JP6668699B2 - Monitoring support device, monitoring support method, and program - Google Patents

Description

  The present invention relates to a monitoring support device, a monitoring support method, and a program.

  As a method of analyzing operation data such as sensor measurement data to monitor and diagnose a process, a method called Multivariate Statistical Process Control (MSPC) is conventionally known.

  Further, there is known a technique for predicting an abnormality of a device by obtaining a relationship between a sequence of log data of an event occurred in the device and the abnormality (for example, see Patent Document 1).

Japanese Patent No. 5364530

  However, in the above-described conventional technology, for example, a plant operator or the like comprehensively calculates the abnormality that is predicted to occur, the time until the abnormality occurs, the probability of occurrence, the transition of the state of the equipment until the occurrence, and the like. In some cases, it was not possible to grasp. Therefore, for example, when the experience of the plant operator is inexperienced, it may take a long time to determine the necessity of the abnormality whose occurrence is predicted, the content of the abnormality, the priority, and the like.

  An embodiment of the present invention has been made in view of the above points, and has as its object to support determination of a predicted abnormality.

  In order to achieve the above object, in one embodiment of the present invention, a monitoring support device that supports monitoring of a device or equipment, wherein event data indicating an event occurred in the device or equipment stored in advance, and Merging means for creating first merged data obtained by merging the stored sensor data measured in the device or equipment, and event data specified in advance from the first merged data created by the merging means Creating means for creating a plurality of data series including: a first calculating means for calculating the similarity between the plurality of data series created by the creating means; and a similarity calculated by the first calculating means. Storage means for creating case data in which the plurality of data series are classified based on the above, and storing the created case data in a database. A second calculation unit configured to calculate a similarity between second event data obtained by merging the event data and the sensor data acquired from the device or the facility, and the case data stored in the database; There is provided an obtaining unit that obtains the case data from the database based on the similarity calculated by the calculating unit, and an output unit that outputs output data based on the case data obtained by the obtaining unit.

  According to the embodiment of the present invention, it is possible to support the judgment on the predicted abnormality.

FIG. 1 is a diagram illustrating a system configuration of an example of a monitoring support system according to a first embodiment. FIG. 2 is a diagram illustrating a hardware configuration of an example of a support device, a monitoring device, and a history management device according to the first embodiment. It is a figure showing the functional composition of an example of the monitoring support system concerning a first embodiment. 5 is a flowchart illustrating an example of a process of creating case data according to the first embodiment. FIG. 9 is a diagram schematically illustrating an example of symbolizing log data. It is a figure which illustrates typically an example of symbolization of driving data. FIG. 4 is a diagram schematically illustrating an example of creating a data series. It is a figure which illustrates the correspondence of the number of appearances typically. FIG. 9 is a diagram illustrating an example of a result of calculating a similarity between data series. It is a figure showing an example of case data DB. 5 is a flowchart illustrating an example of a prediction process according to the first embodiment. FIG. 3 is a diagram schematically illustrating prediction of occurrence of a target event. It is a figure showing an example of a prediction result screen. It is a figure showing an example of a chart screen. It is a figure showing the functional composition of an example of the monitoring support system concerning a second embodiment. 9 is a flowchart illustrating an example of a process of creating case data according to the second embodiment. FIG. 9 is a diagram schematically illustrating another example of creating a data series. It is a flow chart which shows an example of prediction processing concerning a 2nd embodiment. FIG. 9 is a diagram schematically illustrating a past operation procedure after the occurrence of a target event. It is a figure showing other examples of a prediction result screen.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

[First embodiment]
<System configuration>
First, a system configuration of a monitoring support system 1 according to the present embodiment will be described with reference to FIG. FIG. 1 is a diagram illustrating a system configuration of an example of a monitoring support system according to the first embodiment.

  The monitoring support system 1 illustrated in FIG. 1 includes a support device 10, one or more monitoring devices 20, a history management device 30, and a device control device 40 on one. These devices are communicably connected via a network N such as a LAN (Local Area Network). Further, one or more devices 50 are connected to the device control device 40.

  The operation of the present system includes a “case creation” phase for creating a past case when an abnormality such as a failure or an improper operation occurs in the device 50, and occurrence of an abnormality based on the latest state of the device 50 and the past case. And a “prediction” phase. Basically, the “case creation” phase is an offline process, and the “prediction” phase is an online process.

  In the “case creation” phase, the support device 10 creates case data indicating a past case when a predetermined event has occurred based on past event log data and operation data accumulated in the history management device 30. .

  In addition, in the “prediction” phase, the support device 10 generates a predetermined event indicating an abnormality such as a failure or an improper operation of the device 50 based on the latest state of the device 50 and case data indicating a past case. Predict and transmit the prediction result to the monitoring device 20.

  Here, the event log data is a history of event data (data indicating the occurrence of an event) transmitted from the device control apparatus 40 when any event occurs in the device 50. The event includes an alarm indicating occurrence of an abnormality such as a failure or an improper operation of the device 50, various operations in the device 50, various operations such as a change of a set value of the device 50 by a user, and a response of the device 50 to the operation. It is. Hereinafter, the event log data is simply referred to as “log data”.

  The operation data is a history of measurement data of various sensors included in the device 50 such as a flow meter, a pressure gauge, and a thermometer. In the present embodiment, the operation data is described as a history of the measurement data. However, the operation data may include, for example, a history of operation data of an actuator or the like included in the device 50.

  The monitoring device 20 displays the prediction result received from the support device 10 in the “prediction” phase. Thus, for example, a user such as an operator of a plant or an operator can know an abnormality that is predicted to occur in the device 50. Therefore, based on the prediction result displayed on the monitoring device 20, the user can appropriately determine the necessity of the response to the abnormality whose occurrence is predicted, the content of the response, the priority of the response, and the like.

