JP2022084435A - Abnormality detection system, abnormality detection method, and program - Google Patents

Abstract

To provide an abnormality detection system that highly precisely detects an abnormality.SOLUTION: A prediction system includes a data acquisition unit that acquires work data of an object-of-monitoring apparatus, a score calculation unit that uses different methods to calculate plural probabilities, at which a first parameter value that is a measurement value of an object of monitoring contained in the work data is observed, and calculates a score representing a degree of an abnormality for each of the plural probabilities, and an abnormality detection unit that determines on the basis of the plural scores and a determination model whether an abnormality is found in each of the plural scores, and detects an abnormality in the apparatus on the basis of results of the plural determinations.SELECTED DRAWING: Figure 1

Description

The present disclosure relates to anomaly detection systems, anomaly detection methods and programs.

A system for detecting abnormalities in machines and equipment such as plants and factories has been proposed. For example, in Patent Document 1, operation data of equipment to be monitored is collected in the learning phase, an abnormality detection model is constructed from the operation data, and in the monitoring phase, individual operation data is obtained from the operation data and the abnormality detection model. There is disclosed an anomaly detection system that calculates an anomaly score and determines that an anomaly has occurred when the anomaly score exceeds the threshold value.

Japanese Unexamined Patent Publication No. 2020-8997

In the case of an abnormality detection method that calculates an abnormality score for one monitoring item such as temperature and pressure included in the operation data and determines the abnormality score by a threshold value, it is possible to detect an abnormality that can be judged by the instantaneous value of the monitoring item. can. However, for example, depending on the operating state of the equipment, the value of the monitoring item may exceed the threshold value even if no abnormality has occurred, and the abnormality of one monitoring item is determined by paying attention to only one abnormality score. If so, the accuracy of abnormality detection may decrease.

The present disclosure provides an abnormality detection system, an abnormality detection method and a program capable of solving the above problems.

In the abnormality detection system of the present disclosure, the probability that the data acquisition unit that acquires the operation data of the device to be monitored and the value of the first parameter, which is the measured value of the monitoring target included in the operation data, are observed. Based on a score calculation unit that calculates a plurality of types using different methods and calculates a score indicating the degree of abnormality for each of the plurality of types of probabilities, a plurality of the scores, and a determination model. It is provided with an abnormality detection unit for determining whether or not each of the above scores is abnormal and detecting an abnormality in the apparatus based on the results of the plurality of determinations.

In the abnormality detection method of the present disclosure, the abnormality detection system acquires the operation data of the device to be monitored, and the value is observed for the value of the first parameter which is the measured value of the monitoring target included in the operation data. A plurality of types of probabilities are calculated using different methods, a score indicating the degree of abnormality is calculated for each of the plurality of types of probabilities, and the plurality of said scores are calculated based on the plurality of said scores and a determination model. It is determined whether or not each of them is abnormal, and the abnormality of the apparatus is detected based on the results of the plurality of determinations.

The program of the present disclosure acquires the operation data of the device to be monitored by a computer, and differs in the probability that the value is observed for the value of the first parameter which is the measured value of the monitoring target included in the operation data. Multiple types are calculated using the method, a score indicating the degree of abnormality is calculated for each of the plurality of types of probabilities, and based on the plurality of the scores and the determination model, is the score abnormal for each of the plurality of types? It is determined whether or not the device is present, and based on the results of the plurality of determinations, a process for detecting an abnormality in the apparatus is executed.

According to the above-mentioned abnormality detection system, abnormality detection method and program, the accuracy of abnormality detection can be maintained.

It is a functional block diagram which shows the configuration example of the abnormality detection system which concerns on embodiment. It is the first figure explaining the abnormality detection method which concerns on embodiment. It is a 2nd figure explaining the abnormality detection method which concerns on embodiment. It is a 3rd figure explaining the abnormality detection method which concerns on embodiment. It is a 4th figure explaining the abnormality detection method which concerns on embodiment. It is a figure which shows an example of the determination method of abnormality detection which concerns on embodiment. It is a figure which shows an example of the report which concerns on embodiment. It is a flowchart which shows an example of the abnormality detection model creation process which concerns on embodiment. It is a flowchart which shows an example of the abnormality detection processing which concerns on embodiment. It is a figure which shows an example of the hardware configuration of the abnormality detection system which concerns on embodiment.

<Embodiment>
Hereinafter, the abnormality detection system according to the embodiment will be described in detail with reference to FIGS. 1 to 7.
(Constitution)
FIG. 1 is a functional block diagram showing a configuration example of an abnormality detection system according to an embodiment.
The abnormality detection system 10 acquires operation data from the device 20 to be monitored and monitors the behavior of the operation data to detect an abnormality in the device 20. The device 20 is, for example, equipment such as a boiler, a compressor, and a turbine of a plant, a machine tool of a production factory, and the like. The abnormality detection system 10 includes a data acquisition unit 11, a score calculation unit 12, a setting reception unit 13, a learning unit 14, an abnormality detection unit 15, a storage unit 16, a report creation unit 17, and an output unit 18. , Equipped with.

The data acquisition unit 11 acquires the operation data of the device 20. The operation data is a measured value measured by a sensor provided in the device 20, such as temperature, pressure, flow rate, vibration, current, electric power, and rotation speed, and a value calculated based on the measured value. The data acquisition unit 11 acquires the operation data and the measurement time of the operation data from the device 20. Hereinafter, the measured values included in the operation data and the values calculated based on the measured values are described as parameters.

The score calculation unit 12 calculates a score indicating the degree of abnormality in the operation data acquired by the data acquisition unit 11. The score calculation unit 12 includes a first score calculation unit 121, a second score calculation unit 122, a third score calculation unit 123, and a fourth score calculation unit 124. The score calculation unit 12 not only calculates a score focusing only on the parameter to be monitored, but also calculates a score in consideration of the relationship with other parameters.

Specifically, the first score calculation unit 121 calculates the first score, which is the score when only the parameter α is focused on, for one monitored parameter α. For example, the first score calculation unit 121 calculates the probability density P (α) of the parameter α, and calculates the first score based on the value. For example, a negative common logarithm of the probability density P (α) of the parameter α (for example, −log ₁₀ (P (α))) is calculated as the first score. That is, when a value having a small probability density is measured for the parameter α, the first score at that time becomes a large value. In a simple example, if 1000 values of parameter α are obtained, of which 999 values are "1" and 1 is "10", the probability density of the measured value "10" is 1/1000. = 0.001, the first score is 3.0.

