as a first screen example. The screen 2201 has a GUI for setting a learning period for performing offline analysis and analysis conditions including processing parameters. The offline analysis is an analysis (including a series of processes as shown in FIG. 3) according to a user's instruction at an arbitrary timing. On this screen, the calculated learning result can also be registered as a recipe for offline analysis conditions. It is assumed that the past sensor signal 102 is stored in the DB of the data storage unit 103 in association with the equipment ID and the time.

On this screen 2201, the target equipment, learning period, evaluation period, abnormality measure calculation parameters, and the like can be input. In the equipment ID field 2202, the ID of the target equipment 101 is input. By pressing the equipment list display button 2203, the equipment ID list is displayed based on the data stored in the data storage unit 103 of FIG. User U1 can select and input the equipment ID from the list. When only one equipment 101 is connected to the abnormality detection device 1, it is not necessary to display the equipment ID column 2202. In the learning period column 2204, the start date and the end date of the learning period, which is the period for which the learning data is to be extracted, can be input. In the evaluation period column 2205, the start date and end date of the evaluation period, which is the period to be analyzed for abnormality detection, can be input. In the sensor selection field 2206, a sensor (corresponding sensor ID) used for processing can be input. By pressing the list display button 2207, the sensor list 2208 is displayed. In the sensor list 2208, information of a plurality of sensors 5 associated with the equipment 101 is displayed as a candidate. User U1 can select and input one or more sensors from the list. In the sensor selection field 2206, it may be possible to specify a sensor to be excluded. At the time of inputting the sensor signal 102 of FIG. 3, only the information of the sensor selected here is input.

In the sensor classification parameter field 2209, the reference value used in step S504 of FIG. 5 can be input. In this example, this reference value is the threshold value of the correlation value. The sensor 5 whose correlation value exceeds this reference value is classified as a first-class sensor having a high correlation with the air temperature. In the anomaly measure calculation parameter field 2210, parameters used in the calculation of the anomaly measure can be input. This example is an example when the local subspace method is adopted, and the number of neighborhood vectors and the regularization parameter can be input. The regularization parameter is a small number to be added to the diagonal component in order to prevent the inverse matrix of the correlation matrix C from being calculated in Equation 2.

In the distribution density image creation parameter field 2211 (in other words, the two-dimensional histogram calculation parameter field), information on, for example, an image size and a size corresponding to a normal range thereof can be input as parameters used in creating a distribution density image. In the abnormality section extraction parameter column 2212, the maximum length of the interruption period (in other words, the allowable gap) in which the abnormality detection is considered to be continuous in the extraction of the abnormality section can be input.

After inputting and confirming the offline analysis condition information as described above, the user U1 can instruct the abnormality detection device 1 to execute the offline analysis under the offline analysis conditions by the execution button 2214. According to the execution instruction, the abnormality detection device 1 first classifies the sensors according to FIG. 5 using the temperature and the sensor signal during the learning period. Subsequently, the abnormality detection device 1 executes learning according to FIGS. 7, 9, and 13.

As a result of learning, the abnormality detection device 1 stores the following data / information in the learning result storage unit 111.
-Average and standard deviation for each sensor signal calculated in step S702-Data of all feature vectors of the learning period extracted in step S703-Threshold calculated in step S708-Calculated in steps S904 and S905 Processed range and step size of each sensor signal created ・ Round-robin distribution density image created in step S910 ・ Processed range and step size of temperature data calculated in steps S1303 and S1304 ・ Created in step S1309 The horizontal axis is the temperature distribution density image.-The correlation maintenance range set in step S1310.

Further, the abnormality detection device 1 calculates an abnormality measure according to FIG. 15 using the sensor signals of the learning period and the evaluation period, determines normality / abnormality, and combines the determination result with the abnormality measure and the threshold value. And save it. However, with respect to the data of the learning period, it is determined whether it is normal or abnormal by using the abnormality measure calculated in step S707 of FIG.

Next, the abnormality detection device 1 extracts an abnormality section according to FIG. 16, calculates the degree of isolation for each abnormality section, and identifies the abnormality-related sensor. The anomaly detection device 1 saves the start time, end time, isolation degree, identified related sensor name, and anomaly plot image of each anomaly section for display.

