JP2023106472A - Abnormality detection device and abnormality detection method - Google Patents

Abstract

To improve an abnormality detection sensitivity even when a quantity of sensors in a facility is large in an abnormality detection device.SOLUTION: An abnormality detection device has a sensor group setting unit that sets a sensor group based on a similarity between a plurality of sensor signals.SELECTED DRAWING: Figure 1

Description

The present invention relates to an anomaly detection device and an anomaly detection method.

Electric power companies use waste heat from gas turbines to supply hot water for district heating, and to supply high-pressure steam and low-pressure steam to factories. Petrochemical companies operate gas turbines and the like as power supply equipment. In various plants and facilities that use gas turbines and the like, anomaly detection that detects facility failures or signs of such failures is extremely important for minimizing damage to society.

Not only gas turbines and steam turbines, but also water turbines in hydroelectric power plants, nuclear reactors in nuclear power plants, wind turbines in wind power plants, engines of aircraft and heavy equipment, railway vehicles and tracks, escalators, elevators, equipment and parts level. There is no time to enumerate the facilities that require the above preventive maintenance such as battery deterioration and service life.

For this reason, a plurality of sensors that acquire various physical information are attached to the target facility or plant, and whether the target facility or plant is normal or abnormal is determined according to the monitoring criteria for each sensor.

Patent Literature 1 discloses an anomaly detection method for detecting the presence or absence of an anomaly by comparing an anomaly measure calculated based on learning of past normal data with a threshold value. Furthermore, for the purpose of excluding sensors that impede the anomaly detection sensitivity, a method of excluding sensors based on evaluation values calculated based on the two-dimensional distribution of sensor signals is disclosed. Here, the anomaly measure is the amount of deviation from the vector value of the normal state, expressed as one vector value of the measured values by a plurality of sensors.

JP 2016-200949 A

In Patent Literature 1, it is possible to appropriately exclude sensors that impede sensitivity, and it is possible to improve anomaly detection sensitivity. However, if the number of sensors in the facility is large, the effect of each sensor becomes small, and the abnormality detection sensitivity decreases. If the number of sensors targeted for abnormality detection is reduced to about 30, the abnormality detection sensitivity of the targeted sensors is improved. However, for example, if the original number of sensors is 100, about 70 of them are not subject to abnormality detection, and abnormality occurring in those sensors cannot be detected, resulting in a decrease in abnormality detection sensitivity.

SUMMARY OF THE INVENTION It is an object of the present invention to improve anomaly detection sensitivity in an anomaly detection device even when the number of sensors in equipment is large.

An abnormality detection device according to one aspect of the present invention includes a first sensor signal input unit to which a plurality of time-series sensor signals output from a plurality of sensors attached to equipment are input; a sensor group setting unit that obtains a degree of similarity between the plurality of sensor signals input to the unit and sets a sensor group based on the degree of similarity; and a plurality of the sensor signals output from the plurality of sensors are input. a second sensor signal input unit for each sensor group; a feature vector extraction unit for extracting a feature vector for each time from the plurality of sensor signals input to the second sensor signal input unit; an anomaly measure calculation unit that calculates an anomaly measure at each time using the feature vector of a specified learning period as learning data for each sensor group; and comparing the anomaly measure with a predetermined threshold value for each sensor group. and an abnormality detection unit for determining whether the sensor signal at each time is normal or abnormal.

An anomaly detection method according to one aspect of the present invention inputs a plurality of time-series sensor signals output from a plurality of sensors attached to equipment, obtains a degree of similarity between the plurality of sensor signals, and obtains the degree of similarity A sensor group is set based on, and for each sensor group, a feature vector is extracted from the plurality of sensor signals at each time, and for each sensor group, the feature vector of a specified learning period is used as learning data, An abnormality measure at each time is calculated, and whether the sensor signal at each time is normal or abnormal is determined by comparing the anomaly measure with a predetermined threshold for each sensor group.

According to one aspect of the present invention, even when the number of sensors in equipment is large, it is possible to detect an abnormality occurring in a sensor by improving the sensitivity of abnormality detection for all sensors.

It is a figure which shows one structural example of the abnormality detection apparatus of embodiment. It is a figure which shows the example which listed several sensor signals and represented them in the tabular form. It is a figure which shows the whole process flow which the abnormality detection apparatus of embodiment performs. FIG. 10 is a diagram illustrating a flow of sensor group setting processing according to the first embodiment; It is a figure which shows the flow of a two-dimensional frequency distribution calculation process. It is a figure explaining the two-dimensional frequency-distribution image preparation method. It is a figure explaining the method to calculate the similarity between sensors. It is a figure which shows the example of a two-dimensional frequency-distribution image. It is a figure which shows the example of a two-dimensional frequency-distribution image. It is a figure which shows the example of a two-dimensional frequency-distribution image. FIG. 10 is a diagram illustrating a flow of sensor group setting processing according to the second embodiment; FIG. 12 is a diagram illustrating a flow of sensor group setting processing according to the third embodiment; It is a figure which shows the flow of the abnormality measure calculation process at the time of learning. It is a figure explaining the abnormality measure calculation process by the local subspace method. It is a figure which shows the flow of an abnormality detection process. FIG. 10 is a diagram showing an example of a GUI for setting sensor group setting conditions; FIG. 10 is a diagram showing an example of a distribution image display screen; It is a figure which shows the example of a sensor signal display screen. FIG. 10 is a diagram showing an example of a GUI for setting offline analysis conditions; FIG. 10 is a diagram showing an example of a GUI for designating display targets of online analysis results; FIG. 11 is a diagram showing an example of an analysis result overall display screen; It is a figure which shows the example of an analysis result enlarged display screen.

Embodiments will be described below with reference to the drawings.