The second score calculation unit 122 calculates a second score, which is a score in consideration of the relationship between the parameter α to be monitored and other parameters that reflect the operating state of the device 20. For example, when the device 20 is a power generation facility such as a gas turbine, the operating state of the device 20 is an operation mode such as whether the device 20 is operating at the rated output or at a partial load. In this case, another parameter that reflects the operating state of the device 20 is, for example, the load of the power generation facility. When the other parameters reflecting the operating state of the apparatus 20 are parameter β, the value of parameter β included in the operation data acquired by the data acquisition unit 11 is β1, and the value of parameter α is α1, for example, the second score is calculated. Part 122 calculates the probability that the value of the parameter α becomes α1 under the condition that the value of the parameter β becomes β1, that is, the conditional probability P (α1 | β1), and the conditional probability P (α1 | β1). The negative regular logarithm is calculated as the second score. That is, when a small conditional probability P (α1 | β1) is observed, the second score at that time becomes a large value. This also applies to the following third and fourth scores. The number of other parameters that reflect the operating state of the device 20 may be two or more.

The third score calculation unit 123 calculates a third score, which is a score considering the relationship between the parameter α and other parameters having a strong relationship with the parameter α to be monitored. The parameters that are strongly related are, for example, the temperature data of the operating system of the same equipment and the temperature data of the redundant system. Alternatively, for example, in the case of a power generation facility, if the turbine speed and the temperature of the fuel gas increase as the load increases, these may be parameters that are strongly related. Other parameters that are closely related to the parameter α can be selected by machine learning, for example, a decision tree. Alternatively, a user with knowledge may set other parameters that are closely related to the parameter α. When the other parameters closely related to the parameter α are the parameter γ, the value of the parameter γ included in the operation data acquired by the data acquisition unit 11 is γ1, and the value of the parameter α is α1, for example, the third score calculation unit. 123 is a condition in which the value of the parameter γ is γ1, and the probability that the value of the parameter α is α1, that is, the conditional probability P (α1 | γ1) is calculated, and the negative of the conditional probability P (α1 | γ1). The common logarithm of is calculated as the third score. The number of other parameters that are strongly related to the parameter α may be two or more.

The fourth score calculation unit 124 calculates the fourth score, which is a score considering the relationship between the parameter α to be monitored and all the parameters other than the parameter α. For example, when the combination of the values of all the other parameters included in the operation data acquired by the data acquisition unit 11 is δ1 and the value of the parameter α is α1, the fourth score calculation unit 124 uses the values of all the other parameters. Under the condition that the combination of is δ1, the probability that the value of the parameter α becomes α1, that is, the conditional probability P (α1 | δ1) is calculated. The fourth score calculation unit 124 calculates the negative common logarithm of the conditional probability P (α1 | δ1) as the fourth score.

The setting receiving unit 13 receives various settings. For example, the setting receiving unit 13 receives the setting of the parameter β that reflects the operating state. Further, the setting receiving unit 13 may accept the setting of the parameter γ, which has a strong relationship with the parameter α, the setting of the threshold value for determining an abnormality, and the like. For example, the setting reception unit 13 accepts the setting of an index defining a state such as a load and a temperature and a redundant facility as the knowledge of a field worker.

The learning unit 14 is a determination model for determining whether or not an abnormality has occurred in the device 20 or whether or not there is a sign of an abnormality based on each score calculated by the first score calculation unit 121 to the fourth score calculation unit 124. To create. For example, the learning unit 14 collects operation data when the device 20 has been operating normally in the past, learns the first score of the parameter α included in the collected operation data, and how the first score is. A determination model 1 indicating whether the value is normal is created. Further, the learning unit 14 learns the second score calculated based on the parameter α and the parameter β included in the normal operation data, and indicates what value the second score is normal. The determination model 2 is created. The learning unit 14 also creates the determination model 3 and the determination model 4 for the third score and the fourth score.

Further, for example, the learning unit 14 extracts the parameter α from the operation data including both the normal time and the abnormal time collected when an abnormality occurs in the device 20 in the past, and the first score in the normal time regarding the parameter α. And the first score at the time of abnormality may be learned, and a threshold value (determination model 1) for determining what value the first score becomes to cause an abnormality may be calculated. Similarly, the learning unit 14 learns the second score at the normal time and the second score at the abnormal time calculated based on the operation data of the device 20 including both the normal time and the abnormal time, and the second score is obtained. A determination model 2 for determining what kind of value causes an abnormality may be created. Similarly, the learning unit 14 may create a determination model 3 for discriminating between normal and abnormal based on the third score, and a determination model 4 for discriminating between normal and abnormal based on the fourth score.

Further, the learning unit 14 may further create one or a plurality of abnormality determination models that do not depend on the first score to the fourth score. For example, normal operation data of the device 20 may be collected, and a cluster by the k-nearest neighbor method or a unit space in the MT (Mahalanobis Taguchi) method may be created as a determination model for the parameter α included in the operation data.

The abnormality detection unit 15 detects an abnormality in the device 20 based on the score calculated by the score calculation unit 12 (first score to fourth score) and the determination model created by the learning unit 14 (determination models 1 to 4). do. The abnormality detection unit 15 detects an abnormality using a plurality of scores from the first score to the fourth score. For example, when the determination models 1 to 4 are created based on the first score to the fourth score calculated from the normal operation data, the abnormality detection unit 15 determines the value of the first score calculated by the score calculation unit 12. If the difference between the normal first scores shown by the model 1 is equal to or greater than the threshold value, it is determined that the first score of the parameter α is abnormal. Similarly, the abnormality detection unit 15 compares the value of the second score with the determination model 2 to determine whether or not the second score is abnormal, and the third score and the fourth score are also subjected to the determination models 3 and 4, respectively. Whether it is normal or not is determined based on this.
Further, for example, when the learning unit 14 calculates a threshold value for determining an abnormality for each of the first score to the fourth score, the abnormality detection unit 15 determines that the value of the first score calculated by the score calculation unit 12 is set. If the threshold value calculated by the learning unit 14 is exceeded, it is determined that the first score of the parameter α is abnormal. Similarly, the abnormality detection unit 15 determines whether or not the second score to the fourth score are abnormal based on the respective threshold values.
Then, the abnormality detection unit 15 detects the abnormality of the device 20 based on the determination result of whether or not the abnormality is determined for each score and each score. For example, the abnormality detection unit 15 selects the highest score among the scores determined to be abnormal, and outputs the value indicated by the selected score as the abnormality detection result.