  The history management device 30 manages the history of event data (log data) and the history of measurement data (operation data) received from the device control device 40.

  The device control device 40 is a device that controls the device 50. When any event (for example, a state change or operation of the device 50) occurs in the device 50 connected to the device control device 40, the device control device 40 transmits the event data to the history management device 30. . In addition, when the measurement target is measured by various sensors included in the device 50 connected to the device control device 40, the device control device 40 transmits the measurement data to the history management device 30.

  The devices 50 are, for example, gas turbines and steam turbines, and are various devices, facilities, plants, and the like controlled by the device control device 40.

  In the monitoring support system 1 according to the present embodiment, a plant or a facility is assumed as an example of the device 50, but is not limited thereto. The monitoring support system 1 according to the present embodiment can also be applied to a case where a device such as a router is used as the device 50 controlled by the device control device 40 to predict the occurrence of an abnormality in a network device. As described above, the monitoring support system 1 according to the present embodiment can be applied to a case where various electronic devices are used as the device 50 to predict occurrence of an abnormality in the electronic device.

<Hardware configuration>
Next, the hardware configurations of the support device 10, the monitoring device 20, and the history management device 30 according to the present embodiment will be described with reference to FIG. FIG. 2 is a diagram illustrating a hardware configuration of an example of a support device, a monitoring device, and a history management device according to the first embodiment. Since the support device 10, the monitoring device 20, and the history management device 30 have the same hardware configuration, the hardware configuration of the support device 10 will be mainly described below.

  The support device 10 illustrated in FIG. 2 includes an input device 11, a display device 12, an external I / F 13, and a RAM (Random Access Memory) 14. The support device 10 illustrated in FIG. 2 includes a ROM (Read Only Memory) 15, a CPU (Central Processing Unit) 16, a communication I / F 17, and a storage device 18. These pieces of hardware are communicably connected by a bus B.

  The input device 11 is, for example, a keyboard, a mouse, a touch panel, or the like, and is used by a user to input each operation signal. The display device 12 is, for example, an LCD (Liquid Crystal Display) and displays the processing result. The input device 11 and / or the display device 12 may be connected to the bus B and used when necessary.

  The external I / F 13 is an interface with an external device. The external device includes a recording medium 13a and the like. Thereby, the support device 10 can read and / or write on the recording medium 13a via the external I / F 13. The recording medium 13a includes a flexible disk, CD, DVD, SD memory card, USB memory, and the like. Note that a program for implementing the present embodiment may be stored in the recording medium 13a.

  The RAM 14 is a volatile semiconductor memory that can temporarily store programs and data. The ROM 15 stores programs and data such as a BIOS (Basic Input / Output System), an OS (Operating System) setting, and a network setting that are executed when the support device 10 is started.

  The CPU 16 is an arithmetic unit that reads out programs and data from the ROM 15, the storage device 18, and the like onto the RAM 14 and executes processing to realize control and functions of the entire support device 10.

  The communication I / F 17 is an interface for connecting the support device 10 to the network N. Thereby, the support device 10 can perform data communication via the communication I / F 17.

  The storage device 18 is a non-volatile memory that stores programs and data, and is, for example, a hard disk drive (HDD) or a solid state drive (SSD). The programs and data stored in the storage device 18 include a program that implements the present embodiment, an OS that is basic software for controlling the entire support device 10, and application software that provides various functions on the OS. The storage device 18 manages the stored programs and data by using a predetermined file system and / or a DB.

  The support device 10 according to the present embodiment can realize various processes described later by having the above hardware configuration.

<Functional configuration>
Next, a functional configuration of the monitoring support system 1 according to the present embodiment will be described with reference to FIG. FIG. 3 is a diagram illustrating a functional configuration of an example of the monitoring support system according to the first embodiment.

  The history management device 30 illustrated in FIG. 3 includes a log data DB 301 and an operation data DB 302. Each of these DBs can be realized using the storage device 18.

  The log data DB 301 stores the history (log data) of the event data received from the device control device 40. The operation data DB 302 stores the history (operation data) of the measurement data received from the device control device 40.

  As described above, the history management device 30 accumulates the event data of the event generated in the device 50 and the measurement data measured by the various sensors included in the device 50 in the log data DB 301 and the operation data DB 302.

  The support device 10 illustrated in FIG. 3 includes a target event setting unit 101, a symbolizing unit 102, a merging unit 103, a case series creating unit 104, a number associating unit 105, and a first similarity calculating unit 106. , A classification unit 107 and a naming unit 108. 3 includes a comparison sequence creation unit 109, a second similarity calculation unit 110, an acquisition unit 111, a probability calculation unit 112, a time calculation unit 113, and a result creation unit 114. Having. Each of these functional units is realized by a process of causing the CPU 16 to execute one or more programs installed in the support device 10.

  Further, the support device 10 illustrated in FIG. 3 includes a merge data DB 115 and a case data DB 116. Each of these DBs can be realized by the storage device 18. Each of these DBs may be realized using, for example, a storage device or the like connected to the support device 10 via the network N.

  In the “case creation” phase, the target event setting unit 101 sets event data indicating an event specified by the user as a creation target event of case data. Hereinafter, an event for which case data is to be created is referred to as a “target event”.

  The symbolizing unit 102 converts (ie, symbolizes) the event data and the measurement data into predetermined characters or symbols.

  That is, when the target event is set by the target event setting unit 101 in the “case creation” phase, the symbolizing unit 102 encodes the target event and acquires log data and operation data from the history management device 30. Then, the log data and the operation data are symbolized.

  In addition, in the “prediction” phase, the encoding unit 102 acquires the latest log data and operation data from the history management device 30 and encodes the log data and operation data.