Next, according to FIG. 19, the abnormality detection device 1 determines whether the status of each sensor having a high correlation with the temperature is normal, seasonal variation, or abnormal, for each abnormality section. The abnormality detection device 1 stores, as the processing result, the abnormality plot image of the temperature whose horizontal axis is the temperature created in step S1904, and the discrimination result of step S1905.

Further, the abnormality detection device 1 calculates the degree of isolation excluding the influence of seasonal fluctuations, identifies the abnormality-related sensor, calculates the abnormality measure, and determines abnormality / normality for each abnormality section according to FIGS. 20 and 21. conduct.

The abnormality detection device 1 displays a result display screen, which will be described later, after the offline analysis as described above is completed. After the confirmation on the result display screen by the user U1 is completed, the process returns to the offline analysis condition setting screen of FIG. In the recipe name field 2213 on the screen 2201, an offline analysis condition composed of the learning result, the analysis result, and the input information as described above can be set as a recipe. User U1 can enter a recipe name in the recipe name field 2213 and register / update it as a recipe by pressing the registration button 2215. The abnormality detection device 1 stores the learning result, the offline analysis condition based on the analysis result, etc. in the learning result storage unit 111 in association with the equipment ID and the recipe name. In addition to the data created and saved by the learning execution, the above learning results (corresponding offline analysis conditions) include sensor classification parameters, anomaly measure calculation parameters, distribution density image creation parameters, and anomalies entered in each of the above fields. Includes interval extraction parameters.

The abnormality detection device 1 terminates this screen in response to the end button 2216. At the end of this, if there is learning result and analysis result data, those data are deleted, or the remaining data is overwritten by the next learning / analysis executed.

The learning result (recipe of the corresponding offline analysis condition) registered on the screen 2201 is managed with a label of active or inactive. The user U1 can set a label for each of the plurality of learning results (recipe of the corresponding offline analysis condition). The offline analysis condition with the activity label is also applied as an online analysis condition in the online analysis.

After the recipe is registered as described above, online analysis is automatically executed for the specified evaluation period. In the online analysis, the abnormality detection device 1 uses the online analysis condition information such as the learning result of the activity in which the equipment ID matches the newly input data such as the sensor signal 102, and uses the online analysis condition information, FIGS. 15, 16, and 19. , FIG. 20, FIG. 21 and the like are performed. The abnormality detection device 1 stores the processing result in the learning result storage unit 111 in association with the recipe name, the processing date and time, and the like. These online analysis processes are executed every day for a preset period or date and time, for example, on a regular basis, according to the target equipment 101 or the like. For the equipment 101 having a short sampling interval and the equipment 101 requiring real-time performance, the interval for executing the online analysis can be set to an interval shorter than one day (for example, one hour).

[GUI (2)]
FIG. 23 shows a screen 2301 for designating a display target of the online analysis result as a second screen example. The user U1 can specify the equipment 101 to be displayed, the recipe, and the period on this screen 2301. First, the user U1 selects the equipment ID in the equipment ID selection field 2302. Next, the user U1 selects the recipe to be displayed from the list of recipes targeting the equipment ID in the equipment ID selection field 2302 in the recipe name selection field 2303.

In the data recording period column 2304, the start date and the end date of the data recording period, which is the period in which the input recipe is processed and the recording is left, are displayed. In the result display period column 2305, the start date and end date of the result display period, which is the period for which the online analysis result is to be displayed, can be specified and input. According to the display button 2306, the detection result of the abnormality detection process in the online analysis is displayed according to the display target designation on the screen 2301. The screen 2301 ends according to the end button 2307.

[GUI (3-1)]
FIGS. 24 to 27 show examples of screens displaying analysis results (offline or online detection results) by the abnormality detection device 1. The screens of FIGS. 24 to 27 have a plurality of tabs at the top. Depending on the tab selection by the user U1, the screen is switched to any of the screens as shown in FIGS. 24 to 27 associated with each tab and displayed. FIG. 24 shows the sensor classification result display screen 2400, FIG. 25 shows the abnormality detection result overall display screen 2500, FIG. 26 shows the abnormality detection result enlarged display screen 2600, and FIG. 27 shows the related sensor specific result display screen 2700.