The storage unit 16 stores information such as operation data acquired by the data acquisition unit 11, various settings received by the setting reception unit 13, first score to fourth score, determination models 1 to 4, and detection results by the abnormality detection unit 15. Remember.
The report creation unit 17 creates a report that describes the transition of the operation data in a predetermined period, the transition of the first score to the fourth score, and the like. The report will be described later with reference to FIG.

The output unit 18 outputs a graph showing the transition of the first score to the fourth score calculated by the score calculation unit 12, the abnormality detection result by the abnormality detection unit 15, and the like to the display device. Further, the output unit 18 displays the report created by the report creation unit 17 on the display device or outputs the report to an electronic file.

(4 scores)
Next, an abnormality detection method using the first score to the fourth score will be described with reference to FIGS. 2A to 2D and FIG.
An example of the transition of the parameter α is shown in FIG. 2A. The first score is the probability density calculated by focusing on a single parameter α. For example, if the parameter α fluctuates as shown in FIG. 2A, the first score also fluctuates. By monitoring the fluctuation of the first score, the fluctuation of the parameter α can be grasped. For example, if the first score when the value of the parameter α is Q1 exceeds the threshold value, the abnormality detection unit 15 determines that the first score is abnormal.

FIG. 2B shows an example of the transition of the parameter α to be monitored and the parameter β indicating the operating state. The second score indicates the fluctuation of the parameter α in the operating state at that time. For example, it is assumed that the behaviors of the parameter α and the parameter β have a positive correlation during normal operation. As shown in Q2, even though the parameter β is constant (the operating state is constant), if only the value of the parameter α decreases, the second score also fluctuates. By monitoring the fluctuation of the second score, it can be determined whether or not the fluctuation of the parameter α is abnormal in the current operating state. Further, when the first score and the second score are monitored, the case where only the first score fluctuates, the case where only the second score fluctuates, and the case where both the first score and the second score fluctuate with respect to the parameter α. However, it is possible to suppress erroneous detection by performing abnormality detection based on a plurality of scores. For example, when only the first score fluctuates, the value of the parameter α fluctuates due to the change in the operating state, and if the change in the operating state is taken into consideration, it is conceivable that the fluctuation of the parameter α is within the normal range. However, when only the first score is monitored, it may be erroneously detected that an abnormality has occurred due to the fluctuation of the first score. By performing abnormality detection based on the first score and the second score, such false detection can be suppressed. The first score is a value indicating a simple fluctuation of the parameter α, and the second score is a value indicating a fluctuation of the parameter α in consideration of the operating state. By understanding the calculation method of each score, the user can understand the meaning when each score fluctuates. As a result, it is possible to quickly identify the location and cause of the abnormality and deal with the abnormality.

FIG. 2C shows an example of the transition of the parameters α and the parameters γ1 and γ2 having a strong relationship. The third score indicates the variation of the parameter α with respect to the parameters γ1 and γ2, which are strongly related. For example, it is assumed that the behaviors of the parameters α and the parameters γ1 and γ2 have a positive correlation during normal operation. Even though the parameters γ1 and γ2 are decreasing as shown in Q3, if only the value of the parameter α is increased, the third score also fluctuates. By monitoring the fluctuation of the third score, whether the fluctuation of the parameter α is abnormal compared to the other parameters γ1 and γ2 (or whether the fluctuation of the parameters γ1 and γ2 is abnormal compared to the parameter α). Can be determined. Further, by monitoring in combination with the first score and the second score, the accuracy of abnormality detection can be improved. For example, if the 1st score increases but the 3rd score does not increase, it may mean that the parameters with strong relationship fluctuate at the same time for some reason, and that the fluctuation is not a rare event. .. As a result, it is possible to suppress false detection that occurs when only the first score is monitored. Further, by understanding the calculation method of the third score, the user can understand the meaning of the behavior indicated by the third score. For example, if the 3rd score does not increase and the 2nd score increases, it causes fluctuations in the parameter group with strong relationship, and an event that does not occur in the current driving state has occurred, and the 3rd score increases. Since it does not, it can be inferred that the event may be an event that occurs frequently (in other operating conditions), and so on.

An example of the transition of all parameters is shown in FIG. 2D. The fourth score indicates the variation of the parameter α in the state indicated by all the parameters δ1 to δ3. For example, if only the parameter α shows a special behavior with respect to the behavior of all the other parameters, the fourth score also fluctuates. By monitoring the fluctuation of the fourth score, it can be determined whether or not the fluctuation of the parameter α is abnormal as compared with all the other parameters δ1 to δ3. Further, by monitoring in combination with the first score to the third score, the accuracy of abnormality detection can be improved.

Generally, in an abnormality detection system, a value obtained by subjecting a sensor measurement value or the like to statistical processing may be presented to the user as a score, but a user who is unfamiliar with statistical processing recognizes that the value is abnormal. Even if it can be done, it is difficult to understand its meaning. On the other hand, in the case of the first score to the fourth score of the present embodiment, by grasping the calculation method of each score in advance, it is possible to understand what the value of each score means. , It is possible to estimate what kind of event is occurring in the device 20. For example, the first score indicates how rare a value is observed among the values indicated by the parameter. The second score indicates how rare a value was observed in the operating condition. The third score indicates how unusual a value was observed in a state indicated by a group of highly related parameters that behave in tuned manner. The fourth score indicates how rare a value was observed under the condition indicated by all parameters. The user can understand the meaning of each score and use it for understanding and coping with the event when an abnormality is detected. Further, by monitoring each score, the user can determine whether the behavior of the parameter α to be monitored is suddenly changed, deteriorated, deviated, or vibrated.