  In the “case creation” phase, the merging unit 103 merges the log data and the operation data encoded by the encoding unit 102 in chronological order to create merge data. Then, the merge unit 103 stores the created merge data in the merge data DB 115.

  In the “case creation” phase, the case series creation unit 104 creates a plurality of data series from the merge data stored in the merge data DB 115 based on the target event. The data series is a symbol string including the target event.

  In the “case creation” phase, the number association unit 105 associates the number of appearances of the partial data series included in the data series with the data series created by the case series creation unit 104 in the merge data DB 115.

  Note that the partial data sequence is a partial symbol sequence of a data sequence represented by a symbol sequence. For example, when the data sequence is “ABCD”, the partial data sequences are “A”, “AB”, “ABC” "And" ABCD ".

  The first similarity calculator 106 calculates the similarity between the data series in the “case creation” phase. Further, the first similarity calculation unit 106 normalizes the calculated similarity in the “case creation” phase.

  The classifying unit 107 classifies a plurality of data series based on the similarity normalized by the first similarity calculating unit 106 in the “case creation” phase.

  The naming unit 108 gives a name specified by the user to the data series classified by the classification unit 107 in the “case creation” phase. Then, the naming unit 108 stores the named data series in the case data DB 116 as case data.

  Thus, in the monitoring support system 1 according to the present embodiment, in the “case creation” phase, case data indicating a past case when the target event has occurred is created and held.

  In the “prediction” phase, the comparison sequence creation unit 109 creates a comparison data sequence by merging the latest log data and operation data encoded by the encoding unit 102 in a time series. The comparison data sequence is a data sequence for comparing the similarity with the case data stored in the case data DB 116.

  The second similarity calculator 110 calculates the similarity between the case data stored in the case data DB 116 and the comparison data series in the “prediction” phase. Further, the second similarity calculating section 110 normalizes the calculated similarity in the “prediction” phase.

  The acquiring unit 111 acquires case data from the case data DB 116 based on the similarity normalized by the second similarity calculating unit 110 in the “prediction” phase. That is, the acquiring unit 111 acquires case data having a high degree of similarity with the comparison data series from the case data DB 116.

  Thus, the monitoring support system 1 according to the present embodiment can acquire case data indicating a past case similar to the latest state of the device 50.

  In the “prediction” phase, the probability calculation unit 112 calculates the occurrence probability of the target event included in the case data based on the number of appearances associated with the case data acquired by the acquisition unit 111.

  The time calculation unit 113 calculates a time until the target event included in the case data acquired by the acquisition unit 111 occurs in the “prediction” phase.

  The result creation unit 114 creates a prediction result of the case data acquired by the acquisition unit 111 in the “prediction” phase. Then, the result creating unit 114 transmits the created prediction result to the monitoring device 20. The prediction result includes the occurrence probability of the target event calculated by the probability calculation unit 112, the time until the target event calculated by the time calculation unit 113 occurs, and the like.

  The merge data DB 115 stores the merge data created by the merge unit 103.

  The case data DB 116 stores case data created in the “case creation” phase.

  The monitoring device 20 illustrated in FIG. 3 includes a display control unit 201. The function unit is realized by a process of causing the CPU 16 to execute one or more programs installed in the monitoring device 20.

  The display control unit 201 displays a prediction result screen or the like based on the prediction result received from the result creation unit 114 of the support device 10.

  As a result, in the monitoring support system 1 according to the present embodiment, a user such as an operator or an operator operating the monitoring device 20 can determine whether or not to respond to the abnormality whose occurrence is predicted based on the prediction result screen. , Etc., the priority of the response can be appropriately determined.

<Details of processing>
Next, details of the processing of the monitoring support system 1 according to the present embodiment will be described.

<< Creation of case data >>
First, the process of creating case data in the “case creation” phase will be described with reference to FIG. FIG. 4 is a flowchart illustrating an example of a process of creating case data according to the first embodiment.

  The target event setting unit 101 sets an event specified by the user via the input device 11 or the like as a target event (step S401). The target event setting unit 101 may set two or more events as target events.

  Here, the event is represented as a message such as “air blow valve, open” or “pump, failure”. Hereinafter, it is assumed that one or more events (for example, “pump failure”, “cooling device failure”, etc.) indicating the occurrence of an abnormality in the device 50 have been set as target events.

  The encoding unit 102 encodes the target event set by the target event setting unit 101 (Step S402).

  Here, as described above, the event is represented as a message. Therefore, the symbolizing unit 102 symbolizes the target event by associating the message representing the target event set by the target event setting unit 101 with a predetermined symbol.

  For example, when the message indicating the target event is “pump, failure”, the target event is symbolized by a symbol “K” indicating “pump, failure”. Similarly, for example, when the message indicating the target event is “cooling device failure”, the target event is symbolized as “L” indicating “cooling device failure”.

  Next, the encoding unit 102 acquires log data from the log data DB 301 of the history management device 30 and encodes the log data (step S403).

  Here, the symbolization of log data will be described with reference to FIG. FIG. 5 is a diagram schematically illustrating an example of symbolizing log data.

As shown in FIG. 5, the log data DB 301 stores a history of event data (log data). The event data includes the time at which the event occurred (occurrence time) and a message indicating the event. Therefore, for example, when the message “air blow valve, open” is symbolized by the symbol “A”, the event data on the first line of the log data illustrated in FIG. 5 is the occurrence time T ₁ (2015-05-0100). : 14: 17) and the symbol A.

That is, the event data on the first line of the log data shown in FIG. 5 can be represented as A (T ₁ ). Similarly, the event data on the second line of the log data shown in FIG. 5 can be represented as B (T ₂ ), if the occurrence time is T ₂ . The same applies to other event data of the log data shown in FIG.

