JP6129508B2 - Anomaly detection pre-processing apparatus and method, program, and anomaly detection apparatus having the same - Google Patents

Description

  The present invention relates to an abnormality detection preprocessing apparatus and method, a program, and an abnormality detection apparatus including the same.

  Conventionally, a statistical method called Mahalanobis distance is generally used to detect numerical anomalies. Mahalanobis distance is a method based on the assumption that normal data follows a normal distribution. In actual data, there are many cases where the normal data does not follow a normal distribution. (For example, the following patent document 1).

JP 2007-248089 A

However, even if it is determined that the normal data is away from the normal distribution, there is no method for bringing the data closer to the normal distribution in accordance with the purpose of the abnormality detection, and the abnormality cannot be accurately detected by the Mahalanobis distance. There was a problem.
For example, if processing such as adding signal values and averaging is performed, the data approaches the normal distribution from the central limit theorem, so there is a method to approximate the normal distribution unless it is related to the purpose of abnormality detection . However, in that case, even the abnormal signal to be determined approaches the normal distribution, the characteristics of the abnormal signal change, and does not meet the purpose of abnormality detection, and the above problem cannot be solved. .

  The present invention has been made in view of such circumstances, and is a simple and accurate abnormality detection preprocessing apparatus and method and program capable of detecting an abnormality of collected data, and an abnormality detection apparatus having the same The purpose is to provide.

In order to solve the above problems, the present invention employs the following means.
The present invention, the distribution data related to two or more variables in a predetermined period of time that is measured during normal, it is determined determining means for determining whether or not made a distribution in accordance with the normal distribution, not a distribution follows a normal distribution A correction term calculating means for calculating a difference between a plurality of provisional nonlinear models for fitting the distribution data and a regression line of each provisional nonlinear model as a correction term for correcting the distribution data; The correction data calculated based on the abnormality detection model is selected as the abnormality detection model in the case where the distribution data corrected by the correction term causes the distribution that most closely follows the normal distribution to be used for abnormality detection. There is provided an abnormality detection pre-processing device comprising selection means for selecting a term as an abnormality detection correction term used for abnormality detection.

According to such a configuration, it is determined whether or not the distribution data related to two or more variables within a predetermined period measured in a normal state is a distribution according to a normal distribution, and is determined not to be a distribution according to a normal distribution. The data is fitted to the temporary nonlinear model, and a correction term for correcting the distribution data is calculated based on the temporary nonlinear model and the result of the regression analysis of the temporary nonlinear model. The provisional nonlinear model whose distribution data corrected by the calculated correction term yields a distribution that most closely follows the normal distribution is selected as an abnormality detection model when used in abnormality detection, and is calculated based on the abnormality detection model. The correction term is selected as a correction term used for abnormality detection.
In this way, the normal distribution of normal data is quantitatively evaluated, and if it is determined that the normal distribution is not normal, it is corrected so that it follows the normal distribution. ) Can be detected with high accuracy. Moreover, since only data measured at normal time is used, it is simpler than a method using normal data and abnormal data.

  It is preferable that the correction term calculation means of the abnormality detection preprocessing apparatus calculates a difference between the provisional nonlinear model and a regression line of the provisional nonlinear model as the correction term.

The correction term can be easily calculated based on the difference between the provisional nonlinear model and the regression line.
Further, unlike the conventional case, for example, in which an operation such as adding signal values to obtain an average value is performed and the normal distribution is followed, the present invention performs normalization by regressing a nonlinear model to a linear model. Since it is determined whether to follow the distribution, the characteristics of the original distribution data are not lost.

The correction term calculation means of the abnormality detection preprocessing device may be configured to fit a predetermined number of the distribution data selected from the distribution data determined not to follow a normal distribution to a plurality of temporary nonlinear models. Good.
Thereby, the time for fitting to the temporary nonlinear model can be reduced.

  The present invention provides determination data, which is measurement data to be determined as normal / abnormal, based on the abnormality detection preprocessing device and the abnormality detection correction term selected by the selection unit of the abnormality detection preprocessing device. Provided is an abnormality detection device comprising: an abnormality detection unit that calculates corrected correction determination data and determines whether the correction determination data is abnormal based on the Mahalanobis distance.