Next, with reference to FIG. 3, a method of determining four indexes of sudden change, deterioration, deviation, and vibration will be described using the first score to the fourth score. Sudden change means that the value of the parameter α to be monitored changes suddenly in time. Deterioration means that the value of the parameter α changes with time, such as gradually decreasing or increasing. Dissociation means that the value of the parameter α deviates from the value of another similar parameter. Vibration is a change such that the frequency component of the fluctuation of the parameter α suddenly becomes faster. Skilled observers often monitor the behavior of the parameter α and detect anomalies based on these four indicators. The double circle mark in the table shown in FIG. 3 indicates that the score is most suitable for the judgment of the index, the single circle mark indicates that the score can also be detected, and the triangular mark indicates that the score can also be detected. , Indicates that the score may not be detected, and a cross indicates that the score cannot be detected.

The sudden change can be detected by monitoring the first score, but the sudden change can also be detected by the second score to the fourth score. For example, when the abnormality detection unit 15 determines that the first score is abnormal, the user determines that a sudden change has occurred in the parameter determined to be abnormal.

Regarding deterioration, the second score is the most suitable, but deterioration can also be detected by monitoring the first score. For example, when the abnormality detection unit 15 determines that the second score is abnormal, the user determines that the parameter determined to be abnormal has deteriorated.

The divergence can be detected by monitoring the third score. For example, when the abnormality detection unit 15 determines that the third score is abnormal, the user determines that there is a discrepancy in the parameters determined to be abnormal.

Vibration can be detected by the fourth score. For example, if the cycle of the parameter α fluctuates while all the parameters vibrate at a constant cycle, the fourth score fluctuates. By utilizing this property, vibration can be detected by the fourth score. Vibration can also be detected by the second score. For example, when the abnormality detection unit 15 determines that the fourth score is abnormal, the user determines that vibration has occurred for the parameter determined to be abnormal.

Further, for example, the output unit 18 outputs a graph showing the transition of the first score to the fourth score from a few minutes ago to the present for the parameter α to the display device, and the user confirms the fluctuation of each score. , Sudden change, deterioration, deviation, vibration may be determined. Alternatively, the abnormality detecting unit 15 may be provided with a standard for determining sudden change, deterioration, deviation, and vibration, and the abnormality detecting unit 15 may be made to determine. For example, in the case of a sudden change, a threshold value for the amount of fluctuation of the first score is defined for each parameter to be monitored, and if there is a fluctuation exceeding this threshold value within a predetermined time, the abnormality detection unit 15 states that the sudden change has occurred. judge. By using the first score to the fourth score according to the present embodiment, it becomes easy for a skilled observer to judge the four indexes which have been judged by monitoring the behavior of each parameter.

(Report)
FIG. 4 shows an example of a report created by the report creation unit 17.
The report 100 is, for example, a monthly periodic report, in which the measured values of each parameter measured in the immediately preceding month and the values of the first score to the fourth score are described every month. The report 100 includes an area 101 for displaying data relationships, an area 102 for displaying high score rankings, an area 103 for displaying trends for one month, and an area 104 for displaying long-term trends.

In the area 101, the relationship between the parameters is displayed. For example, the column of measurement points indicates the type of parameter. All the parameters in the column of measurement points may be parameters to be monitored, or some may be parameters to be monitored. In the equipment status column, the parameters indicating the operating status are marked with a circle. In the correlation column, the same alphabet is displayed for the strongly related parameters. In the case of report 100 in FIG. 4, Para1 to Para3 are described as measurement points, the relationship between Para1 and Para2 is strong (“A” in the correlation column), and Para3 is a parameter indicating the operating state (circle in the equipment status column). Mark). Therefore, for example, when Para1 is a parameter to be monitored, the probability density of Para1 is the first score, the conditional probability P (Para1 | Para3) is the second score, and the conditional probability P (Para1 | Para2) is the third score.・ ・ Etc. By referring to the area 101, the user can confirm the parameter indicating the operating state with respect to the second score, and can confirm the parameter having a strong relationship with respect to the third score.

In the area 102, about 20 of the first to fourth scores observed for each parameter for one month are displayed in descending order. The rank is displayed in the No column, the time when the score was observed is displayed in the time column, the score value is displayed in the score column, and the monitored parameter is displayed in the monitored item column. The type is displayed, and in the score type column, whether the score is the first score to the fourth score is displayed. In the case of Report 100 in FIG. 4, the largest value was the first score value “X1” of Para1 observed in “Y / M / D hh: m1”, and the second largest value was “”. The second score value of Para2 observed in "Y / M / D hh: m2" is "X2", and the third largest value is the second score of Para2 observed in "Y / M / D hh: m3". The value of 1 score is "X3". By referring to the area 102, the user can confirm the information of the parameter showing the high value in the past month.

The region 103 shows the changes in the measured values of each parameter and the values of the first score to the fourth score for one month. The region 104 shows the transition of the measured value of each parameter and the value of the first score to the fourth score over a long period of time (for example, the past 5 years). The user can confirm the trend of the first score to the fourth score calculated for each parameter by referring to the areas 103 and 104. There are two types of anomaly detection: a need for short-term evaluation and a need for medium- to long-term evaluation. The short-term evaluation is necessary to grasp, for example, the failure or abnormality currently occurring in the device 20 based on the occurrence situation of the abnormality in a short period based on the present. On the other hand, the medium- to long-term evaluation is the deterioration or failure of the device 20 based on the tendency of abnormalities and abnormal signs detected from the past to the present (occurrence status such as frequency and magnitude of score). You will need it to make predictions. The user can perform a medium- to long-term evaluation of the apparatus 20 by referring to the areas 103 and 104. Abnormalities in the device 20 often show some signs before they lead to a sudden failure. By utilizing the report 100, signs of abnormality can be confirmed. It can also be used to predict abnormalities that may occur in the future in chronological order.

For example, the user can confirm the first score to the fourth score and the measured value by the following procedure using the report 100, from the conventional equipment operation centered on post-maintenance to preventive maintenance equipment management. It is possible to put in place a mechanism to support.
(1) Understand the relationship between data.
The user refers to the area 101 and confirms the relationship and combination of each parameter before referring to the specific score value. This makes it possible to grasp the meaning of the first score to the fourth score.
(2) Check where the score has risen.
The user refers to the areas 102 to 104, and confirms the place and time when the values of the first score to the fourth score are high.