Thereby, the log data shown in FIG. 5 is a symbol string of “A (T ₁ ) B (T ₂ ) E (T ₃ ) C (T ₄ ) B (T ₅ ) K (T ₆ ). Can be symbolized as In the following, the description of the occurrence time will be omitted unless otherwise specified. Therefore, the log data shown in FIG. 5 is represented by a symbol string “ABECBK...”.

  Next, the symbolizing unit 102 acquires operation data from the operation data DB 302 of the history management device 30 and encodes the operation data (step S404).

  Here, the symbolization of the driving data will be described with reference to FIG. FIG. 6 is a diagram schematically illustrating an example of symbolizing driving data.

  As shown in FIG. 6, the operation data DB 302 stores the history (operation data) of the measurement data. The measurement data includes the time of measurement (measurement time) and variables 1 to L indicating measurement values (FIG. 6 shows a case where L = 2 for simplicity).

Therefore, for example, when the value of the variable 1 is symbolized as a symbol “a ₁ ” when the value of “10.0” or more is symbolized as a symbol “a ₂ ” and less than “10.0” as a symbol “a ₂ ”, one line of the operation data shown in FIG. variable 1 contained in the eyes of the measurement data, the measurement time t _1, can be represented by the symbol a _1. Similarly, for example, when the value of the variable 2 is “100.0” or more is symbolized by the symbol “b ₁ ” and less than “100.0” is symbolized by the symbol “b ₂ ”, the operation data 1 shown in FIG. variable 2 included in the measurement data of the row is a measurement time t _1, it can be represented by the symbol b _1.

That is, the measurement data in the first row of the operation data shown in FIG. 6 can be represented by a symbol string of a ₁ (t ₁ ) b ₁ (t ₁ ). Similarly, the measurement data in the second row of the operation data shown in FIG. 5 can be represented by a symbol string of a ₂ (t ₂ ) b ₂ (t ₂ ), where t ₂ is the measurement time. The same applies to other measurement data of the operation data shown in FIG.

Thus, the operation data shown in FIG. 6 is “a ₁ (t ₁ ) b ₁ (t ₁ ) a ₂ (t ₂ ) b ₂ (t ₂ ) a ₁ (t ₃ ) b ₂ (t ₃ ) a ₂ (T ₄ ) b ₁ (t ₄ ) a ₁ (t ₅ ) b ₁ (t ₅ ) a ₁ (t ₆ ) b ₂ (t ₆ )... Hereinafter, the description of the measurement time is omitted unless otherwise specified. Therefore, the operation data shown in FIG. 6 is represented by a symbol string of “a ₁ b ₁ a ₂ b ₂ a ₁ b ₂ a ₂ b ₁ a ₁ b ₁ a ₁ b ₂ ...”. .

In this way, the measurement data is symbolized for each variable included in the measurement data according to the value of the variable. That is, for example, for the variable 1, the symbol “a ₁ ” when the value of the variable 1 is within the first predetermined range, the symbol “a ₂ ” when the value of the variable 1 is within the second predetermined range, If it is within a predetermined range of 3, it is symbolized as a symbol “a ₃ ”.

  Next, the merging unit 103 merges the log data and the operation data encoded by the encoding unit 102 in a time series, and creates merge data. Then, the merge unit 103 stores the created merge data in the merge data DB 115 (Step S405).

  That is, the merging unit 103 merges the symbolized log data and the operation data, and creates a symbol string rearranged according to the time (occurrence time or measurement time) of the event data and the measurement data as merge data. It is stored in the merge data DB 115.

  Next, the case series creation unit 104 acquires one target event set by the target event setting unit 101 (step S406). Note that the target event acquired here is the target event encoded by the encoding unit 102.

  Next, the case series creation unit 104 creates a plurality of data series from the merge data stored in the merge data DB 115 based on the acquired target event (step S407).

  Here, creation of a data series will be described with reference to FIG. FIG. 7 is a diagram schematically illustrating an example of creating a data series. Note that, in FIG. 7, a description will be given assuming that the target event “K” has been acquired.

  As shown in FIG. 7, merge data is stored in the merge data DB 115 in chronological order. At this time, the case series creation unit 104 extracts, as a data series, event data and measurement data for a predetermined time (for example, 30 minutes) before the occurrence of the event data indicating the target event “K”.

That is, the case series creation unit 104 extracts the first data series “ECa ₂ b ₁ BK”,..., And the N-th data series “CDa ₂ b ₂ K” from the merge data shown in FIG. As a result, the case series creating unit 104 creates a plurality of data series. Hereinafter, as illustrated in FIG. 7, a description will be given assuming that N data sequences from the first data sequence to the N-th data sequence have been created.

  The predetermined time before the occurrence of the target event extracted by the case series creating unit 104 may be set by the user to an arbitrary time.

  Next, the number association unit 105 associates the number of appearances of the partial data series with the merge data DB 115 for each data series created by the case series creation unit 104 (step S408).

Here, the association of the number of appearances with the data series will be described with reference to FIG. FIG. 8 is a diagram schematically illustrating the association of the number of appearances. FIG. 8 illustrates a case where the number of appearances is associated with the first data series “ECa ₂ b ₁ BK”.

As shown in FIG. 8, number associating part 105 calculates the number of occurrences _{P 1} of the merge data DB115 symbol "E" appears, the _{P 1} first data sequence _"ECa 2 _b 1 BK" Corresponding to the symbol “E”.

Similarly, the number of correlating unit 105 calculates the number of occurrences _{P 2} of the merge data DB115 symbol string "EC" appears, the _{P 2} first data series _{"E (P 1) Ca 2 b} 1 BK ”is associated with the symbol“ C ”. The same applies to the following.