  It is determined whether or not the measurement data is abnormal based on the correction determination data corrected by the abnormality detection correction term determined based on the normal distribution data. Thereby, abnormality can be detected with high accuracy.

In the present invention, a first process for determining whether or not distribution data relating to two or more variables within a predetermined period measured in a normal state is a distribution according to a normal distribution, and a case where it is determined that the distribution is not a distribution according to a normal distribution A second step of calculating a difference between a plurality of provisional nonlinear models for fitting the distribution data and a regression line of each provisional nonlinear model as a correction term for correcting the distribution data; and the correction term The provisional nonlinear model that provides the distribution that most closely follows the normal distribution is selected as an abnormality detection model when used in abnormality detection, and the correction term calculated based on the abnormality detection model is There is provided an abnormality detection pre-processing method having a third process selected as an abnormality detection correction term used for abnormality detection.

In the present invention, a first process for determining whether or not distribution data relating to two or more variables within a predetermined period measured in a normal state is a distribution according to a normal distribution, and a case where it is determined that the distribution is not a distribution according to a normal distribution A second process for calculating a difference between a plurality of provisional nonlinear models for fitting the distribution data and a regression line of each provisional nonlinear model as a correction term for correcting the distribution data; The provisional nonlinear model that provides the distribution that most closely follows the normal distribution is selected as an abnormality detection model when used in abnormality detection, and the correction term calculated based on the abnormality detection model is Provided is an abnormality detection preprocessing program for causing a computer to execute a third process selected as an abnormality detection correction term used for abnormality detection.

  The present invention is advantageous in that it can easily and accurately detect an abnormality in collected data.

It is the figure which showed schematic structure of the monitoring system which concerns on one Embodiment of this invention. It is the figure which showed schematic structure of the abnormality detection apparatus which concerns on one Embodiment of this invention. It is a functional block diagram of the abnormality detection apparatus which concerns on one Embodiment of this invention. It is a figure for demonstrating calculation of a correction | amendment term. It is an operation | movement flow of the abnormality detection pre-processing apparatus of one Embodiment of this invention. It is the figure which compared before and after correction | amendment of the distribution data by a two-dimensional model, (a) The figure which shows the normal distribution property of the distribution data at the time of normal, (b) The figure which fitted the distribution data at the time of normal by the two-dimensional model, (C) The figure which corrected distribution data by the correction | amendment term, (d) It is a figure which shows the normal distribution property of the data after correction | amendment. It is the figure which compared before and after correction | amendment of the distribution data by a trigonometric function model, (a) The figure which shows the normal distribution property of the distribution data at the time of normal, (b) The figure which fitted the distribution data at the time of normal by the two-dimensional model, (C) The figure which corrected distribution data by the correction | amendment term, (d) It is a figure which shows the normal distribution property of the data after correction | amendment. It is a figure explaining calculation of the correction term in the case of the n-dimensional pattern concerning one embodiment of the present invention.

DESCRIPTION OF EMBODIMENTS Embodiments of an abnormality detection preprocessing apparatus and method and program according to the present invention and an abnormality detection apparatus including the same will be described below with reference to the drawings.
In the present embodiment, the abnormality detection pretreatment device 10 is provided in a monitoring center that monitors the gas turbine and is used for detecting an abnormality of the gas turbine. However, the present invention is not limited to this.

  FIG. 1 shows a schematic configuration of a monitoring system 100 that monitors a gas turbine facility 31 provided in a power plant from a monitoring center 30. The monitoring center 30 is provided with an abnormality detection device 20 including the abnormality detection preprocessing device 10. The gas turbine equipment 31 and the abnormality detection device 20 are connected via a network 32 so as to be able to exchange information. For example, the abnormality detection device 20 receives gas turbine operation data (measurement data), alarm information, inquiry information, and the like transmitted from the gas turbine equipment 31 at a predetermined timing. The abnormality detection apparatus 20 stores the acquired various types of information in a storage unit (details will be described later). In the present embodiment, the abnormality detection device 20 is described as being provided in the remote monitoring center 30 from the gas turbine facility 31 via the network, but the position of the abnormality detection device 20 is not limited thereto.