(3) Check the related parameters.
The user confirms the parameter in which the high score confirmed in (2) is observed. The user confirms the target parameter from the following viewpoints.
(3-1) The first score is increasing.
Focus only on the target parameter, and check whether the measured value of that parameter has changed suddenly, or whether the value is in a range that is not normally possible.
(3-2) The second score is increasing.
Focus on the target parameter or operating condition parameter. Check if one or both of them have abnormal values. The operating state parameter is a parameter in which the equipment state of the area 101 is marked with a circle.
(3-3) The third score is increasing.
Focus on the parameter of interest or the parameter that is closely related to the parameter of interest. Check the trend (region 103) of each parameter to see if any of them has an abnormal value. The strongly related parameters are shown in the correlation column of region 101. For example, in the case of the example of FIG. 4, when the third score of Para1 increases, it is necessary to pay attention to Para2 as well.

For example, the report creation unit 17 creates the report 100 once a month, and the output unit 18 outputs the report 100 as an electronic file or the like. Based on the output report 100, the user can perform a medium- to long-term evaluation regarding the abnormality of the equipment 20 by the above procedure. Further, the user can evaluate the state of the equipment 20 from the viewpoint of the four indicators described with reference to FIG. 3 based on the report 100.

(motion)
Next, the operation of the abnormality detection system 10 will be described with reference to FIGS. 5 and 6.
First, an example of the operation of the learning phase will be described with reference to FIG.
FIG. 5 is a flowchart showing an example of the abnormality detection model creation process according to the embodiment.
First, the setting receiving unit 13 receives various settings (step S11). For example, the user inputs to the abnormality detection system 10 the setting of the parameter to be monitored, the setting of the parameter indicating the operating state, and the setting of the parameter having a strong relationship. The setting receiving unit 13 receives these settings, writes them in the storage unit 16, and saves them. Parameters with strong relationships are parameters that have been analyzed in advance by machine learning or the like to have strong relationships.

Next, the data acquisition unit 11 collects operation data measured while the device 20 is operating in a normal operating state (step S12). Since the operation data to be collected is the learning data of the abnormality determination model, it is preferable to collect as much operation data as possible while operating under various conditions. Further, for the evaluation of the second score, it is preferable to collect the operation data in all the operating states of the apparatus 20. The data acquisition unit 11 writes the collected operation data in the storage unit 16 and stores it.

Next, the score calculation unit 12 calculates the first score to the fourth score (step S13). For example, the first score calculation unit 121 reads out the data of the parameter set as the monitoring target from the operation data collected as the learning data stored in the storage unit 16, and calculates the probability density for the parameter at each time. For example, if 10,000 measured values are collected for the parameter α, the probability density (first score) in the 10,000 measured values is calculated for each of the 10,000 measured values. The first score calculation unit 121 writes the calculated first score in the storage unit 16 and stores it. Similarly, the second score calculation unit 122 reads out the combination of the parameter data set as the monitoring target and the parameter data set as indicating the operating state from the collected operating data, and reads the operating state. The data of the monitored parameter is classified according to the operating state indicated by the value of the indicated parameter, and the probability (second score) that the value is observed in the same classification is calculated for each classified data. The second score calculation unit 122 writes the calculated second score in the storage unit 16 and stores it. The third score calculation unit 123 reads out a combination of the data of the monitored parameter and the data of the parameter having a strong relationship from the collected operation data, and the condition is that the value of the parameter having a strong relationship is observed. The probability that the value of the monitored parameter is observed (third score) is calculated, and the third score is written in the storage unit 16 and stored. The fourth score calculation unit 124 observes the values of the monitored parameters, provided that the combination of the values of all the other parameters measured at the same time is observed for each of the values of the monitored parameters. The probability (fourth score) is calculated, and the fourth score is written in the storage unit 16 and stored.

Next, the learning unit 14 creates the determination models 1 to 4 (step S14). For example, the learning unit 14 creates the determination model 1 based on the first score calculated in step S13. For example, the learning unit 14 may use the average value of the first score as the determination model 1, create the determination model 1 in which the range of the minimum value and the maximum value of the first score is regarded as normal, or the first. The cluster created by clustering the scores by the k-nearest neighbor method may be used as the determination model 1. The learning unit 14 also creates a determination model 2, a determination model 3, and a determination model 4 showing the normal range of each score for the second score, the third score, and the fourth score, respectively. The learning unit 14 writes and stores the created determination models 1 to 4 in the storage unit 16.

Alternatively, the learning unit 14 may calculate a threshold value for discriminating between normal and abnormal. For example, the data acquisition unit 11 acquires the operation data measured when the device 20 is operating in a normal state and the operation data measured when an abnormality occurs, and stores the operation data in the storage unit 16. Next, the score calculation unit 12 calculates the first score to the fourth score for the measured values of the parameters to be monitored included in the collected operation data, and stores them in the storage unit 16. Next, for each of the calculated first score to fourth score, the learning unit 14 determines whether the score is the first score to the fourth score calculated based on the parameters measured at the normal time of the apparatus 20. , Or, label information indicating whether the score is the first score to the fourth score calculated based on the parameters measured at the time of abnormality is attached. Next, the learning unit 14 creates a determination model 1 for determining the presence or absence of an abnormality based on the value of the first score by a predetermined method using the first score to which the label information is added as learning data. For example, the learning unit 14 creates the determination model 1 by using an SVM (Support Vector Machine), a decision tree, or the like. The learning unit 14 creates the determination models 2 to 4 by the same method.

As described above, in the present embodiment, the operation data is converted into the probability density and the conditional probability to create the determination models 1 to 4. As a result, abnormality detection can be performed based on the first score to the fourth score. Further, as will be described later, anomaly detection can be performed using ensemble learning. The learning unit 14 may create a determination model different from the determination models 1 to 4 by using, for example, the parameter values as learning data instead of the first score to the fourth score for ensemble learning.

Next, an example of the operation of the monitoring phase will be described with reference to FIG.
FIG. 6 is a flowchart showing an example of the abnormality detection process according to the embodiment.
As a premise, it is assumed that the created determination models 1 to 4 and the threshold value for abnormality determination are registered in advance in the storage unit 16. For example, a threshold value 1 for determining the first score of the parameter α to be monitored, a threshold value 2 for determining the second score, a threshold value 3 for determining the third score, and a threshold value for determining the fourth score. It is assumed that 4 is registered in the storage unit 16.