Thereby, the number-of-times associating unit 105 associates the number of appearances P ₁ , P ₂ ,..., P ₆ with the first data series “ECa ₂ b ₁ BK”, and and _{"E (P 1) C (P} 2) a 2 (P 3) b 1 (P 4) B (P 5) K (P 6) ." In the following, description of the number of appearances will be omitted unless otherwise specified. That is, unless otherwise specified, the first data sequence after the number of appearances is associated by the number association unit 105 is also represented as “ECa ₂ b ₁ BK”.

  Next, the first similarity calculation unit 106 calculates the similarity between the data series (step S409).

  That is, the first similarity calculation unit 106 calculates the similarity between the first data sequence and each of the first to Nth data sequences. Similarly, the first similarity calculator 106 calculates the similarity between the second data sequence and each of the second to Nth data sequences. Similarly, first similarity calculation section 106 calculates the similarity between the third data sequence and each of the third to Nth data sequences. The same applies to the following. As described above, the first similarity calculating unit 106 calculates the similarity between data series.

  Here, as a method of calculating the degree of similarity between data series, for example, the following method (1) or (2) can be used.

(1) Method of calculating information amount (for example, Kullback-Leibler information amount) between HMMs as similarity when a data sequence is regarded as data generated from a Hidden Markov Model (HMM) (2) ) Method of calculating the Levenshtein distance defined as the minimum cost of the procedure required to transform one data series into another data series as similarity

  Next, the first similarity calculation unit 106 normalizes the calculated similarity (step S409). That is, the first similarity calculation unit 106 normalizes the calculated similarity to a value of, for example, 0 or more and 1 or less.

  Here, the calculation result of the similarity normalized by the first similarity calculation unit 106 is shown in FIG. FIG. 9 is a diagram illustrating an example of a result of calculating the similarity between data series.

  As shown in FIG. 9, in the present embodiment, when the data series are the same, the value of the normalized similarity is “1.0”. On the other hand, as the degree of similarity between data series decreases, the value of the normalized degree of similarity decreases.

  Next, the classification unit 107 classifies the data series based on the similarity normalized by the first similarity calculation unit 106 (step S411).

  Here, as a method of classifying the data series, for example, there is a method of classifying the data series into a number of clusters designated by the user in advance by using a cohesive hierarchical clustering technique. In the agglomerative hierarchical clustering method, the distance between clusters may be updated based on, for example, a Lance-Williams update formula.

  Next, the naming unit 108 assigns a name specified by the user to the data series classified by the classification unit 107. Then, the naming unit 108 stores the named data series in the case data DB 116 as case data (step S412). As a result, the case data is stored in the case data DB 116.

  Subsequently, the case series creation unit 104 determines whether there is a next target event set by the target event setting unit 101 (Step S413).

  If it is determined in step S413 that there is a next target event, the case sequence creation unit 104 returns to step S406. That is, the case series creation unit 104 acquires the next target event, and creates a plurality of data series based on the acquired target event.

  On the other hand, when it is determined in step S413 that there is no next target event, the case series creating unit 104 ends the process.

  As described above, the case data created for each target event set by the target event setting unit 101 is stored in the case data DB 116.

  Here, the target events set by the target event setting unit 101 are “K”, “L”, and “M”, and the case data DB 116 in the case where the data series is classified into three clusters in step S411 described above. FIG. 10 shows the case data stored in. FIG. 10 is a diagram illustrating an example of the case data DB.

  As shown in FIG. 10, in the case data DB 116, the first data series (first case data) to the Nth data series (Nth case data) created based on the target event “K” are: It is classified into three clusters of a name “α”, a name “β”, and a name “γ”. The same applies to the other target events “L” and “M”.

  In addition, it is preferable that an appropriate name is given to the case data classified into the same cluster by the user. For example, the case data in which the target event “K” occurs due to the measurement data is given a name such as “abnormal measurement value”, and the case data in which the target event “K” occurs due to an operation error of the operator is given. Is for giving “operation error origin” or the like.

  As described above, in the monitoring support system 1 according to the present embodiment, based on the history of past event data and measurement data, the case data that is a data series until the target event occurs is created. Then, in the monitoring support system 1 according to the present embodiment, the case data that are similar to each other are given a name, classified, and stored. Accordingly, in a prediction process described later, a prediction result based on similar case data can be presented to the user, and it is possible to assist the user in determining the prediction result.

≪Prediction processing≫
Next, a process of predicting the occurrence of an abnormality in the “prediction” phase and providing the prediction result to the user will be described with reference to FIG. FIG. 11 is a flowchart illustrating an example of the prediction process according to the first embodiment.

  The symbolizing unit 102 acquires the latest event data and measurement data from the log data DB 301 and the operation data DB 302 of the history management device 30, respectively, and encodes the acquired event data and measurement data (step S1101).

  That is, the encoding unit 102 acquires event data of an event that has occurred during a predetermined time in the past from the current time (for example, in the past 30 minutes) from the event data stored in the log data DB 301, The acquired event data is encoded.

  Similarly, the symbolizing unit 102 obtains, from the measurement data stored in the operation data DB 302, the measurement data measured during a predetermined time in the past from the current time, and encodes the obtained measurement data. I do.

  Next, the comparison sequence creation unit 109 creates a comparison data sequence by merging the event data and the measurement data encoded by the encoding unit 102 according to a time series (step S1102).

  That is, the comparison sequence creation unit 109 merges the symbolized event data and measurement data, and then sorts the symbol string rearranged according to the time (occurrence time or measurement time) of the event data and measurement data as a comparison data sequence. I do.

  Next, the comparison sequence creation unit 109 acquires one target event set by the target event setting unit 101 in the “case creation” phase (step S1103). Note that the target event acquired here is the target event encoded by the encoding unit 102.

  Next, the second similarity calculating section 110 calculates the similarity between the comparison data series created by the comparison series creating section 109 and the case data associated with the target event acquired by the comparison series creating section 109. The degree is calculated (step S1104).