FIG. 2 is a block diagram showing a schematic configuration of the abnormality detection apparatus 20 according to the present embodiment.
As shown in FIG. 2, the abnormality detection device 20 according to the present embodiment is a computer system (computer system), and includes a CPU (Central Processing Unit) 11, a RAM (Random Access Memory) and other main storage devices 12, and an auxiliary device. A storage device 13, an input device 14 such as a keyboard and a mouse, an output device 15 such as a display and a printer, a communication device 16 that exchanges information by communicating with external devices, and the like.
The auxiliary storage device 13 is a computer-readable recording medium, such as a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, or a semiconductor memory. Various programs (for example, abnormality detection pre-processing program) are stored in the auxiliary storage device 13, and various processes are realized by the CPU 11 reading the program from the auxiliary storage device 13 to the main storage device 12 and executing it. Let

  FIG. 3 is a functional block diagram showing the functions provided in the abnormality detection device 20 in an expanded manner. As shown in FIG. 3, the abnormality detection device 20 includes an abnormality detection preprocessing device 10. The abnormality detection preprocessing apparatus 10 includes a determination unit (determination unit) 1, a correction term calculation unit (correction term calculation unit) 2, a selection unit (selection unit) 3, and a storage unit 4.

Next, processing contents executed in each unit included in the above-described abnormality detection preprocessing apparatus 10 will be described with reference to FIG.
The storage unit 4 stores measurement data (operation data) within a predetermined period obtained from measuring instruments provided at a plurality of locations of the gas turbine equipment 31. The measurement data includes, for example, operation data within a predetermined period measured in an unsteady state in which normal data varies particularly, such as when the gas turbine is started, and operation data that is subject to determination of normal or abnormal gas turbine equipment. And are included. Moreover, in this embodiment, the multiple places of gas turbine equipment are a combustor, a compressor, etc., for example, and measurement data are information, such as temperature and a pressure value obtained from these multiple places.

The determination unit 1 determines whether or not the distribution data regarding two or more variables within a predetermined period measured in a normal state is a distribution according to a normal distribution. For example, the determination unit 1 distributes a distribution obtained by extracting two variables of measurement data acquired from two locations within a predetermined period among measurement data acquired from a plurality of locations of the gas turbine stored in the storage unit 4. It is determined whether the distribution conforms to the normal distribution based on the normal probability plot (eg, qq plot). In the normal probability plot, when the measurement data is normally distributed, the points indicating the measurement data are arranged almost on a straight line. In addition, in this embodiment, although it demonstrates as producing | generating two-dimensional distribution data by the measurement data of two places (two variables) among the measurement data acquired from several places, this invention is not limited to this. This is also applied to the case where n-dimensional distribution data is generated from measurement data at n locations (n variables).

When it is determined that the distribution does not follow the normal distribution, the correction term calculation unit 2 distributes distribution data based on a plurality of provisional nonlinear models for fitting distribution data and the results of regression analysis of the respective provisional nonlinear models. A correction term for correcting is calculated. The correction term calculation unit 2 may fit all of the distribution data determined not to be a distribution according to the normal distribution to a temporary nonlinear model, but preferably a predetermined number of all the distribution data is selected. Fitting the distribution data to a plurality of temporary nonlinear models. As a result, the distribution data to be fitted is reduced, and the time required for fitting can be reduced.
Specifically, the correction term calculation unit 2 calculates a difference between the temporary nonlinear model and the regression line of the temporary nonlinear model as a correction term.

Hereinafter, a case where the provisional nonlinear model is a quadratic function y = f _N (x) will be described as an example.
FIG. 4 shows a quadratic function y = f _N (x) and a regression line y = f _L (x) = ax + b of this quadratic function. The correction term calculation unit 2 calculates the deviation between the quadratic function and the regression line by the following equation (1).
Δyi = f _N (xi) − (axi + b) (1)
In the case of correcting the distribution data (xi, yi), Δyi determined by the above equation (1) is used as a correction term, and is corrected as shown in the following equation (2) and converted into yi (new).
yi (new) = yi−Δyi (2)

In this way, by correcting the distribution data using the difference between the non-linear model and the linear model as a correction term, the distribution data distributed non-linearly can be reliably distributed on the linear main axis. It can be.
The selection unit 3 selects, as an abnormality detection model when the distribution data corrected by the correction term is used for abnormality detection, a provisional nonlinear model that provides a distribution that follows the normal distribution, and is calculated based on the abnormality detection model. The correction term is selected as an abnormality detection correction term used for abnormality detection. In other words, the selection unit 3 compares the normal distribution of the distribution data corrected by the correction term calculated for each temporary nonlinear model, and compares the temporary nonlinear model having the most normal distribution with the temporary nonlinear model. The calculated correction term is selected as a nonlinear model and correction term used for abnormality detection.