First, the data acquisition unit 11 acquires the latest operation data from the device 20 (step S21). The data acquisition unit 11 outputs the latest operation data to the score calculation unit 12. Next, the score calculation unit 12 (first score calculation unit 121 to fourth score calculation unit 124) calculates the first score to the fourth score for the latest operation data (step S22). Since the operation data collected in the learning phase is accumulated in the storage unit 16, for example, the score calculation unit 12 uses the accumulated operation data and the latest operation data to score the first to fourth scores. Is calculated. The score calculation unit 12 outputs the first score to the fourth score to the abnormality detection unit 15. Next, the abnormality detection unit 15 determines an abnormality based on the determination models 1 to 4 (step S23). First, the abnormality detection unit 15 determines whether or not the first score is abnormal based on the first score and the determination model 1. For example, when the determination model 1 is created as the average value of the first scores in the normal state, the abnormality detection unit 15 sets the first score based on the latest operation data and the average value of the first scores (determination model 1). If the difference between the two exceeds the threshold value 1, the latest first score may be determined to be abnormal. For example, when the determination model 1 is created by the maximum value and the minimum value of the first score at the normal time, the abnormality detection unit 15 determines the range in which the first score based on the latest operation data is indicated by the maximum value and the minimum value. If it deviates from the threshold value of 1 or more, it may be determined that the latest first score is abnormal. For example, when the determination model 1 is a cluster with a first score when it is normal, the abnormality detection unit 15 is the latest if the distance between the first score based on the latest operation data and the center of gravity of the cluster is a threshold value of 1 or more. The first score may be determined to be abnormal. The abnormality detection unit 15 determines whether or not the second score to the fourth score based on the latest operation data are abnormal in the same manner.

Further, when the determination models 1 to 4 for discriminating between normal and abnormal are created in the learning phase, the abnormality detection unit 15 inputs the value of the first score based on the latest operation data into the determination model 1. The determination model 1 determines whether it is normal or abnormal, and outputs the determination result. When the discrimination result output by the determination model 1 is abnormal, the abnormality detection unit 15 determines that the latest first score is abnormal. The abnormality detection unit 15 also determines whether or not the second score to the fourth score based on the latest operation data are abnormal by the same method based on the determination models 2 to 4, respectively. Further, when ensemble learning is performed, the abnormality detection unit 15 determines whether or not the latest operation data is abnormal by using the determination model created in the learning phase.

Next, the abnormality detection unit 15 analyzes the determination result based on each score (step S24). Specifically, the abnormality detection unit 15 selects the score having the maximum score value among the scores determined to be abnormal. For example, the value of the first score is "5", the value of the second score is "10", the value of the third score is "0.5", the value of the fourth score is "0.5", and the first score. When the second score is determined to be abnormal, the abnormality detection unit 15 selects the second score as the score indicating the abnormality occurring in the device 20 most simply.

Further, in the case of performing ensemble learning and when an abnormality is determined by the determination model created for ensemble learning, the abnormality detection unit 15 calculates the degree of abnormality indicated by the operation data by a predetermined method. The calculated degree of abnormality is a value comparable to the first score to the fourth score. The abnormality detection unit 15 selects the maximum value from the first score to the fourth score and the degree of abnormality calculated for ensemble learning.
The abnormality detection unit 15 outputs the information of the first score to the fourth score, the determination result of each score, the determination time, and the score indicating the highest value to the output unit 18, and writes and stores the information in the storage unit 16. This information is used when the report creation unit 17 creates the report 100.

Next, the output unit 18 outputs the abnormality detection result to the display device or the like (step S25). For example, the output unit 18 indicates the values of the first score to the fourth score, the determination result (whether or not it is abnormal) and the determination time for each score, and the maximum value selected by the abnormality detection unit 15 from the abnormality detection unit 15. Get score information and display them. For example, the abnormality detection unit 15 may create and display a graph showing the transition of the values of the first score to the fourth score from before a predetermined period. For example, the user can confirm the occurrence of sudden change, deterioration, deviation, and vibration by paying attention to the score indicating the maximum value selected by the abnormality detection unit 15, and can detect the abnormality of the device 20. The output unit 18 displays the maximum value selected by the abnormality detection unit 15 from the first score to the fourth score. As a result, the best result can be transmitted to the user from the judgment results (judgment results for each of the first score to the fourth score) by a plurality of methods, and the accuracy of abnormality detection can be improved. can. Further, by displaying the first score to the fourth score, the user can confirm a plurality of scores, prevent false detection, and from the contents meaning by each score, the abnormality occurring in the device 20. The cause and content can be estimated.

In the above embodiment, the process of detecting an abnormality by the abnormality detecting unit 15 has been described as an example, but the apparatus 20 does not merely detect the abnormality, but also based on the values of the first score to the fourth score. Condition monitoring may be performed. For example, the abnormality detection system 10 detects the operating state of each of the plurality of scores based on the plurality of scores (first score to the fourth score, or the first score to the third score) and the determination model. A state determination unit that determines the state of the device 20 based on the results of the plurality of operating states may be further provided. Alternatively, the abnormality detection unit 15 may include the above-mentioned state determination unit. For example, an index indicating a state associated with one or more values or a tendency of a value among the first score to the fourth score is defined in advance (for example, state A, state B ..., Or Good, usually not abnormal, but prone to XX, etc.), the state determination unit performs a process of determining which of the indexes indicating a predefined state is based on the first score to the fourth score. conduct. Further, the state determination unit may determine the state of the device 20 based on the index indicating the determined one or more states.
Further, the output unit 18 may output an index indicating the state determined by the state determination unit or the state determined by the state determination unit in real time.