A configuration example of the abnormality detection device according to the embodiment will be described with reference to FIG.
The anomaly detection device 100 acquires sensor signals 102 output from a plurality of sensors attached to equipment 101, which is a detection target, at predetermined time intervals (periodically). The acquired sensor signal 102 is temporarily stored in the sensor signal storage unit 103 . A signal input unit (first sensor signal input unit) 104 inputs the sensor signal 102 from the sensor signal storage unit 103 and sends it to the sensor group setting unit 105 . The sensor group setting unit 105 sets sensor groups based on the similarity (degree of similarity) between sensor signals, and stores the result in the group information accumulation unit 106 .

A signal input unit (second sensor signal input unit) 107 receives the sensor signal 102 from the sensor signal storage unit 103 or directly from a sensor attached to the equipment 101 and sends it to the feature vector extraction unit 108 . The feature vector extraction unit 108 receives sensor group information from the group information accumulation unit 106 , extracts a feature vector based on the sensor signal 102 for each set group, and sends the feature vector to the abnormality measure calculation unit 109 . The anomaly measure calculation unit 109 calculates an anomaly measure for each feature vector at each predetermined time (hereinafter also referred to as each time) using the feature vector of the learning period specified in advance.

The threshold calculator 110 calculates a threshold based on the anomaly measure of the learning data by the anomaly measure calculator 109 . The feature vector of the learning period extracted by the feature vector extraction unit 108, the threshold value calculated by the threshold value calculation unit 110, and other data necessary for abnormality detection are stored in the learning result storage unit 111 as learning results. . The anomaly detection unit 112 detects an anomaly of the facility 101 by comparing the anomaly measure of each feature vector sent from the anomaly measure calculation unit 109 and the threshold value calculated by the threshold value calculation unit 110 . A detection result detected by the abnormality detection unit 112 is output to the output unit 113 .

Here, a brief explanation of the terms used below is provided. A feature vector is a single vector value representing measured values from a plurality of sensors. The anomaly measure is the amount of deviation of the feature vector of interest from the feature vector in the specified period. In other words, the anomaly measure is the amount of deviation from the vector value of the normal state, expressed as one vector value of the measured values by a plurality of sensors.

The facility 101 to be detected as an abnormality is, for example, a facility such as a gas turbine or a steam turbine, or a plant. Equipment 101 outputs a sensor signal 102 representing its state. The sensor signal 102 is stored in the sensor signal storage unit 103 .

FIG. 2 is an example in which a plurality of sensor signals 102 are listed and represented in tabular form.
The sensor signal 102 is a multidimensional time-series signal in which a plurality of pieces of physical information having different physical properties are acquired at predetermined intervals. The configuration of the table shown in FIG. 2 shows information on date and time 201 and sensor values 202 of a plurality of sensors in correspondence. There are cases where there are hundreds to thousands of sensors, depending on their types, for example, temperature of cylinder, oil, cooling water, pressure of oil and cooling water, shaft rotation speed, room temperature, operating time, etc. is output as the sensor value. A sensor value not only represents the output or state of a facility or plant, but may also be a control signal for controlling the state of something to a certain value (for example, a target value).

The operation of the anomaly detection device 100 includes a “sensor group setting” process for setting a sensor group using the data accumulated in the sensor signal accumulation unit 103, and a learning data processing using the data accumulated in the sensor signal accumulation unit 103. There are two phases: a “learning” process for generating and storing , and an “abnormality detection” process for detecting anomalies based on input signals. Basically, "sensor group setting" and "learning" are offline processes, and "abnormality detection" is online processing. However, "abnormality detection" can also be processed offline. In the following description, these are distinguished by the terms "at the time of sensor group setting", "at the time of learning", and "at the time of abnormality detection".

The operation of the abnormality detection device 100 of the embodiment will be described with reference to the processing flow of FIG.
Note that FIG. 3 shows an outline of the processing.

(a) is sensor group setting processing, in which sensor signals for a specified period are input (S301), similarities between sensor signals are calculated (S302), and sensor groups are set based on the similarities (S303).

(b) is anomaly measure calculation processing during learning, in which sensor signals during the learning period are input (S311), feature vector extraction (S312), anomaly measure calculation (S313), and threshold value calculation (S314) are performed. .

(c) is abnormality determination processing at the time of abnormality detection, in which a sensor signal to be detected is input (S321), a feature vector is extracted (S322), and an abnormality measure is calculated (S323). Then, the normality/abnormality of the facility is determined by comparing the calculated abnormality measure with the threshold obtained in S314 (S324). Note that (b) and (c) are processes for each group set by the sensor group setting unit 105 .

4, 5, 9A, 9B, 10A, and 11 will be used to describe detailed flows of each of (a), (b), and (c) in order.

The sensor group setting process of the first embodiment will be described with reference to the flow of FIG.
First, the signal input unit (first sensor signal input unit) 104 inputs a sensor signal of a specified period among the sensor values accumulated in the sensor signal accumulation unit 103 (S401). Next, in the sensor group setting unit 105, a two-dimensional frequency distribution image is created by round-robin of two sensors (S402). Next, the degree of similarity between sensor signals is calculated based on the two-dimensional frequency distribution image (S403).

Next, hierarchical clustering based on similarity is performed (S404). All input sensor signals are assigned to each cluster without duplication, which is a sensor group. Finally, the group information is stored in the group information storage unit 106 (S405). The output format output to the output unit 113 is a list of sensor names or numbers of used sensors or sensor names or numbers of unused sensors for each sensor group.