On the sensor classification result display screen 2400 of FIG. 24, the temperature signal data, the time series graph of the first-class sensor having a high correlation with the air temperature, and the second distribution density image in which the horizontal axis is the air temperature are displayed. When displaying the offline analysis result, the learning period and the evaluation period specified in FIG. 22 are displayed in the period display field 2401. When displaying the online analysis result, the learning period and the evaluation period corresponding to the recipe are displayed in the period display field 2401. In this example, the study period is 3 months from January 1, 2009 to March 31, 2009. The evaluation period is 8 months from April 1, 2009 to November 30, 2009.

In the air temperature display column 2402, the air temperature data 2402a of the learning period and the evaluation period is displayed as a time series graph. In the first sensor signal display column 2403, a time series graph of the sensor signal 2403a having the highest correlation with the air temperature and a distribution density image 2403b with the sensor signal as the vertical axis and the temperature as the horizontal axis are displayed. Similar information (2404a, 2404b) is displayed in the second sensor signal display column 2404 for the sensor having the second highest correlation with the air temperature. Similar information (2405a, 2405b) is displayed in the third sensor signal display column 2405 for the sensor having the third highest correlation with the air temperature. In this example, among the sensors 5 (sensors 00, 01, ..., 15) of a plurality (m = 16) of a certain facility 101, "sensor 15", "sensor 11", "sensor 11", "sensor 15", "sensor 11", "sensor 15", "sensor 11", "sensor 15", "sensor 11", "sensor 15", "sensor 11", "sensor 15" Sensor 02 ". In this example, the number of sensor signal display columns is 3, but the number is not limited to this, and this number is the same as the number classified as a sensor having a high correlation with temperature, and this number depends on the data and the reference value. The display of the column changes automatically.

The date bar 2406 displays the date corresponding to the time on the horizontal axis of the time series graph. When the period cannot be displayed on the screen due to a long period, the period to be displayed by the user U1 can be selected by the scroll bar or the like. This screen ends according to the end button 2407. As a modification, the sensor classification screen 2400 may also display the order of correlation with the temperature and the correlation value for the information (2403 to 2405) of a plurality of sensor signals.

[GUI (3-2)]
On the abnormality detection result overall display screen 2500 of FIG. 25, an abnormality measure, a threshold value, a determination result, and a time series graph of a sensor signal in a designated period are displayed. In the period display column 2501, the learning period and the evaluation period specified in FIG. 22 are displayed when displaying the offline analysis result, and the result display period specified in FIG. 23 is displayed when displaying the online analysis result. Is displayed. In the display content column 2502, in column 2502a, whether the analysis result being displayed is before or after seasonal variation removal is displayed. Before removal corresponds to step S607 in FIG. After removal corresponds to after performing the processing up to step S610.

Column 2502a is initially "before seasonal fluctuation removal". That is, on the abnormality detection result overall display screen 2500 at this time, the data before the seasonal variation is removed is displayed. With the switching button 2502b, the display content of the column 2502a can be switched to "before seasonal fluctuation removal". Along with the switching, the data after removing the seasonal variation is displayed on the abnormality detection result overall display screen 2500. This switching is also reflected in the abnormality detection result enlarged display screen 2600 and the related sensor specific result display screen 2700 of other tabs. Although not shown, in the data display on the screen after removing the seasonal fluctuation, the data part corresponding to the "seasonal fluctuation" status is removed, and the abnormality measure 2504a, the judgment result 2504c, and the graph value and shape of each sensor signal are removed. However, it will be different from the one before removal.

In the anomaly measure column 2504, a time series graph of the anomaly measure 2504a in a designated period (learning period / evaluation period or result display period), a threshold value 2504b, and a determination result 2504c are displayed. The determination result 2504c is displayed as a binary line at each time point, for example, with "no abnormality" as a value 0 and "with an abnormality" as a value 1 (for example, red).