The abnormality detection device 20 includes an abnormality detection unit (abnormality detection means) 21.
The abnormality detection unit 21 reads the determination data from the storage unit 4, calculates correction determination data obtained by correcting the determination data based on the abnormality detection correction term selected by the selection unit 3 of the abnormality detection preprocessing apparatus 10, and performs correction determination. Determine whether the data is abnormal based on Mahalanobis distance. Further, the abnormality detection unit 21 sets a threshold value for the Mahalanobis distance, and determines that it is normal if it is equal to or less than the threshold value, and determines that it is abnormal if it is greater than the threshold value.

  Judgment using Mahalanobis distance refers to the characteristic quantity (multivariate) of a certain group with one parameter (Mahalanobis distance), and the good / bad of certain measurement data is the basis of a healthy group (normal measurement data) This is an evaluation method based on the distance from the data. If some measurement data is bad, the distance from the healthy group is large, and if the measurement data is good, the distance from the healthy group is small.

For example, Mahalanobis distance MD ² of k dimensions, determined by the following equation (3). Here, k is the number of items, i and j are 1 to k, α _ij is the i and j components of the inverse matrix of the correlation matrix, m _i , m _j , σ _i , and σ _j are the average value and standard in the unit space, respectively. Deviation.

The operation of the abnormality detection pre-processing device 10 and the abnormality detection device 20 according to this embodiment will be described below with reference to FIGS.
Operation data relating to the operation of the gas turbine is output from the gas turbine equipment 31 to the remote monitoring center 30 at a predetermined timing, and the operation data is acquired by the abnormality detection device 20 of the monitoring center 30. The abnormality detection device 20 stores the acquired operation data in the storage unit 4 (step SA1 in FIG. 5).

  When an abnormality detection start instruction regarding two variables (for example, a gas turbine output (MW) and a blade path temperature (° C.)) is input by a monitor, the “gas turbine output (MW) within a predetermined period measured during normal operation”. ) ”And“ blade path temperature (° C.) ”are selected, the two variables selected from the storage unit 4 are extracted, and the distribution data regarding the two variables (two dimensions) becomes a distribution according to the normal distribution. Is determined (step SA2 in FIG. 5). If it is determined that the distribution conforms to the normal distribution, the normal data is not corrected. Therefore, the processing of the abnormality detection pre-processing device 10 is terminated, and the abnormality detection device 20 detects normal abnormality based on the Mahalanobis distance. Make a decision.

  When it is determined that the distribution data is not a distribution according to the normal distribution, a predetermined number of distribution data is selected from the distribution data determined not to be a distribution according to the normal distribution (step SA3 in FIG. 5). The distribution data is fitted to a plurality of temporary nonlinear models (step SA4 in FIG. 5), and correction terms for correcting the distribution data are calculated based on the difference from the regression line of each temporary nonlinear model (FIG. 5). 5 step SA5). The distribution data is corrected by the calculated correction term (step SA6 in FIG. 5). Thereby, the distribution data determined not to be a distribution according to the normal distribution is also converted into a distribution in a direction according to the normal distribution.

It is determined whether a plurality of distribution data after correction is a distribution according to a normal distribution, a nonlinear model that brings the distribution that most closely follows a normal distribution is selected as an abnormality detection model, and a correction term calculated from this abnormality detection model is an abnormality detection correction term. Is selected (step SA7 in FIG. 5), and is output to the abnormality detection unit 21, and the process of the abnormality detection preprocessing apparatus 10 is terminated.
The abnormality detection unit 21 of the abnormality detection device 20 reads the determination data from the storage unit 4 and calculates correction determination data obtained by correcting the determination data based on the abnormality detection correction term acquired from the selection unit 3. The correction determination data is compared with a predetermined threshold value of the Mahalanobis distance. If the correction determination data is equal to or smaller than the threshold value, it is determined to be normal, and if it is greater than the threshold value, it is determined to be abnormal.