Here, the two-dimensional frequency distribution calculation process (S402) will be described with reference to FIG. FIG. 5 is a diagram showing a flow of two-dimensional frequency distribution calculation processing.
First, a sensor signal for a specified period is input (S501). The processing from steps S503 to S506 is repeated for each sensor signal (S502, loop 1). First, the maximum value (MAX) and minimum value (MIN) of the data in the learning period are obtained (S503). Next, the step size S for dividing the range from the minimum value to the maximum value by the specified number N is calculated (S504). It can be calculated by S=(MAX-MIN)/N. Next, the processing range for calculating the two-dimensional frequency distribution is calculated (S505). Here, the processing range from MIN to MAX calculated in step S503 is used as it is.

Next, for all the data in the learning period, the bin number (BNO) is calculated from the sensor signal value (F) by the following equation (S506).
BNO=INT(N*(F−MIN)/(MAX−MIN))
However, the function INT(X) represents the integer part of X. By using the bin number (BNO), each signal value is converted to an integer value of (N+1) steps from the minimum value 0 to the maximum value N.

Next, two sensors are extracted from the plurality of sensors, and a two-dimensional frequency distribution is calculated based on a combination of respective sensor signals. The processing from steps S508 to S510 is repeated for all sensor combinations (S507, loop 2). Here, the combination of the same sensor is included in the combination of two sensors. Therefore, the number of sensor combinations (the number of repetitions) is (the number of sensors)×(the number of sensors+1)/2.

First, a two-dimensional array for two-dimensional distribution calculation is secured, and 0 is set to all elements (S508). The size of the array is N. For all the data in the learning period, 1 is added to the array elements corresponding to the bin numbers BNO of the two sensor signals (S509). That is, the bin numbers of one sensor signal correspond to column elements, and the bin numbers of the other sensor signal correspond to row elements. Through this processing, a two-dimensional frequency distribution (histogram) of signals from the two sensors is calculated. This frequency distribution is converted into an image and saved (S510). A conversion method will be described later. FIG. 6 is a diagram showing the relationship between time-series sensor signals and two-dimensional frequency distribution images.

An example of the image conversion method in step S510 will be described.
First, the maximum value of the array elements, that is, the maximum frequency is obtained. It is assumed that the image size is the same as the array size, and the pixel value of the coordinates corresponding to the value of each element is, for example, 255×array element value/maximum frequency. The numerical value 255 is the maximum value when a pixel value is represented by 8 bits, and if this value is used, it can be saved as it is in the bitmap format. Alternatively, the pixel value is 255×LOG (array element value+1)/LOG (maximum frequency+1). However, the function LOG(X) represents the logarithm of X. By using such a conversion formula, it is possible to associate a non-zero pixel value with a non-zero frequency even when the maximum frequency is large.

The method of creating the frequency distribution image is not limited to the above method. For example, instead of a simple frequency distribution, a Gaussian distribution or other weighted filter may be assigned to one piece of data and superimposed. Alternatively, the image obtained by the above method may be subjected to a maximum value filter of a predetermined size, an average filter, or other weighted filters. Also, instead of 8 bits, it may be converted to 16 bits. In addition, it is not always necessary to save in image format, and the two-dimensional array may be saved in binary or text format without conversion.

Next, the similarity calculation processing between sensor signals (S403) will be described.
Here, the degree of similarity between sensor signals represents a quantification of whether or not the signal values influence each other. Therefore, the degree of similarity is calculated using the two-dimensional frequency distribution image calculated in step S402.

FIG. 7 is a diagram for explaining similarity calculation between sensor a and sensor b. From the left, two-dimensional frequency distribution images of sensor a, sensor b, and sensor a and sensor b.

These images obtained by the processing in FIG. 5 are represented by high pixel values where the density is high on the two-dimensional feature space. This is a grayscale image in which pixel values of 0 are represented by white and pixel values of 255 are represented by black, unlike a normal gray scale image. From these images, the non-zero pixels are first counted as Count(a, a), Count(b, b) and Count(a, b), respectively. Similarity (a, b) is calculated by (Equation 1). However, if Count(b, b) > Count(a, a), calculate by replacing a and b in the following formula.

It is a formula designed based on the idea that the smaller the value range of the other sensor when the value of the sensor with the larger number of states is determined, the higher the similarity. The degree of similarity becomes 0 when the entire surface is filled.

8A-8C are diagrams showing some examples of two-dimensional frequency distribution images. The horizontal axis indicates the signal value (bin number) of sensor a, and the vertical axis indicates the signal value (bin number) of sensor b.

The pattern of the two-dimensional frequency distribution image changes according to the strength of the correlation between the two sensors. 8A and 8B show strong correlation, and FIG. 8A shows a case where there is a time lag in state transition. FIG. 8C is the case where the correlation is weak. Here, the similarity in the two-dimensional frequency distribution image in FIG. 8A is 0.893, the similarity in the two-dimensional frequency distribution image in FIG. 8B is 0.838, and the similarity in the two-dimensional frequency distribution image in FIG. is 0.084.

A correlation coefficient is known as a numerical value representing the relationship between data, but this is a scale representing linearity and cannot cover all cases where data affect each other. FIG. 8A shows an example in which the mutual influence of sensors is strong but the correlation coefficient is low.

Next, the hierarchical clustering process (S404) will be described.
Hierarchical clustering starts from assigning individual data to clusters one by one, and recursively combines similar clusters. Methods such as the shortest distance method, the longest distance method, and the group average method are available depending on the criteria for selecting clusters to be combined. In each method, the degree of similarity between clusters is defined by the maximum value, minimum value, and average value of the degree of similarity between data across clusters. Pairs with large similarities between clusters are sequentially combined to form one cluster, and when the similarities between all clusters fall below a predetermined similarity standard value, the combination is stopped. However, if the total number of data contained in the two clusters of interest is greater than the predetermined maximum number of sensors, the similarity is considered to be 0, so that the number of data contained in one cluster does not exceed the maximum number make it The similarity reference value is a parameter and specifies a real number between 0 and 1. The maximum number of sensors is also a parameter.