(effect)
As described above, according to the present embodiment, abnormality detection is performed using not only one score but also scores calculated from a plurality of viewpoints. As a result, based on the index that defines the state of each device, the degree of abnormality can be evaluated after adjusting the index so that it becomes a certain condition, so that false detection can be prevented and the accuracy of abnormality detection can be improved. Can be done. More specifically, there are methods for evaluating the degree of anomaly based on data distribution such as MT method, k-nearest neighbor method, and LOF, which are general unsupervised anomaly detection methods, and methods that only present indicators that contribute to them. Unlike, since the data probability density can be estimated and the degree of abnormality can be comprehensively evaluated from the conditional probabilities under a plurality of conditions, false detection can be prevented and the accuracy of abnormality detection can be improved. Further, the first score to the fourth score are values based on various probabilities that the parameter to be monitored is observed. It is possible to grasp the content of the probability that is the background of each score. That is, according to the present embodiment, it is possible to improve the explanation to the user about the meaning of each score. By grasping the meaning of the score, it is possible to identify the abnormal part, deal with the abnormality, and improve the quality and accuracy of the monitoring work by the user. Further, according to the report 100, the long-term trends of the first score to the fourth score can be confirmed. This enables medium- to long-term evaluation of the device 20, and the evaluation results can be utilized for preventive maintenance.
Further, according to the present embodiment, it is possible to monitor the state using not only one score but also scores calculated from a plurality of viewpoints.

FIG. 7 is a diagram showing an example of the hardware configuration of the prediction system according to the embodiment.
The computer 900 includes a CPU 901, a main storage device 902, an auxiliary storage device 903, an input / output interface 904, and a communication interface 905.
The above-mentioned abnormality detection system 10 is mounted on the computer 900. Each of the above-mentioned functions is stored in the auxiliary storage device 903 in the form of a program. The CPU 901 reads a program from the auxiliary storage device 903, expands it to the main storage device 902, and executes the above processing according to the program. Further, the CPU 901 secures a storage area in the main storage device 902 according to the program. Further, the CPU 901 secures a storage area for storing the data being processed in the auxiliary storage device 903 according to the program.

By recording a program for realizing all or part of the functions of the abnormality detection system 10 on a computer-readable recording medium, and having the computer system read and execute the program recorded on the recording medium, the program is executed. Processing by each functional unit may be performed. The term "computer system" as used herein includes hardware such as an OS and peripheral devices. Further, the "computer system" includes the homepage providing environment (or display environment) if the WWW system is used. Further, the "computer-readable recording medium" refers to a portable medium such as a CD, DVD, or USB, or a storage device such as a hard disk built in a computer system. When this program is distributed to the computer 900 by a communication line, the distributed computer 900 may expand the program to the main storage device 902 and execute the above processing. Further, the above program may be for realizing a part of the above-mentioned functions, and may be further realized for realizing the above-mentioned functions in combination with a program already recorded in the computer system. ..
The abnormality detection system 10 may be composed of a plurality of computers 900.

As described above, some embodiments according to the present disclosure have been described, but all of these embodiments are presented as examples and are not intended to limit the scope of the invention. For example, instead of adopting the fourth score, three scores of the first score to the third score may be calculated, and then the abnormality may be detected based on the score having the largest value among these scores. These embodiments can be implemented in various other embodiments, and various omissions, replacements, and changes can be made without departing from the gist of the invention. These embodiments and variations thereof are included in the scope of the invention described in the claims and the equivalent scope thereof, as are included in the scope and gist of the invention.

<Additional Notes>
The abnormality detection system 10, the abnormality detection method and the program described in each embodiment are grasped as follows, for example.

(1) The abnormality detection system 10 according to the first aspect has a data acquisition unit 11 that acquires operation data of a device to be monitored, and a value of a first parameter that is a measurement value of the monitoring target included in the operation data. , A score calculation unit 12 that calculates a plurality of types of probabilities that the value is observed by using different methods, and calculates a score indicating the degree of abnormality for each of the plurality of types of probabilities, and a plurality of the scores. It is provided with an abnormality detection unit 15 that determines whether or not each of the plurality of scores is abnormal based on the determination model, and detects the abnormality of the apparatus based on the results of the plurality of determinations.
By performing anomaly detection based on a plurality of scores, false detection can be prevented and detection accuracy can be improved. Since the plurality of scores are values based on the plurality of types of probabilities in which the monitored parameter is observed, the user can understand the meaning of each score by grasping the calculation contents of the plurality of types of probabilities. .. That is, the explanation of the score can be improved.

(2) The abnormality detection system 10 according to the second aspect is the abnormality detection system 10 according to (1), and the probability related to one of the plurality of scores is included in the operation data. This is the probability that the value of the first parameter included in the operating data will be observed in the operating state indicated by the second parameter, which is a measured value related to the operating state of.
As a result, the probability that the value of the first parameter is observed in the current operating state is calculated, and for example, when a value with a low probability is observed, it is determined that an abnormal value is observed in the current operating state. be able to. Further, by monitoring the second score based on the probability, it is possible to determine "deterioration" among the behaviors indicated by the parameters.

(3) The abnormality detection system 10 according to the third aspect is the abnormality detection system 10 according to (1) to (2), and the probability related to one of the plurality of scores is the first parameter. When the value of the third parameter included in the operation data is observed for the third parameter, which is a predetermined measured value having a strong relationship with the operation data, the value of the first parameter included in the operation data is observed. It is the probability that it will be done.
As a result, the probability that the value of the first parameter is observed with respect to the value of another parameter with a strong relationship is calculated. For example, when a value with a low probability is observed, the first parameter or the relationship is determined. It can be determined that an abnormal value was observed with a strong parameter. Further, by monitoring the third score based on the probability, it is possible to determine "dissociation" among the behaviors indicated by the parameters.

(4) The abnormality detection system 10 according to the fourth aspect is the abnormality detection system 10 of (1) to (3), and the probability related to one of the plurality of scores is the first parameter. Probability that the value of the first parameter included in the operation data is observed when the value of the fourth parameter included in the operation data is observed for the fourth parameter which is a plurality of other measured values excluding. Is.
As a result, the probability that the value of the first parameter is observed with respect to the value of the other parameter is calculated. For example, when a value with a low probability is observed, an abnormal value in the first parameter or another parameter is calculated. Can be determined to have been observed. Further, by monitoring the fourth score based on the probability, it is possible to determine "vibration" among the behaviors indicated by the parameters.