In the first sensor signal column 2505, a graph of the time-series sensor signal 2505b in the specified period is displayed for the sensor 5 designated in the sensor column 2505a. Similarly, in the second sensor signal column 2506 and the third sensor signal column 2507, information about the designated sensor is displayed. The user U1 can specify an arbitrary sensor 5 and display information. In this example, the information of "sensor 11" is displayed in the first sensor signal column 2505, the information of "sensor 00" is displayed in the second sensor signal column 2506, and the information of "sensor 15" is displayed in the third sensor signal column 2507. .. In this example, the number of sensor signal columns is set to 3, but the display is not limited to this. The date bar 2508 displays the date corresponding to the time on the horizontal axis of the time series graph. The cursor 2509 is a time designation button, represents a starting point at the time of enlarged display described later, and can be moved by an operation of a mouse or the like by the user U1. In the display day number designation field 2510, the number of days from the start point to the end point of the enlarged display on the analysis result enlarged display screen 2600 is displayed as the number of display days, and can be input / specified in this field as well. In the date display field 2511, the date and the date and time at the position of the cursor 2509 are displayed. The screen ends according to the end button.

By looking at the above screen, the user U1 compares the graph (2504) of the determination result or detection result of the abnormality measure, the threshold value, and the equipment state with the graph of the first-class sensor signal having a high correlation with the temperature. You can check the details at. The following is also possible as a modification. On a screen like the one above, the information before and after the removal of seasonal fluctuations may be displayed in parallel so that they can be compared. For example, the same type of information is displayed side by side in the vertical or horizontal direction with the units aligned. The user U1 can easily confirm the information before and after the removal by the above switching and the parallel display.

[GUI (3-3)]
In the abnormality detection result enlarged display screen 2600 of FIG. 26, the abnormality measurement and the threshold value in the period of the display days specified in the display days designation field 2510 starting from the date specified by the cursor 2509 of the abnormality detection result overall display screen 2500. A time series graph of values, determination results, and sensor signals is displayed. That is, in the anomaly measure column 2604 and the sensor signal column 2605 to 2607, the same information as in FIG. 25 is enlarged and displayed in the designated period. In the date bar 2608, for example, the number of display days is two days, and June 22nd and 23rd are displayed. On the abnormality detection result enlarged display screen 2600, the scroll bar 2611 and the scroll bar area 2612 are additionally displayed. The total length of the scroll bar area 2612 is a length corresponding to the display period on the abnormality detection result overall display screen 2500. The length of the scroll bar 2611 is set to be the length corresponding to the number of days specified in the display day number designation field 2510. The left end of the scroll bar 2611 corresponds to the start point of the enlarged display, and the right end corresponds to the end point of the enlarged display. User U1 can change the starting point of the enlarged display by operating the scroll bar 2611. This change is also reflected in the position of the cursor 2509 and the display of the date display field 2511 on the abnormality detection result overall display screen 2500.

[GUI (3-4)]
On the related sensor identification result display screen 2700 of FIG. 27, the anomaly measure, the threshold value, and the determination result for the specified period, the anomaly-related sensor identification result for the selected anomaly section, and the seasonal variation determination result are displayed. To. The related sensor identification result display screen 2700 has an abnormal section number column 2701, a related sensor identification column 2702, and a seasonal variation determination result column 2706.

The period display column 2501, the display content column 2502, and the abnormality measurement column 2503 are the same as the display on the abnormality detection result overall display screen 2500. Also on this screen, it is possible to switch between before and after removing seasonal fluctuations by using the switching button, and the switching is reflected on the screens of other tabs.

In the abnormal section number column 2701, a number indicating the selected abnormal section and the date and time of the abnormal section are displayed. Initially, the first anomalous interval of the date indicated by the cursor 2509 on the date bar is selected and displayed. If there is no abnormal section on that date, it will be blank and neither the related sensor identification result nor the seasonal fluctuation determination result will be displayed. User U1 can select the previous or next abnormal section by the arrow button in the abnormal section number column 2701. If blank, the nearest anomalous interval before or after the date indicated by cursor 2509 is selected and displayed. In addition, the user U1 can directly input and specify the abnormal section number. The position of the cursor 2509 is changed to the date of the selected abnormal section. This change will be reflected on the screens of other tabs.