  That is, when the target event acquired by the comparison series creation unit 109 is “K”, the second similarity calculation unit 110 determines the first case associated with the target event “K” in the case data DB 116. Data to Nth case data are acquired. Then, the second similarity calculator 110 calculates the similarity between the comparison data series and each of the first to Nth case data.

  Next, the second similarity calculation unit 110 normalizes the calculated similarity (Step S1105). That is, the second similarity calculation unit 110 normalizes the calculated similarity to a value of, for example, 0 or more and 1 or less.

Next, the acquisition unit 111, among the case data similarity between the comparison data sequence is calculated, normalized similarity to acquire a high-level N ₁ review data series (step S1106). Incidentally, N ₁ is a natural number of 1 or more which has been set in advance by the user. N ₁ may be, for example, about 1 or 2.

Thus, the occurrence of the target event is predicted based on the acquired case data. That is, for example, as shown in FIG. 12, when the acquired case data is “ECa ₂ b ₁ BK” and the comparison data sequence is “ECa ₂ ”, the data sequence pattern “b ₁ B” follows. It is predicted that the target event “K” will occur.

  Next, the probability calculation unit 112 calculates the occurrence probability of the target event based on the comparison data series and the number of appearances associated with the case data acquired by the acquisition unit 111 (step S1107).

For example, the data series “E (P ₁ ) C (P ₂ ) a ₂ (P ₃ ) b ₁ (P ₄ ) B (P ₅ ) K (P ₆ )” shown in FIG. When the data series is “ECa ₂ ”, the probability of occurrence of the target event “K” is calculated by P ₃ / P ₆ . As another example, for example, when the comparison data series is “EC”, the occurrence probability of the target event “K” is calculated by P ₂ / P ₆ .

  As described above, the occurrence probability of the target event is calculated by dividing the number of appearances of the comparison data series in the merge data DB 115 by the number of occurrences of the case data in the merge data DB 115.

  Next, based on the comparison data sequence and the time (occurrence time or measurement time) associated with the case data acquired by the acquisition unit 111, the time calculation unit 113 performs a process until the target event occurs. The time is calculated (step S1108).

For example, the case data is “E (T ₁ ) C (T ₂ ) a ₂ (t ₃ ) b ₁ (t ₄ ) B (T ₅ ) K (T ₆ )” and the comparison data series is “ECa ₂ , The time until the target event “K” occurs is calculated by T ₆ −t ₄ . As another example, for example, when the comparison data series is “ECa ₂ b ₁ ”, the time until the target event “K” occurs is calculated by T ₆ −T ₅ .

  Next, the comparison sequence creation unit 109 determines whether there is a next target event set by the target event setting unit 101 in the “case creation” phase (step S1109).

  If it is determined in step S1109 that there is a next target event, the comparison sequence creation unit 109 returns to step S1103. That is, the comparison sequence creation unit 109 acquires the next target event.

  On the other hand, if it is determined in step S1109 that there is no next target event, the result creating unit 114 creates a prediction result for the case data of each target event acquired by the acquiring unit 111. Then, the result creating unit 114 transmits the created prediction result to the monitoring device 20 (Step S1110).

  Here, the prediction result includes a data sequence pattern until the occurrence of the target event, the occurrence probability of the target event calculated by the probability calculation unit 112, and the time until the occurrence of the target event calculated by the time calculation unit 113. Including time. That is, the prediction result includes various types of information for assisting the user in making the prediction of the occurrence of the target event (abnormality).

  Thus, in the monitoring device 20, the display control unit 201 displays a prediction result screen 1000 as shown in FIG. 13 based on the prediction result.

  The prediction result screen 1000 shown in FIG. 13 includes, for each name 1001 indicating the target event, a data series pattern 1002 until the target event occurs, a target event occurrence probability 1003, and a time 1004 until the target event occurs. The prediction result associated with is displayed. In the prediction result screen 1000, a chart display 1005 for transitioning to a chart screen described later is associated with the prediction result.

  The name 1001 is the name (error name or failure name) of the target event. The pattern 1002 is a pattern of an operation or an operation until a target event occurs, and is displayed based on a data sequence pattern until the target event occurs. The occurrence probability 1003 is the probability that the target event will occur, and is displayed based on the calculation result by the probability calculation unit 112. The time until occurrence 1004 is a time until the target event occurs, and is displayed based on the calculation result by the time calculation unit 113.

  In the prediction result screen 1000 shown in FIG. 13, the prediction results are displayed in descending order of the occurrence probabilities 1003 (in descending order of the occurrence probabilities). That is, the result creating unit 114 may include, for example, the occurrence probabilities of the target event calculated by the probability calculating unit 112 in the prediction result in descending order of the occurrence probabilities. This allows the user to preferentially determine whether or not to deal with an abnormality having a high probability of occurrence and the content of the response.

  Note that, in the prediction result screen 1000 shown in FIG. 13, the prediction results are displayed in descending order of the occurrence probabilities 1003. However, the present invention is not limited to this. It may be displayed. That is, the result creating unit 114 may include, for example, the time until the target event calculated by the time calculating unit 113 occurs in the prediction result in ascending order of the time. This allows the user to preferentially determine whether it is necessary to respond to an abnormality that has a short time to occurrence and to respond.

  Here, when the “display” button of the chart display 1005 is selected by the user on the prediction result screen 1000 shown in FIG. 13, the display control unit 201 displays a chart screen 2000 as shown in FIG.

  In the chart screen 2000 shown in FIG. 14, the target event name 2001 associated with the "display" button selected by the user is displayed in a selectable manner. When the user selects the name 2001 on the chart screen 2000 shown in FIG. 14, the display control unit 201 displays the chart screen of the target event corresponding to the selected name 2001.