Embodiment 2 Sensor group setting processing will be described with reference to the flow of FIG. 9A. The second embodiment is a process of preliminarily designating sensors to be grouped together.

First, the signal input unit (first sensor signal input unit) 104 inputs a sensor signal of a specified period among the sensor values accumulated in the sensor signal accumulation unit 103 (S901). Next, in the sensor group setting unit 105, a two-dimensional frequency distribution image is created by round-robin of two sensors (S902). Next, the degree of similarity between sensor signals is calculated based on the two-dimensional frequency distribution image (S903). Next, an instruction regarding sensor group setting is input (S904). It is assumed that the sensors to be included in the same sensor group are specified, regardless of the method such as input from the GUI or reading of a file. A plurality of combinations may be specified.

Next, the similarity between the same sensor group and the designated sensor is set to 1 regardless of the value calculated in step S903 (S905). Next, hierarchical clustering based on similarity is performed (S906). Sensors designated as the same sensor group have a similarity of 1, so they are combined at the beginning of hierarchical clustering, and sensors that are not designated are combined according to their similarity. As in step S404, the maximum number of sensors and the similarity standard value are specified in advance. When the maximum number of sensors is exceeded, no merging is performed. When the distance between all clusters is less than the similarity standard value, merging is stopped. do. Finally, the group information is stored in the group information storage unit 106 (S907).

The sensor group setting process of the third embodiment will be described with reference to the flow of FIG. 9B. Example 3 is a process of grouping sensors similar to sensors preliminarily designated as the core of a group into the same group.

First, sensor signal input (S911), two-dimensional frequency distribution image creation (S912), and sensor signal similarity calculation (S913) are the same as in the second embodiment.

Next, an instruction regarding sensor group setting is input (S914). Here, it is assumed that a sensor group consisting of one or more sensors to be used as the nucleus of the sensor group is specified. The number of instructions may be plural, and the following processing is performed independently for each instruction (S915).

First, a new cluster is created and the designated sensor group is put into the cluster (S916). Next, the similarity between the undesignated sensor and the sensor group is calculated (S917). The similarity between the sensor and the cluster is, for example, the average of the similarities between the target sensor and the sensors in the sensor group. Alternatively, the minimum or maximum value.

Next, the sensors are placed in the same cluster in descending order of calculated similarity (S918). However, it is assumed that the number of sensors is within a predetermined maximum number of sensors and is equal to or greater than a predetermined similarity reference value. When the processing of steps S916 to S918 is completed for the number of instructions, next, one new cluster is created and sensors not included in any cluster are added (S919). Finally, the group information is stored in the group information storage unit 106 (S920).

A further modification of the sensor group setting process described with reference to FIGS. 4, 9A, and 9B will be described.

In the first example, the sensors to be included in all the groups are specified in advance, and after group setting by one of the above methods, the specified sensors are added to the previous group. In the second example, after the sensor signal is input (S401), data cleansing processing based on the sensor signal is performed. This is a process of removing noise data such as missing values and error values that adversely affect analysis. Specifically, based on the histogram for each sensor, data deviating from the main distribution and having a low occurrence rate are deleted. The data cleansing process can improve the calculation accuracy of the similarity between sensors.

Next, the abnormality measure calculation process during learning in FIG. 3B will be described with reference to the flow in FIG. 10A. This processing is performed for each sensor group set in S303.

First, the signal input unit (second sensor signal input unit) 107 inputs a sensor signal of a specified period (learning period) among the sensor values accumulated in the sensor signal accumulation unit 103 (S1001). A period during which the equipment was in a normal state shall be designated as the learning period. Next, the feature vector extraction unit 108 normalizes the input sensor signal (S1002). The feature vector extraction unit 108 acquires information on the sensors included in the group of interest from the group information storage unit 106, and the sensors included in the group are subjected to canonicalization and feature vector extraction, which will be described later.

Canonicalization of sensor signals is performed in order to treat a plurality of sensor signals with different units and scales in the same way. Specifically, using the average and standard deviation of each sensor signal during the learning period, each sensor signal is transformed so that the average is 0 and the variance is 1. The average and standard deviation of each sensor signal are stored so that the same conversion can be performed when an abnormality is detected. Alternatively, each sensor signal is converted so that the maximum value is 1 and the minimum value is 0 using the maximum value and minimum value of each sensor signal during the learning period. Alternatively, preset upper and lower limits may be used instead of the maximum and minimum values. In this case, the maximum and minimum values or the upper and lower limits of each sensor signal are stored in the learning result accumulation unit 109 so that similar conversion can be performed when an abnormality is detected.

Next, the feature vector extraction unit 108 extracts a feature vector at each time (S1003). A feature vector is obtained by arranging the canonicalized sensor signals as elements as they are. Alternatively, windows of ±1, ±2, . Features can also be extracted. Alternatively, discrete wavelet transform (DWT) may be applied to decompose into frequency components.

Next, the anomaly measure calculation unit 109 calculates an anomaly measure for the learning period. First, the learning period is divided into a plurality of intervals (S1004), and the following processing is repeated for all extracted feature vectors (S1005). A vector of interest, which is a feature vector sequentially selected corresponding to a plurality of sections, and data in the learning period excluding the same section as the vector of interest are used as learning data (S1006). An abnormality measure is calculated using the vector of interest and the learning data (S1007). For example, the segmentation in step S1004 is for each day. Alternatively, in the case of batch processing such as a chemical plant, it may be set for each batch, for processing equipment for each individual to be processed, and for medical equipment such as MRI, it may be set for each person to be inspected. A local subspace method (LSC: Local Sub-space Classifier) or a projection distance method (PDM: Projection Distance Method) can be used for the abnormality measure calculation process of step S1007.