The related sensor identification column 2702 has an isolation degree column 2703 and an anomaly plot image column 2704. In the isolation degree column 2703, the isolation degree in the selected abnormal section is displayed. The horizontal axis of the graph in this column is each sensor name, sensor ID (for example, sensors 00, 01, ..., 15) of the plurality of sensors 5, and the vertical axis is the degree of isolation for each sensor 5. This degree of isolation is calculated in FIG. 16 when the display in the display content column 2502 is "before removal of seasonal fluctuations" and in FIG. 20 when the display in the display content column 2502 is "after removal of seasonal fluctuations". The degree of isolation is displayed.

In the anomaly plot image column 2704, for example, anomaly plot images 2704a, 2704b, 2704c are displayed as anomalous plot images in the selected anomalous section. As the anomaly plot image, the anomaly plot image created in step S1613 of FIG. 16 is displayed when it is “before seasonal variation removal”, and in step S2009 of FIG. 20 when it is “after seasonal variation removal”. .. In this example, these anomalous plot images are images in which anomalous data values are plotted on a first distribution density image of a combination of two sensors 5. Further, the plurality of abnormal plot images are displayed, for example, from left to right in the order created in step S1806 in the first loop of step S1801 in FIG. The number of anomalous plot images varies from interval to interval. If a plurality of images cannot be displayed on the screen, the displayed abnormal plot image can be moved to the left or right by operating the arrow buttons or the like in the abnormal plot image field 2704.

In the seasonal variation determination result column 2706, for the selected anomalous section, anomalous plot images in which the temperature is on the horizontal axis, for example, anomalous plot images 2706a, 2706b, 2706c, which are created in step S1904 of FIG. 19, are displayed. In this anomalous plot image, an image showing the correlation maintenance range may be superimposed and displayed as in FIG. 14 described above. At the same time, "seasonal variation", "abnormality", etc. are displayed as the status 2708 of the determination result of step S1905 in FIG. 19 in each abnormality plot image. The number and order of the display of the plurality of abnormal plot images in the seasonal variation determination result column 2706 are unified, for example, in the order of high correlation with the temperature, as in the display of the data of the plurality of sensor signals in FIG. .. By looking at such an abnormality plot image, the user U1 can easily confirm the sensor signal, the abnormality data value, the discrimination result status, etc., which have a high correlation with the air temperature. Further, the user U1 can confirm the details of the detection result before and after the seasonal variation removal by also viewing the display of the related sensor identification column 2702 (2703, 2704).

[Example of abnormal plot image]
FIG. 28 shows an example of anomalous plot images. The user U1 can also select an abnormal plot image on a screen as shown in FIG. 27 and display it in detail on the screen for confirmation. (A) is an abnormal plot image 2701a, (B) is an abnormal plot image 2701b, and (C) is a detailed display of the abnormal plot image 2701c. In the abnormal plot image 2701a of (A), the portion 2801 shown by the broken line frame corresponds to the normal data having a high distribution density and is displayed in gray. The portion 2802 is displayed in red. This portion 2802 is an example of data in the correlation maintenance range 2803 and the correlation is maintained, similar to the point C in the correlation maintenance range 1401 in FIG. Therefore, this data is determined to have a "seasonal variation" status.

In the abnormal plot image 2701b of (B), the portion 2811 corresponds to the normal data and is displayed in gray. The portion 2812 is displayed in red. This portion 2812 is an example of data in which the portion 2811 is separated from the portion 2811 and has a portion outside the corresponding correlation maintenance range 2813, and the correlation is not maintained. Therefore, this data is determined to be "abnormal" rather than "seasonal variation". In the abnormal plot image 2701c of (C), the portion 2821 corresponds to the normal data and is displayed in gray. The portion 2822 is displayed in red. This portion 2822 is an example of data in which the correlation is not maintained, having a portion that is separated from the portion 2821 and goes out of the corresponding correlation maintenance range 2823. Therefore, this data is determined to be "abnormal" rather than "seasonal variation".