  On a chart screen 2000 shown in FIG. 14, a performance graph 2002 showing the transition of the latest measurement data and a performance plot 2003 showing the event data of the most recently occurred event are displayed. Further, on a chart screen 2000 shown in FIG. 14, a prediction graph 2004 showing transition of predicted measurement data and a prediction plot 2005 showing event data of the predicted event are displayed.

  The performance graph 2002 and the performance plot 2003 are displayed based on the comparison data series. On the other hand, the prediction graph 2004 and the prediction plot 2005 are displayed based on the time-series data corresponding to the target event. For this reason, the user can grasp the transition of the measurement data up to the present time and the transition of the measurement data predicted until the occurrence of the abnormality. Similarly, the user can grasp the events that have occurred up to the present time and the events that are predicted to occur before the occurrence of the abnormality.

  As described above, in the monitoring support system 1 according to the present embodiment, various information such as the probability of occurrence and the time until the occurrence is presented to the user for the abnormality whose occurrence is predicted. Thereby, in the monitoring support system 1 according to the present embodiment, the user's judgment (for example, examination of the necessity of response, examination of the response content, priority of the corresponding abnormality, etc.) to be performed on the abnormality whose occurrence is predicted is determined. I can help.

[Second embodiment]
Next, a monitoring support system 1 according to a second embodiment will be described. In the second embodiment, after an abnormality occurs, a recovery operation procedure (recovery operation procedure) for the generated abnormality is presented to the user. In the description of the second embodiment, differences from the first embodiment will be described, and portions having substantially the same functions as those of the first embodiment and portions performing the same processing will be described in the first embodiment. The same reference numerals as those used in the description of the first embodiment denote the same parts, and a description thereof will be omitted.

<Functional configuration>
The functional configuration of the monitoring support system 1 according to the present embodiment will be described with reference to FIG. FIG. 15 is a diagram illustrating a functional configuration of an example of a monitoring support system according to the second embodiment.

  The support device 10 illustrated in FIG. 15 includes a case series creation unit 104A and a result creation unit 114A.

  In the “case creation” phase, the case series creation unit 104A creates a plurality of data series from the merge data stored in the merge data DB 115 based on the target event. Here, the case series creation unit 104A creates a data series by extracting event data and measurement data at a predetermined time before and after the occurrence of the target event.

  In the “prediction” phase, the result creation unit 114A creates a prediction result including a data sequence pattern indicating an operation procedure after the occurrence of the target event.

<Details of processing>
Next, details of the processing of the monitoring support system 1 according to the present embodiment will be described.

<< Creation of case data >>
First, a process of creating case data according to the present embodiment will be described with reference to FIG. FIG. 16 is a flowchart illustrating an example of a process of creating case data according to the second embodiment. Note that, in FIG. 16, the processes in steps S401 to S406 and steps S408 to S413 are the same as those in the first embodiment, and thus description thereof will be omitted.

  The case series creation unit 104A creates a plurality of data series from the merge data stored in the merge data DB 115 based on the acquired target event (step S1601).

  Here, creation of a data sequence according to the present embodiment will be described with reference to FIG. FIG. 17 is a diagram schematically illustrating another example of creating a data series.

  As shown in FIG. 17, merge data is stored in the merge data DB 115 in chronological order. At this time, the case series creation unit 104A extracts, as a data series, event data and measurement data of a predetermined time (for example, 30 minutes before and after) before and after the occurrence of the event data indicating the target event “K”.

That is, the case series creation unit 104A converts the first data series “Ca ₂ b ₁ BKa ₁ b ₁ DF”,..., The N-th data series “CDa ₂ b ₂ KC” from the merge data shown in FIG. Extract. Thereby, a plurality of data series are created by the case series creating unit 104A.

  As described above, in the monitoring support system 1 according to the present embodiment, in the merge data DB 115, the event data and the measurement data at a predetermined time before and after the occurrence of the target event are extracted, and a data sequence is created.

≪Prediction processing≫
Next, a prediction process according to the present embodiment will be described with reference to FIG. FIG. 18 is a flowchart illustrating an example of the prediction process according to the second embodiment. Note that, in FIG. 18, the processing in steps S1101 to S1109 is the same as in the first embodiment, and a description thereof will be omitted.

  The result creating unit 114A creates a prediction result for the acquired case data of each target event. Then, the result creating unit 114A transmits the created prediction result to the monitoring device 20 (Step S1801).

  Here, the prediction result includes a data sequence pattern indicating an operation procedure after the occurrence of the target event.

That is, when the target event is “K”, the comparison data series is “Ca ₂ b ₁ BK”, and the case data is “Ca ₂ b ₁ BKa ₁ b ₂ DF”, as shown in FIG. The data sequence pattern after the occurrence of "K" can be predicted. Therefore, by acquiring event data of an event indicating an operation from the data sequence pattern, it is possible to acquire a data sequence pattern “DF” indicating an operation procedure after the occurrence of the target event “K”.

  Thus, in the monitoring device 20, the display control unit 201 displays a prediction result screen 3000 as shown in FIG. 20 based on the prediction result.

  The prediction result screen 3000 shown in FIG. 20 is further associated with a recovery operation display 3001 for displaying a recovery operation procedure after occurrence of an abnormality.

  When the “display” button of the restoration operation display 3001 is selected by the user on the prediction result screen 3000 illustrated in FIG. 20, the display control unit 201 corresponds to the target event associated with the selected “display” button. The restoration operation procedure screen 3100 is displayed.

  The recovery operation procedure screen 3100 displays a recovery operation procedure when a target event associated with the “display” button selected by the user has occurred. Such a recovery operation procedure is displayed based on a data sequence pattern indicating the operation procedure after the occurrence of the target event, which is included in the prediction result created by the result creation unit 114A. Thereby, the user can know the recovery operation procedure when the abnormality occurs.