FIG. 10B is a diagram explaining anomaly measure calculation processing by the local subspace method.
The local subspace method selects k neighboring vectors for the vector of interest q, and measures the projection distance when the vector of interest q is projected onto the k-1-dimensional affine subspace spanned by the selected k neighboring vectors. is. In FIG. 10B, k=3 neighborhood vectors x1 to x3 form an affine subspace. The point Xb on the affine subspace closest to the vector of interest q is the projection point (reference vector), and the distance from the vector of interest q to the reference vector Xb is the anomaly measure.

A specific calculation method will be explained. From the evaluation data q and its k neighboring vectors xi (i=1, . A correlation matrix C is obtained. Next, the coefficient vector b representing the weighting of the neighborhood vector xi is calculated from (Equation 3). The anomaly measure d is calculated by the norm of the vector (q−Xb) or its square.

Although the case of k=3 has been described in FIG. 10B, any number may be used as long as the number of dimensions is sufficiently smaller than the number of dimensions of the feature vector. When k=1, the process is equivalent to the nearest neighbor method.

The projected distance method is a method that creates a subspace with a unique origin for the selected feature vector, ie, an affine subspace (a space with maximum variance). A plurality of feature vectors corresponding to the vector of interest are selected by some method, and an affine subspace is calculated by the following method.

First, the average μ and covariance matrix Σ of the selected feature vectors are obtained, then the eigenvalue problem of Σ is solved, and the matrix U in which the eigenvectors corresponding to the r eigenvalues specified in advance from the largest value are arranged is obtained. Let it be the orthonormal basis of the affine subspace. Let r be a number smaller than the dimension of the feature vector and smaller than the number of selected data. Alternatively, instead of setting r to a fixed number, it may be set to a value when the contribution rate accumulated from the larger eigenvalue exceeds a predetermined rate. The point on the affine subspace closest to the vector of interest becomes the reference vector. A residual vector is obtained by subtracting the reference vector from the vector of interest, and the norm of the residual vector or the square of the norm is the anomaly measure.

Here, as a method of selecting a plurality of feature vectors, there is a method of selecting a predetermined number of feature vectors from tens to hundreds in order of proximity to the vector of interest. Alternatively, the feature vectors to be learned may be clustered in advance, and the feature vector included in the cluster closest to the vector of interest may be selected. Alternatively, a Gaussian process or a local mean distance method, in which the distance to the mean vector of the k-neighboring vectors of the vector of interest q is used as an anomaly measure, may be used.

After the abnormality measure calculation process for all feature vectors, the threshold calculation unit 110 calculates a threshold (S1008). This threshold value is compared with the anomaly measure input to the anomaly detector 113 and used to determine whether the equipment is normal or abnormal. The threshold calculation unit 107 calculates a threshold for not judging normal learning data as abnormal. In other words, the maximum value of the anomaly measure obtained from normal learning data is calculated as the threshold value.

Alternatively, a threshold may be calculated for judging normal learning data to be normal in a proportion larger than a predetermined ratio. In this case, the anomaly measures obtained from the normal learning data are sorted, and the anomaly measure reaching the above-described predetermined ratio is adopted as the threshold from the lowest anomaly measure.

In the learning process of FIG. 10A, the learning result is stored in the learning result accumulation unit 111. FIG. Data saved as learning results include at least parameters for feature vector extraction, parameters for anomaly measure calculation, parameters for sensor canonicalization, all extracted feature vector data, anomaly judgment thresholds, feature The parameters for vector extraction and the parameters for anomaly measure calculation are the same as those specified at the time of learning. The parameters for sensor canonicalization are the average, standard deviation, maximum value, minimum value, etc. of each sensor signal calculated by the sensor signal input unit 107 in the process of step S1002.

Next, referring to FIG. 11, the abnormality determination process at the time of abnormality detection in FIG. 3(c) will be described. FIG. 11 is a diagram showing a flow of abnormality detection processing (S321 to S324) by the abnormality detection unit 112. As shown in FIG. Here, for data accumulated in the sensor signal accumulation unit 103 in a specified period or newly observed data, feature vector extraction (feature vector extraction unit 108) and anomaly measure calculation (abnormality measure Calculation unit 109) is performed, and this is compared with a threshold value (threshold value calculation unit 111), and abnormality detection unit 112 determines whether it is normal or abnormal.

The anomaly detection unit 110 reads the learning result saved during learning from the database (S1101). At that time, the user selects an appropriate processing number based on the anomaly measure and the threshold at the time of learning, and the learning result associated with the processing number is used. The signal input unit (second sensor signal input unit) 107 inputs the sensor signal 102 from the sensor signal storage unit 103 or the facility 101 (S1102), and normalizes each sensor signal (S1103). At this time, the parameters used for the canonical processing in step S1002 are used. Next, the feature vector extraction unit 108 extracts a feature vector from the selected sensor signal using the same method as the process in step S1003 (S1104).

Next, the processing of steps S1106 and S1107 is performed for all feature vectors (S1105, loop). The anomaly measure calculation unit 109 calculates an anomaly measure using the vector of interest and the learning data (S1106). This process is performed in the same manner as step S1007 in FIG. 10A, but all learning data is used. The anomaly detection unit 112 compares the threshold read in step S1101 with the anomaly measure calculated in step S1106. If the anomaly measure is less than or equal to the threshold value, the equipment is determined to be "normal", and if the anomaly measure is greater than the threshold value, it is determined to be "abnormal" (S1107).

Next, an example of a user interface (GUI) of the anomaly detection device 100 for realizing the above operations will be described.

FIG. 12 is an example of a GUI for setting analysis conditions including a target period and processing parameters for implementing sensor group setting. It is assumed that the past sensor signal 102 is stored in the sensor signal storage unit 103 in association with the facility ID and time.