In FIG. 6, comparison data before and after correction of distribution data by the abnormality detection preprocessing apparatus 10 is shown as an example. Here, a case where a two-dimensional model is used as the nonlinear model is taken as an example.
FIG. 6A shows the normal distribution of normal distribution data (not shown) read from the storage unit 4 according to a normal probability plot. When it is determined that the distribution is not in accordance with the normal distribution by determining whether the distribution is in accordance with the normal distribution, a predetermined number of data among the normal distribution data read from the storage unit 4 is two-dimensional FIG. 6B shows the fitting performed by the model.

  When the distribution data read from the storage unit 4 is corrected by a correction term obtained by regression analysis (corrected by a two-dimensional model), FIG. 6C is obtained. Furthermore, FIG. 6D is obtained by plotting the normal probability plot of FIG. The numerical values described in the upper part of FIG. 6A and FIG. 6D are values indicating normal distribution, and the smaller the value, the more the normal distribution is obeyed. Accordingly, it can be seen that the normal distribution is more improved in FIG. 6D after the correction of the distribution data with the two-dimensional model than in FIG. 6A before the correction of the distribution data.

Similarly, FIGS. 7A to 7D show comparison data before and after correction when a trigonometric function model is used as the nonlinear model.
FIG. 7A is a normal probability plot before distribution data correction, and FIG. 7D shows a normal probability plot after distribution data correction using a trigonometric function model. Also in this case, it can be seen that the normal distribution is more improved in FIG. 7D than in FIG.

  As described above, according to the abnormality detection pre-processing device 10 and method and program according to the present embodiment, and the abnormality detection device 20 including the same, distribution data relating to two variables within a predetermined period measured at normal time is obtained. It is determined whether the distribution conforms to the normal distribution, and a predetermined number of distribution data selected from the distribution data determined not to conform to the normal distribution are fitted to the temporary nonlinear model, A correction term for correcting the distribution data is calculated based on the difference from the regression line. The distribution data corrected by this correction term is selected as an abnormality detection model when using a temporary nonlinear model that produces a distribution that most closely follows the normal distribution, and the correction term calculated based on the abnormality detection model is selected. It is selected as a correction term used for abnormality detection.

In this way, normal distribution of normal data is quantitatively evaluated, and based on the distribution data measured at normal time, an abnormality detection model and a correction term used for abnormality detection are selected. Deviated data (that is, abnormal data) can be detected with high accuracy. In addition, since only data measured at normal time is used, it is simpler than the case of using both normal data and abnormal data.
Even if it is determined that the normal data is away from the normal distribution, the normal data can be corrected to follow the normal distribution without changing the characteristics of the abnormal data.

Unlike the conventional method of adding a signal value and calculating an average value to follow a normal distribution, the present invention regresses a nonlinear model to a linear model to determine whether or not to follow a normal distribution. Therefore, the characteristics of the original distribution data are not lost.
Further, once the correction term is selected by the abnormality detection pre-processing device 10, the abnormality detection device 20 converts the determination data using the correction term, and determines normality of the determination data with respect to two predetermined variables. Therefore, a slight change from the passage of time and the determination of the determination data itself do not require a large calculation load, and can be processed easily.

Moreover, in the said embodiment, although the abnormality detection apparatus 20 was demonstrated as including the abnormality detection part 21 and the abnormality detection pre-processing apparatus 10 in one apparatus, it is not limited to this, The abnormality detection part 21 And the abnormality detection preprocessing apparatus 10 may be provided in different apparatuses (computer systems) and connected so as to be able to exchange information.
In the above-described embodiment, the determination whether or not to follow the normal distribution and the calculation of the correction term for the two variables selected by the monitoring staff has been started. However, the present invention is not limited to this, and is stored in the storage unit 4. The measurement data collected from a plurality of locations (for example, 200 locations) is preliminarily subjected to processing for determining normal distribution and calculating a correction term for each two-dimensional pair of all combinations, and the result is stored in the storage unit 4. It is good also as reading only a result suitably.

  In the above embodiment, a plurality of nonlinear models (for example, a quadratic function and a trigonometric function) are prepared as a plurality of non-linear models, and the most regular including the parameters in them are optimal. Although described as selecting a nonlinear model according to the distribution, the present invention is not limited to this. For example, this is a method for optimizing a nonlinear model by a so-called genetic algorithm (GE) that incorporates mating (synthesis) and displacement (transformation of a part of an expression) between models using a nonlinear model as one gene. It may be possible.