  As described above, in the monitoring support system 1 according to the present embodiment, when an abnormality has occurred, the recovery operation procedure from the abnormality is presented to the user. Thereby, the monitoring support system 1 according to the present embodiment can support the determination of the content of the response to the occurred abnormality (how to respond to the occurred abnormality).

REFERENCE SIGNS LIST 1 monitoring support system 10 support device 20 monitoring device 30 history management device 40 device control device 50 device 101 target event setting unit 102 encoding unit 103 merging unit 104 case series creation unit 105 number correspondence unit 106 first similarity calculation unit 107 Classification unit 108 Naming unit 109 Comparison series creation unit 110 Second similarity calculation unit 111 Acquisition unit 112 Probability calculation unit 113 Time calculation unit 114 Result creation unit 115 Merge data DB
116 Case Data DB
201 display control unit 301 log data DB
302 Operation data DB
N network

Claims (8)

A monitoring support device that supports monitoring of equipment or equipment,
In accordance with event data obtained by encoding an event generated in the device or equipment stored in advance into a predetermined symbol for each event, and a range of sensor values measured in the device or equipment stored in advance. Merging means for creating first merge data obtained by merging sensor data encoded into predetermined symbols in the order of the time at which the event occurred and the time at which the sensor value was measured ;
Creating means for creating a plurality of data series including previously designated event data from the first merge data created by the merging means;
First calculating means for calculating the degree of similarity between the plurality of data series created by the creating means;
Storage means for creating case data in which the plurality of data series are classified based on the similarity calculated by the first calculation means, and storing the created case data in a database;
Event data in which an event occurred in the device or equipment is encoded into a predetermined symbol for each event, and a sensor in which the event is encoded into a predetermined symbol according to a range of sensor values measured in the device or equipment. A second merged data obtained by merging data with the time at which the event occurred and the time at which the sensor value was measured, and a second degree of similarity between the case data stored in the database and the second merged data. Calculating means;
Acquiring means for acquiring the case data from the database based on the similarity calculated by the second calculating means;
Output means for creating a prediction result of the case data obtained by the obtaining means , and outputting the prediction result ,
A monitoring support device having: A third calculating unit that calculates a probability that the specified event included in the case data will occur, based on the case data obtained by the obtaining unit and the second merge data;
The output means,
The monitoring support device according to claim 1, wherein a prediction result including the probability is created . A fourth calculating unit configured to calculate a time until the specified event included in the case data occurs, based on the case data obtained by the obtaining unit and the second merge data; ,
The acquisition means,
The monitoring support device according to claim 1, wherein a prediction result including the time is created . The creation means,
By extracting, from the first merged data created by the merging means, event data or sensor data generated during a predetermined time including the occurrence time of event data specified in advance, the plurality of data series is extracted. The monitoring support device according to any one of claims 1 to 3, which creates the monitoring support device. The output means,
The method according to any one of claims 1 to 4, wherein the prediction result is transmitted to a monitoring device connected to the monitoring support device via a network, and a predetermined screen based on the prediction result is displayed on the monitoring device. Monitoring support equipment. The first calculating means includes:
The monitoring support device according to any one of claims 1 to 5, wherein a Kullback-Leibler information amount based on a hidden Markov model is calculated as the similarity between the plurality of data sequences. A monitoring support method used for a monitoring support device that supports monitoring of devices or equipment,
In accordance with event data obtained by encoding an event generated in the device or equipment stored in advance into a predetermined symbol for each event, and a range of sensor values measured in the device or equipment stored in advance. A merge procedure for creating first merge data in which sensor data encoded into predetermined symbols are merged in the order of the time at which the event occurred and the time at which the sensor value was measured ;
A creation procedure of creating a plurality of data series including pre-designated event data from the first merge data created by the merge procedure;
A first calculation procedure for calculating the degree of similarity between the plurality of data series created by the creation procedure,
A storage procedure of creating case data in which the plurality of data series are classified based on the similarity calculated by the first calculation procedure, and storing the created case data in a database;
Event data in which an event occurred in the device or equipment is encoded into a predetermined symbol for each event, and a sensor in which the event is encoded into a predetermined symbol according to a range of sensor values measured in the device or equipment. A second merged data obtained by merging data with the time at which the event occurred and the time at which the sensor value was measured, and a second degree of similarity between the case data stored in the database and the second merged data. Calculation procedure,
An acquisition procedure for acquiring the case data from the database based on the similarity calculated by the second calculation procedure;
An output procedure for creating a prediction result of the case data acquired by the acquisition procedure , and outputting the prediction result ,
A monitoring support method having: A monitoring support device that supports monitoring of equipment or equipment,
In accordance with event data obtained by encoding an event generated in the device or equipment stored in advance into a predetermined symbol for each event, and a range of sensor values measured in the device or equipment stored in advance. A merging procedure for creating first merge data in which sensor data encoded into predetermined symbols are merged in the order of the time when the event occurs and the time when the sensor value is measured ;
A creation procedure of creating a plurality of data series including event data specified in advance from the first merge data created by the merge procedure;
A first calculation procedure for calculating the similarity between a plurality of data series created by the creation procedure,
A storage procedure of creating case data in which the plurality of data series are classified based on the similarity calculated by the first calculation procedure, and storing the created case data in a database;
Event data in which an event occurred in the device or equipment is encoded into a predetermined symbol for each event, and a sensor in which the event is encoded into a predetermined symbol according to a range of sensor values measured in the device or equipment. A second merged data obtained by merging data with the time at which the event occurred and the time at which the sensor value was measured, and a second degree of similarity between the case data stored in the database and the second merged data. Calculation procedure,
An acquisition step of acquiring the case data from the database based on the similarity calculated by the second calculation step;
An output step of creating a prediction result of the case data obtained by the obtaining step , and outputting the prediction result ;
A program for executing

Images