On the sensor group setting screen 1201, the target equipment, target period, data cleansing parameters, sensor group setting parameters, sensor group setting method, group instruction file name, and recipe name are entered. In the facility ID input window 1202, the ID of the target facility is entered. When the equipment list display button 1203 is pressed, a list of device IDs of data stored in the sensor signal storage unit 103 is displayed, and a selection is made from the list. If there is only one facility 101 connected to the anomaly detection device 100, the facility ID input window 1202 is not displayed. Here, the sensor group setting screen 1201 is displayed on the output unit 113 in FIG. 1, for example.

The start date and end date of the processing target period are entered in the target period input window 1204 . A data cleansing check box 1205 is checked if the data cleansing process is to be performed before the sensor group setting process. In that case, the cleansing ratio is entered in the cleansing ratio input window 1206 . If the sensor signal value deviates from the main distribution and the incidence rate is lower than the entered value, it is subject to data deletion.

In the maximum number of sensors input window 1207 and similarity reference value input window 1208, the sensor group setting parameters referred to in step S404 of FIG. 4, step S906 of FIG. 9A, and step S918 of FIG. 9B are input. A sensor group setting method selection button 1209 is used to select one of the methods. The examples in this figure correspond to methods according to the processing flows of FIGS. 4, 9A, and 9B. If "Same group instruction" or "Nuclear sensor instruction" is selected, the instruction file name is entered in the instruction file input window 1210 . The instruction file describes, for example, a set of sensor names to be grouped together, or one or more sensor names to be the nucleus of the group.

After the information of the above conditions is determined, the execution button 1211 is pressed to execute the sensor group setting process. First, when the data cleansing check box 1205 is checked, data cleansing processing is performed on the sensor signal in the target period. Next, according to the selection by the sensor group setting method selection button 1209, a sensor group is set according to the processing flow of either FIG. 4, FIG. 9A, or FIG. 9B, and the group information is saved.

After the processing ends, a result display screen, which will be described later, is displayed. After the confirmation by the user is completed, the screen returns to the sensor group setting screen 1201 . By pressing the redisplay button 1212, the result display screen can be side-displayed. By entering a registered name in the registered name input window 1213 and pressing a register button 1214, the sensor group information is saved in association with the equipment ID and the registered name, and the process ends. When the end button 1215 is pressed, the process ends without doing anything. In this case, the once stored sensor group information is deleted.

13A and 13B are examples of GUIs for presenting sensor group results to a user. The user selects a tab displayed at the top of each screen to switch to either a distribution image display screen 1301 or a sensor signal display screen 1302 . Here, the distribution image display screen 1301 and the sensor signal display screen 1302 are displayed on the output unit 113 in FIG. 1, for example.

FIG. 13A is an example of a distribution image display screen. A distribution image display screen 1301 displays a distribution image among sensors belonging to a group selected in a group selection window 1303 in accordance with a display order selected in a display order selection window 1304 .

In the group selection window 1303, a list consisting of the set sensor group number and "Others" is displayed by pressing the list display button, and the group to be displayed is specified by selecting one of them. Group 1 is selected prior to selection by the user. In the display order selection window 1304, it is possible to select either "sensor number" or "similarity" by pressing a list display button. When "sensor number" is selected, the sensor numbers are displayed in descending order, and when "similarity" is selected, the average similarity is displayed in descending order. Average similarity is the average value of similarities between a sensor and another sensor in the group.

A sensor number and a corresponding sensor name are displayed in the sensor number column 1305 and the sensor name column 1306, respectively. A destination selection window 1307 and a move button 1308 are displayed on each line. The action will be described later. In the distribution image display window 1309, two-dimensional frequency distribution images and similarities of the sensors corresponding to the rows and the sensors corresponding to the columns are displayed in a matrix. Even if the vertical axis and the horizontal axis of the sensor number are exchanged, the distribution image only changes symmetrically, and the similarity value becomes the same value. is displayed. When the display order is switched in the display order selection window 1304, both rows and columns are exchanged, and if the similarity is on the lower left side, it is exchanged with the distribution image on the opposite side. Create an image in which the vertical axis and the horizontal axis are exchanged from the image, and replace it.

Group editing is also possible on this screen. By selecting a destination in the destination selection window 1307 and pressing a move button 1308, the sensor in the corresponding row can be moved to another group. Select either a group other than the current group or "Others" as the destination. The corresponding sensor is deleted from the group being displayed, and the corresponding row and column are deleted and displayed aligned to the top and left. The average similarity is recalculated.

An operation selection window 1310 is used to select whether to register or discard the group. After all the groups have been selected, pressing the OK button 1311 saves the group information of the group selected for registration, and returns to the sensor group setting screen 1201 . When the cancel button 1311 is pressed, the sensor group is returned to the state before editing and the sensor group setting screen 1201 is displayed. While the OK button 1311 has not been pressed even once, the registration button 1214 cannot be pressed on the sensor group setting screen 1201 .

The results of group selection, display order selection, sensor group movement, and operation selection performed on the distribution image display screen 1301 are all reflected on the sensor signal display screen 1302 . Further, the result of sensor group movement is also reflected on the display screen when another group is selected.

FIG. 13B is an example of a sensor signal display screen 1302 . The sensor signal display screen 1302 displays a time-series sensor signal graph of sensors belonging to the group selected in the group selection window 1303 in accordance with the display order selected in the display order selection window 1304 . The display period can be changed by inputting to the period input window 1312 . This change is performed for all sensors at once. The sensor signal display window 1313 displays a time-series graph of sensor signals corresponding to each row.

On the sensor signal display screen 1302 , group selection, display order selection, sensor group movement, and operation selection similar to the distribution image display screen 1301 can be performed, and the results are reflected on the distribution image display screen 1301 . Also, an OK button 1311 and a cancel button 1311 can be pressed.