[Effects, etc.]
As described above, according to the abnormality detection device or the like of the first embodiment, when an abnormality is detected based on a plurality of time-series sensor signals output by the equipment 101, an abnormality is determined and detected in consideration of seasonal fluctuations. Error can be reduced. Further, according to the first embodiment, it is not necessary to extend the learning period to one year or more, and it is possible to automatically discriminate between abnormalities caused by seasonal fluctuations and abnormalities not due to seasonal fluctuations in the equipment 101, and seasonal fluctuations. It is possible to output the result of reducing / removing the influence of.

According to the first embodiment, since the sensor 5 is classified based on the correlation with the temperature, it is possible to know the sensor 5 affected by the seasonal fluctuation even if the learning period is less than one year. According to the first embodiment, it is examined whether or not the correlation between the sensors 5 and the temperature is maintained. As a result, in the first embodiment, the presence / absence of abnormality (normal / abnormal) is further determined as "seasonal variation" and the presence / absence of abnormality not caused by seasonal variation ("no abnormality" / "abnormal"). can. According to the first embodiment, as a result of seasonal fluctuation determination, an abnormality plot image in which the horizontal axis is the temperature can be displayed on the screen, and whether or not the correlation with the temperature is maintained and whether or not the abnormality is caused by the seasonal fluctuation. It is easy for user U1 to confirm and understand such things. According to the first embodiment, since each detection result before and after the removal of the seasonal fluctuation can be displayed on the screen, the user U1 can confirm whether or not the influence of the seasonal fluctuation is present, and after the removal, a factor other than the seasonal fluctuation can be confirmed. It is possible to grasp the abnormal phenomenon caused by.

In the above, an example of using temperature as a parameter (seasonal fluctuation value) that fluctuates depending on the season has been described. In addition, parameters such as precipitation, wind direction / speed, solar radiation, atmospheric pressure, and humidity are also parameters that change depending on the season. It is also possible to replace the air temperature in the first embodiment with any of these seasonal fluctuation values. Further, it is also possible to perform the same processing by inputting a plurality of seasonal fluctuation values to perform seasonal fluctuation discrimination, seasonal fluctuation removal, and the like.

Further, as shown in FIG. 1, a dedicated sensor (for example, a temperature sensor 6) may be installed near the equipment 101 to acquire data on the temperature or other seasonal fluctuation values, but the present invention is not limited to this. be. The abnormality detection device 1 (for example, the server 10) periodically downloads and acquires the temperature and seasonal fluctuation value data of each place from the outside of the equipment 101, for example, the homepage (Web service) of the Meteorological Agency on the communication network 9. It may be stored in the DB.

Although the present invention has been specifically described above based on the embodiments, the present invention is not limited to the above embodiments and can be variously modified without departing from the gist thereof.

1 ... Abnormality detection device, 5 ... Sensor, 9 ... Communication network, 10 ... Server, 20 ... Client terminal, 50 ... Communication device, 101 ... Equipment, 102 ... Sensor signal, 103 ... Data storage unit, 104 ... Temperature signal, 105 ... Sensor classification unit, 106 ... Signal input unit, 107 ... Feature vector extraction unit, 108 ... Abnormality measurement calculation unit, 109 ... Threshold calculation unit, 110 ... Distribution density image creation unit, 111 ... Learning result storage unit, 112 ... Abnormality detection unit, 113 ... Related sensor identification unit, 114 ... Seasonal fluctuation determination unit, 115 ... Seasonal fluctuation removal unit, 116 ... Detection result output unit, 150 ... Communication signal, 160 ... Detection result, U1 ... User.