(5) The abnormality detection system 10 according to the fifth aspect is the abnormality detection system 10 of (1) to (4), and the probability related to one of the plurality of scores is based on the operation data. The probability density at which the value of the first parameter included is observed.
As a result, the probability that the value of the first parameter will be observed this time is calculated among the values that the first parameter can take. For example, when a value with a low probability is observed, an abnormal value for the first parameter is calculated. Can be determined to have been observed. Further, by monitoring the first score based on the probability, it is possible to determine "sudden change" among the behaviors indicated by the parameters.

(6) The abnormality detection system 10 according to the sixth aspect is the abnormality detection system 10 of (1) to (5), and the abnormality detection unit 15 has the highest score among the plurality of scores. Detect anomalies based on.
As a result, the score that most clearly represents the abnormality can be notified to the user, which can be useful for determining the abnormality.

(7) The abnormality detection system 10 according to the seventh aspect is the abnormality detection system 10 of (1) to (6), further including an output unit 18 for outputting an abnormality detected by the abnormality detection unit 15. ..

(8) The abnormality detection system 10 according to the eighth aspect is the abnormality detection system 10 of (1) to (7), based on the operation data when the device 20 is in a normal operating state. A determination model creating unit (learning unit 14) for creating the determination models 1 to 4 indicating a range in which the score is normal is further provided for each of the plurality of types of the scores calculated by the score calculation unit 12.
As a result, it is possible to evaluate whether or not the score calculated by the score calculation unit is abnormal.

(9) The abnormality detection system 10 according to the eighth aspect is the abnormality detection system 10 of (1) to (8), and is a report creation unit that creates a report including a graph showing the transition of a plurality of types of the scores. 17 is further provided.
By confirming the transition of the score, it is possible to evaluate the change over time for the abnormality of the device 20. By setting the range of the transition shown in the graph to, for example, one year or more, the medium- to long-term evaluation of the apparatus 20 can be performed.

(10) In the prediction method according to the tenth aspect, the abnormality detection system acquires the operation data of the device to be monitored, and the value of the first parameter, which is the measured value of the monitoring target included in the operation data, is concerned. Multiple types of probabilities of observing values are calculated using different methods, and for each of the multiple types of probabilities, a score indicating the degree of abnormality is calculated, based on the plurality of scores and a determination model. , It is determined whether or not each of the plurality of scores is abnormal, and the abnormality of the apparatus is detected based on the results of the plurality of determinations.

(11) The program according to the eleventh aspect acquires the operation data of the device to be monitored by the computer, and observes the value of the first parameter which is the measured value of the monitoring target included in the operation data. A plurality of types of probabilities are calculated using different methods, a score indicating the degree of abnormality is calculated for each of the plurality of types of probabilities, and a plurality of scores are calculated based on the plurality of scores and a determination model. It is determined whether or not each of the scores is abnormal, and a process for detecting an abnormality in the apparatus is executed based on the results of the plurality of determinations.

10 ... Abnormality detection system 11 ... Data acquisition unit 12 ... Score calculation unit 13 ... Setting reception unit 14 ... Learning unit 15 ... Abnormality detection unit 16 ... Storage unit 17 ... Report creation unit 18 ... Output unit 20 ... Device 900 ... Computer 901 ... CPU
902 ... Main storage device 903 ... Auxiliary storage device 904 ... Input / output interface 905 ... Communication interface

Claims (11)

The data acquisition unit that acquires the operation data of the device to be monitored, and
For the value of the first parameter, which is the measured value of the monitoring target included in the operation data, the probability of the value being observed is calculated for multiple types using different methods, and each of the multiple types of probabilities is abnormal. A score calculation unit that calculates the score indicating the degree, and
An abnormality detection unit that determines whether or not each of the plurality of scores is abnormal based on the plurality of the scores and the determination model, and detects the abnormality of the apparatus based on the results of the plurality of determinations.
Anomaly detection system with. The probability pertaining to one of the plurality of scores is included in the operation data in the operation state indicated by the second parameter which is a measured value related to the operation state of the apparatus included in the operation data. The probability that the value of one parameter will be observed,
The abnormality detection system according to claim 1. The probability related to one of the plurality of scores is observed by the value of the third parameter included in the operation data for the third parameter, which is a predetermined measured value having a strong relationship with the first parameter. This is the probability that the value of the first parameter included in the operation data will be observed.
The abnormality detection system according to claim 1 or 2. The probability pertaining to one of the plurality of scores is when the value of the fourth parameter included in the operation data is observed for the fourth parameter which is a plurality of other measured values excluding the first parameter. In addition, it is the probability that the value of the first parameter included in the operation data is observed.
The abnormality detection system according to any one of claims 1 to 3. The probability pertaining to one of the plurality of scores is the probability density at which the value of the first parameter included in the operation data is observed.
The abnormality detection system according to any one of claims 1 to 4. The abnormality detection unit detects an abnormality based on the score having the largest value among the plurality of scores.
The abnormality detection system according to any one of claims 1 to 5. An output unit that outputs an abnormality detected by the abnormality detection unit,
The abnormality detection system according to any one of claims 1 to 6, further comprising. A determination to create a determination model indicating a range in which the score is normal for each of a plurality of types of scores calculated by the score calculation unit based on the operation data when the device is in a normal operating state. Modeling department,
The abnormality detection system according to any one of claims 1 to 7, further comprising. The abnormality detection system according to any one of claims 1 to 8, further comprising a report creating unit for creating a report including a graph showing changes in the scores of a plurality of types. The anomaly detection system
Acquire the operation data of the device to be monitored and
For the value of the first parameter, which is the measured value of the monitoring target included in the operation data, the probability of the value being observed is calculated for multiple types using different methods, and each of the multiple types of probabilities is abnormal. Calculate a score that indicates the degree,
Based on the plurality of the scores and the determination model, it is determined whether or not each of the plurality of scores is abnormal, and the abnormality of the apparatus is detected based on the results of the plurality of determinations.
Anomaly detection method. On the computer
Acquire the operation data of the device to be monitored and
For the value of the first parameter, which is the measured value of the monitoring target included in the operation data, the probability of the value being observed is calculated for multiple types using different methods, and each of the multiple types of probabilities is abnormal. Calculate a score that indicates the degree,
A process of determining whether or not each of the plurality of scores is abnormal based on the plurality of the scores and the determination model, and detecting the abnormality of the apparatus based on the results of the plurality of determinations.
A program to execute.

Images