FIG. 14A is an example of a GUI for setting analysis conditions including a learning period and processing parameters for performing offline analysis. On this screen, it is also possible to register the calculated learning result as a recipe. It is also assumed that past sensor signals 102 are stored in the database in association with facility IDs and times.

On the offline analysis condition setting screen 1401, the target facility, learning period, test period, and anomaly measure calculation parameter are input. In the facility ID input window 1402, the ID of the target facility is entered. When the equipment list display button 1403 is pressed, a list of device IDs of data stored in the sensor signal storage unit 103 is displayed, and a selection is made from the list. If there is only one facility 101 connected to the anomaly detection device 100, the facility ID input window 1402 is not displayed. Here, the offline analysis condition setting screen 1401 is displayed on the output unit 113 in FIG. 1, for example.

In the learning period input window 1404, the user inputs the start date and end date of the period from which the learning data is to be extracted. In the test period input window 1405, the start date and end date of the period to be analyzed are input.

In the anomaly measure calculation parameter input window 1406, parameters used for anomaly measure calculation are entered. The figure shows an example in which the local subspace is adopted as a method, and the number of neighborhood vectors and the regularization parameter are input. The regularization parameter is a small number added to the diagonal components to prevent the inverse of the correlation matrix C from being found in equation (2).

In the sensor group registration name input window 1407 and the group number input window, the registration name and group number of the sensor group set and registered on the screens of FIGS. 13A and 13B are entered. After the above analysis condition information is determined, the execution button 1409 is pressed to execute the offline analysis.

First, learning is performed according to the processing flow of FIG. 10A using sensor signals during the learning period. As learning results, the average and standard deviation for each sensor signal calculated in step S1002, all feature vector data during the learning period extracted in step S1003, and the threshold value calculated in step S1008 are saved.

Furthermore, using the sensor signals during the learning period and the test period, the abnormality measure is calculated according to the processing flow of FIG. . However, the data in the learning period is judged to be normal or abnormal using the anomaly measure calculated in step S1007.

After the analysis is completed, a result display screen, which will be described later, is displayed. After the confirmation by the user is completed, the screen returns to the offline analysis condition setting screen 1401 . By inputting a recipe name in the recipe name input window 1410 and pressing a registration button 1411, the learning result and the analysis result are stored in association with the equipment ID and the recipe name, and the process ends. Here, the learning result includes data created and saved by execution of learning, as well as anomaly measure calculation parameters, sensor group registration names, and group numbers input through input windows 1406 to 1408 . When the end button 1412 is pressed, the process ends without doing anything. In this case, the learning result created and saved by learning and the analysis result created and saved by the subsequent anomaly detection process are deleted or overwritten by the next analysis.

The registered learning results are labeled as active or inactive and managed, after which online analysis is performed. In the online analysis, the processing shown in FIG. 11 is performed for newly input data using the active learning result information with the matching device ID, and the result is stored in association with the recipe name and processing date and time. . These processes are performed periodically, for example, every day. For equipment with a short sampling interval or equipment that requires real-time performance, the interval of execution should be shortened.

FIG. 14B is an example of a GUI for designating display targets of online analysis results.
The user specifies equipment, recipes, and periods to be displayed from the display target specification screen 1421 . First, a facility ID is selected from the device ID selection window 1422 . Next, a recipe to be displayed is selected from the recipe list for the facility ID 1422 using the recipe name selection window 1423 . The data recording period display portion 1424 displays the start date and end date of the period during which the input recipe is processed and the record is left. In the result display period specification window 1425, enter the start date and end date of the period for which the results are to be displayed. When the display button 1426 is pressed, the results of the abnormality detection processing are displayed. When the end button 1427 is pressed, the process of designating the display target ends. Here, the display target designation screen 1421 is displayed on the output unit 113 in FIG. 1, for example.

15A and 15B are examples of GUIs for showing analysis results to the user. When the user selects a tab displayed at the top of each screen, the screen is switched to either an analysis result overall display screen 1501 or an analysis result enlarged display screen 1502 . Here, the analysis result entire display screen 1501 and the analysis result enlarged display screen 1502 are displayed on the output unit 113 in FIG. 1, for example.

FIG. 15A is an example of an analysis result overall display screen 1501 . The analysis result overall display screen 1501 displays a time-series graph of anomaly measures, threshold values, determination results, and sensor signals for a specified period. The period display window 1503 displays the learning period and test period specified in FIG. 14A when displaying the results of the offline analysis. When displaying the results of the online analysis, although not shown, the result display period specified in FIG. 14B is displayed.

An abnormality measure display window 1504 displays an abnormality measure 1504a, a threshold value 1504b (broken line), and a determination result 1504c in a specified learning period/test period or result display period. Also, a circle 1504d is displayed in the section used for learning. A sensor signal display window 1505 displays a time-series sensor signal 1505a for a specified sensor during a specified learning period/test period or result display period.

In the sensor selection window 1506, the sensor is specified by the user's input. However, the first used sensor is selected before the user designates it. A cursor 1507 represents the starting point for enlarged display, and can be moved by the user's mouse operation. The display days specification window 508 displays the number of days from the start point to the end point of enlarged display on the analysis result enlarged display screen 1502, and can be input on this screen. A date display window 1509 displays the date at the cursor position. By pressing the end button 1510, both the analysis result entire display screen 1501 and the analysis result enlarged display screen 1502 are erased, and the display of the analysis result is terminated.