Claims (10)

Input multiple sensor signals from multiple sensors installed in equipment in the environment
Input the signal of the seasonal fluctuation value by the temperature in the environment or the parameter other than the temperature, and input the signal.
The plurality of sensor signals are classified into a type 1 sensor signal having a high correlation with the seasonal fluctuation value and a type 2 sensor signal having a low correlation with the seasonal fluctuation value.
The feature vector for each time is extracted from the plurality of sensor signals, and the feature vector is extracted.
Based on the feature vector for each time, the anomaly measure for each time is calculated using the feature vector in the specified learning period as learning data.
By comparing the abnormality measure with the threshold value, it is determined whether the state of the equipment represented by the plurality of sensor signals at each time is normal or abnormal.
Using the type 1 sensor signal, it is determined whether or not the determined abnormality is caused by seasonal fluctuation.
When it is determined that the cause is due to the seasonal fluctuation, a detection result in which the influence of the seasonal fluctuation is removed from the state of the equipment is created and output.
Anomaly detection device. In the abnormality detection device according to claim 1,
Regarding the determined abnormality, the two-dimensional frequency distribution in the relationship between the seasonal variation value and the type 1 sensor signal is investigated, and the seasonal variation value and the type 1 type 1 are based on the normal distribution region at the time of learning. The correlation maintenance range in which the correlation with the sensor signal is maintained is calculated, and if the data value of the frequency distribution is included in the normal distribution region within the correlation maintenance range, it is determined as "no abnormality" status. However, if it is within the correlation maintenance range and outside the normal distribution region, it is determined to be in the "seasonal fluctuation" status, and if it is outside the correlation maintenance range, it is determined to be in the "abnormal" status.
Anomaly detection device. In the abnormality detection device according to claim 2,
For the determined abnormality, a distribution density image showing a two-dimensional frequency distribution in the relationship between the seasonal fluctuation value and the type 1 sensor signal is created, and the data determined to be the abnormality on the distribution density image. Create an anomalous plot image plotting the values and
Display the abnormal plot image on the screen.
Anomaly detection device. In the abnormality detection device according to claim 2,
When creating the detection result by removing the influence of the seasonal fluctuation, the detection result by removing the data value corresponding to the "seasonal fluctuation" status is created.
Anomaly detection device. In the abnormality detection device according to claim 1,
The data before removing the influence of the seasonal fluctuation and the data after removing the influence of the seasonal fluctuation are displayed on the screen according to the switching operation or displayed in parallel.
Anomaly detection device. In the abnormality detection device according to claim 1,
For each combination of the two sensors in the plurality of sensors, a first distribution density image showing a two-dimensional frequency distribution in the relationship between the two sensors was created.
For each of the first distribution density images, the degree of isolation in the combination of the two sensors was calculated.
Based on the degree of isolation in the combination of the two sensors, the degree of isolation for each sensor is calculated.
Based on the degree of isolation of each sensor, the sensor highly related to the abnormality is identified.
Information on the sensor that is highly related to the abnormality is displayed on the screen.
Anomaly detection device. In the abnormality detection device according to claim 1,
A graph of the determination result or detection result of the abnormality measure, the threshold value, and the state of the equipment, and a graph of the type 1 sensor signal are displayed on the screen.
Anomaly detection device. In the abnormality detection device according to claim 1,
The seasonal variation value is at least one of temperature, precipitation, wind direction / velocity, solar radiation, atmospheric pressure, and humidity.
Anomaly detection device. In the abnormality detection device according to claim 1,
The study period shall be at least one week and less than one year.
Anomaly detection device. It is an abnormality detection method in an abnormality detection device.
As a step executed by the abnormality detection device,
Steps to input multiple sensor signals from multiple sensors installed in equipment in the environment,
The step of inputting a signal of a seasonal fluctuation value due to the temperature in the environment or a parameter other than the temperature, and
A step of classifying the plurality of sensor signals into a type 1 sensor signal having a high correlation with the seasonal fluctuation value and a type 2 sensor signal having a low correlation with the seasonal fluctuation value.
A step of extracting a feature vector for each time from the plurality of sensor signals, and
Based on the feature vector for each time, the step of calculating the anomaly measure for each time using the feature vector in the specified learning period as learning data, and
A step of determining whether the state of the equipment represented by the plurality of sensor signals at each time is normal or abnormal by comparing the abnormality measure with a threshold value.
Using the type 1 sensor signal, a step of determining whether or not the determined abnormality is due to seasonal variation, and
When it is determined that the cause is due to the seasonal fluctuation, the step of creating and outputting the detection result by removing the influence of the seasonal fluctuation from the state of the equipment, and
Anomaly detection method.

Images