In the above-described embodiment, the case where the distribution data is a two-dimensional pattern in which the variable of y = f (x) is two variables has been described as an example, but n pieces of f (x) = 0 are described. A correction term calculation method in the case of an n-dimensional pattern as a variable of x will be described with reference to FIG. 8 (x is an n-dimensional vector).
a and b are n-dimensional vectors, t is a linear one-dimensional parameter, and a regression line is x = at + b. The center cN of f (x) = 0 and the center b (t = 0) of at + b are set near the center of the data group. F (x) = 0 is approximated by a polygonal line from cN to a unit length vector {df / _{ds_i} }. Here, s is a one-dimensional parameter of the curve and moves to the plus side and the minus side.

For each broken line component, a transformation _{R_i} that moves to a straight line component { _{at_i} + b} is calculated. The obtained _{R_i} is used as a correction term, the nearest broken line #i is obtained for each normal data, and the data x is converted by _{R_ix} .
As described above, according to the present invention, even if the distribution data is a pattern of any dimension, a correction term is easily obtained and the distribution conforms to the normal distribution, and a distribution familiar to the determination of the Mahalanobis distance is obtained.

DESCRIPTION OF SYMBOLS 1 Determination part 2 Correction term calculation part 3 Selection part 4 Storage part 10 Abnormality detection pre-processing apparatus 20 Abnormality detection apparatus 21 Abnormality detection part 100 Monitoring system

Claims (5)

The distribution data related to two or more variables in a predetermined period of time that is measured during normal, determining means for determining whether or not made a distribution in accordance with the normal distribution,
When it is determined that the distribution does not conform to the normal distribution , a difference between a plurality of provisional nonlinear models for fitting the distribution data and a regression line of each provisional nonlinear model is calculated as a correction term for correcting the distribution data. Correction term calculation means for
The distribution data corrected by the correction term is selected as an abnormality detection model when using the provisional nonlinear model that yields the distribution that follows the most normal distribution as an abnormality detection model, and is calculated based on the abnormality detection model. An abnormality detection pre-processing apparatus comprising: selection means for selecting a correction term as an abnormality detection correction term used for abnormality detection. 2. The pre-abnormality detection according to claim 1, wherein the correction term calculation unit fits a predetermined number of the distribution data selected from the distribution data determined not to follow a normal distribution to a plurality of temporary nonlinear models. Processing equipment. The abnormality detection pre-processing device according to claim 1 or 2 ,
Based on the abnormality detection correction term selected by the selection means of the abnormality detection preprocessing apparatus, correction correction data obtained by correcting determination data that is measurement data to be determined as normal abnormality is calculated, and the correction determination data An abnormality detection device comprising abnormality detection means for determining whether or not there is an abnormality based on the Mahalanobis distance. A first step of determining whether or not distribution data relating to two or more variables within a predetermined period measured in a normal period is a distribution according to a normal distribution;
When it is determined that the distribution does not follow the normal distribution , a difference between a plurality of provisional nonlinear models for fitting the distribution data and a regression line of each provisional nonlinear model is used as a correction term for correcting the distribution data. A second process to calculate,
The distribution data corrected by the correction term is selected as an abnormality detection model when using the provisional nonlinear model that yields the distribution that follows the most normal distribution as an abnormality detection model, and is calculated based on the abnormality detection model. And a third step of selecting a correction term as an abnormality detection correction term used for abnormality detection. A first process for determining whether or not distribution data relating to two or more variables within a predetermined period measured in a normal period is a distribution according to a normal distribution;
When it is determined that the distribution does not follow the normal distribution , a difference between a plurality of provisional nonlinear models for fitting the distribution data and a regression line of each provisional nonlinear model is used as a correction term for correcting the distribution data. A second process to calculate;
The distribution data corrected by the correction term is selected as an abnormality detection model when using the provisional nonlinear model that yields the distribution that follows the most normal distribution as an abnormality detection model, and is calculated based on the abnormality detection model. The abnormality detection pre-processing program for making a computer perform the 3rd process which selects a correction term as an abnormality detection correction term used for abnormality detection.

Images