FIG. 15B is an example of an analysis result enlarged display screen 1502 . On the analysis result enlarged display screen 1502, starting from the date indicated by the cursor 1507 on the analysis result overall display screen 1501, the abnormality measure, threshold value, and judgment within the period of the number of days specified in the display days specification window 1509 are displayed. Results and a time series graph of the sensor signal are displayed. That is, in the abnormality measure display window 1504 and the sensor signal display window 1505, the same information as the analysis result overall display screen 1501 is displayed in an enlarged manner.

Note that a scroll bar 1511 and a scroll bar area 1512 are additionally displayed on the analysis result enlarged display screen 1502 . The length of the scroll bar 1511 corresponds to the number of days specified in the display days specification window 1508 , and the overall length of the scroll bar area 1511 corresponds to the period displayed on the analysis result overall display screen 1501 . Also, the left end of the scroll bar 1511 corresponds to the starting point of enlarged display. The user can also change the starting point of the display by operating the scroll bar 1511 , and this change is reflected in the position of the cursor 1507 on the entire analysis result display screen 1501 and the display of the date display window 1509 .

In the above-described embodiment, in abnormality detection based on a plurality of time-series sensor signals, all sensors are divided into appropriate sensor groups so as to improve sensitivity, and abnormality detection is performed for each sensor group. According to the above embodiment, since all sensors are targeted and divided into an appropriate number of sensor groups based on the similarity (similarity) between sensor signals, the anomaly detection sensitivity can be improved and which sensor Abnormalities that have occurred can also be detected.

100 Abnormality detection device 101 Equipment 102 Sensor signal 103 Sensor signal storage unit 104 Signal input unit (first sensor signal input unit)
105 sensor group setting unit 106 group information storage unit,
107 signal input unit (second sensor signal input unit)
108 Feature vector extraction unit 109 Abnormality measure calculation unit 110 Threshold calculation unit 111 Learning result accumulation unit 112 Abnormality detection unit 113 Output unit

Claims (9)

An abnormality detection device that performs sensor group setting processing, learning processing, and abnormality determination processing,
a first sensor signal input unit to which a plurality of time-series sensor signals output from a plurality of sensors attached to equipment are input;
A screen for input operation of sensor group setting conditions used in the sensor group setting process is displayed on the output unit, and the degree of similarity between the plurality of sensor signals input to the first sensor signal input unit is calculated. a sensor group setting unit that obtains and sets a sensor group based on the similarity and the sensor group setting condition input via the screen;
a second sensor signal input unit to which the plurality of sensor signals output from the plurality of sensors are input;
a feature vector extraction unit that is used in the abnormality determination process and the learning process and extracts a feature vector for each time from the plurality of sensor signals input to the second sensor signal input unit for each sensor group;
an anomaly measure calculation unit that is used in the anomaly determination process and calculates an anomaly measure at each time using the feature vector of a designated learning period as learning data for each sensor group;
an abnormality detection unit that is used in the abnormality determination process and determines whether the sensor signal at each time is normal or abnormal by comparing the abnormality measure with a predetermined threshold value for each sensor group;
has
The feature vector extraction unit acquires values that are elements of the feature vector by performing any of the following processes,
normalizing the sensor signal;
subjecting the discrete wavelet transform to the sensor signal;
The anomaly measure is
A distance between a reference vector obtained from the feature vector as the learning data and the feature vector to be calculated,
The predetermined threshold is
the maximum value of the anomaly measure obtained from the normal learning data;
A value adjusted to determine that the normal learning data is normal more than a predetermined percentage,
Abnormality detection device which is either. 2. The anomaly detection device according to claim 1, wherein the sensor group setting conditions include at least a maximum number of sensors per sensor group. The setting of the sensor group by the sensor group setting unit is performed using a hierarchical clustering process that involves temporarily creating a plurality of clusters containing one or more sensors,
2. The anomaly detection device according to claim 1, wherein the sensor group setting conditions include at least a similarity reference value for determining whether the first cluster and the second cluster need to be combined. The sensor group setting conditions include at least designation of the core sensor of the sensor group,
The sensor group set using the sensor group setting condition includes at least the core sensor and a sensor selected based on a degree of similarity with the core sensor. Item 2. The abnormality detection device according to item 1. 2. The anomaly detection device according to claim 1, wherein the sensor group setting conditions include at least specification of sensors to be included in all of the sensor groups. 2. The anomaly detection device according to claim 1, wherein said sensor group setting conditions include at least conditions for data cleansing processing for deleting outliers out of the histogram distribution of said sensor signals. 2. The abnormality detection device according to claim 1, wherein the abnormality detection unit displays the similarity for each of the sensors included in the sensor group on the output unit. 2. The abnormality detection device according to claim 1, wherein the abnormality detection section displays a distribution image of the sensor signals for each of the sensors included in the sensor group on the output section. An abnormality detection method for performing sensor group setting processing, learning processing, and abnormality determination processing,
Input multiple time-series sensor signals output from multiple sensors attached to equipment,
In the sensor group setting process, obtaining a similarity between the plurality of sensor signals, setting a sensor group based on the similarity,
In the abnormality determination process and the learning process, a feature vector is extracted for each time from the plurality of sensor signals for each sensor group,
In the abnormality determination process, for each sensor group, calculating an abnormality measure at each time using the feature vector of a designated learning period as learning data,
In the abnormality determination process, it is determined whether the sensor signal at each time is normal or abnormal by comparing the abnormality measure with a predetermined threshold value for each sensor group;
The extraction of the feature vector is performed by performing any of the following processes to acquire values that are elements of the feature vector,
normalizing the sensor signal;
subjecting the discrete wavelet transform to the sensor signal;
The anomaly measure is
A distance between a reference vector obtained from the feature vector as the learning data and the feature vector to be calculated,
The predetermined threshold is
The maximum value of the anomaly measure obtained from the normal learning data,
A value adjusted to determine that the normal learning data is normal more than a predetermined percentage,
An anomaly detection method that is either