JP6973445B2 - Display method, display device, and program - Google Patents

Description

The present invention relates to a display method, a display device, and a program, and more particularly to a display method, a display device, and a program for analyzing the state of a system.

In recent years, a system analyzer that analyzes the state of a system based on sensor data obtained from the components of the system has been used. The analysis process by such a system analyzer is performed for the purpose of operating the system safely and efficiently. Further, as one of the analysis processes, there is a process of detecting a system abnormality by performing multivariate analysis of sensor data. In such an analysis process, when the system analyzer detects an abnormality in the system, it notifies the operator and the system of the occurrence of the abnormality. As a result, it is possible to detect an abnormality or a sign of an abnormality at an early stage, accelerate the initial action of countermeasures, and minimize the damage.

Examples of the system to be analyzed include a group or a mechanism composed of mutually influential elements such as an ICT (Information and Communication Technology) system, a chemical plant, a power plant, and a power facility.

By the way, some system analyzers provide information that contributes to the identification of the cause when the system analyzer detects an abnormality in the system. One of the information provided is the name of the sensor associated with the anomaly. Patent Documents 1 and 2 disclose a technique for notifying an operator and a system of a sensor name related to such anomalies.

Specifically, the process monitoring and diagnostic apparatus disclosed in Patent Document 1 provides a sensor name having a high degree of abnormality at the time when the system analyzer detects an abnormality as a sensor name related to the abnormality.

Further, the time-series data processing apparatus disclosed in Patent Document 2 estimates the abnormal propagation order from the time-series data for a certain period of time, and provides the sensor names related to the abnormality by rearranging them in the estimated abnormal propagation order.

Further, Patent Document 3 describes a technique for appropriately detecting the occurrence of a failure by extracting the period in which the performance information does not satisfy the relationship shown by the correlation function as the failure period. ing.

Further, Patent Document 4 describes a technique of detecting an abnormality using an output signal of a sensor added to the equipment and creating a network of each sensor signal from information on the degree of influence of each sensor signal on the abnormality. There is.

Further, in Patent Document 5, among a plurality of sensor data items, those having a large mutual relationship of sensor data behavior are collected and grouped, and the mutual relationship between the data items in the group and the group are obtained. A technique for constructing a link model showing the mutual relationship between the two is described.

Japanese Unexamined Patent Publication No. 2014-096050 Japanese Unexamined Patent Publication No. 2014-115714 International Publication No. 2010/032701 Japanese Unexamined Patent Publication No. 2013-041448 Japanese Unexamined Patent Publication No. 2011-243118

The entire disclosure contents of Patent Documents 1 to 5 shall be renormalized and described in this document. The following analysis was made by the inventor of the present invention.

When an event including a plurality of types of abnormalities and signs of an abnormality is detected, the apparatus disclosed in Patent Documents 1 to 5 may confuse and output the plurality of detected events. Therefore, according to the devices disclosed in Patent Documents 1 to 5, there is a problem that the operator cannot properly grasp the state of the system in such a case.

Therefore, when a plurality of events occur in the system to be analyzed, it is a problem to separate each event and output the information corresponding to each event. An object of the present invention is to provide a display method, a display device, and a program that contribute to solving such a problem.

In the display method according to the first aspect of the present invention, a step of determining a sensor having an abnormal value for each of a plurality of sensors provided in a target as an abnormality sensor, and a plurality of groups of the determined abnormality sensors. And the steps to cluster to belong to one of
The step of determining the hierarchy among the plurality of groups is associated with the anomaly sensor with a symbol that can distinguish the group to which the anomaly sensor belongs, and the anomaly sensor is used together with information indicating the hierarchical relationship between the groups. , And steps to present to the user.

The display device according to the second aspect of the present invention includes a history information generation unit that determines a sensor having an abnormal value for each of a plurality of sensors provided in the target as an abnormality sensor, and the determined abnormality sensor. A clustering unit that clusters so as to belong to one of a plurality of groups, a cluster hierarchy structuring unit that determines a hierarchy among the plurality of groups, and a symbol that can distinguish the group to which the abnormality sensor belongs corresponds to the abnormality sensor. Attached, the abnormality sensor is provided with an output unit that presents the abnormality sensor to the user together with information indicating the hierarchical relationship between the groups using the symbol.

In the program according to the third aspect of the present invention, a process of determining a sensor having an abnormal value for each of a plurality of sensors provided in the target as an abnormality sensor, and a process of determining the determined abnormality sensor in a plurality of groups. The process of clustering so as to belong to any of the above, the process of determining the hierarchy among the plurality of groups, and the anomaly sensor are associated with a symbol that can distinguish the group to which the anomaly sensor belongs, and the anomaly is used. The computer is made to execute the process of presenting the sensor to the user together with the information indicating the hierarchical relationship between the groups. The program can also be provided as a program product recorded on a non-transitory computer-readable storage medium.

According to the display method, display device, and program according to the present invention, when a plurality of events occur in the system to be analyzed, each abnormality can be separated and information corresponding to each event can be output. can.

It is a block diagram which illustrates the structure of the display device which concerns on one Embodiment. It is a block diagram which shows the schematic structure of the display device in 1st Embodiment. It is a block diagram which illustrates the specific structure of the display device in 1st Embodiment. It is a figure which shows an example of the output result by the display device in 1st Embodiment. It is a figure which shows an example of the output result by the display device in 1st Embodiment. It is a figure which shows an example of the output result by the display device in 1st Embodiment. It is a figure which shows an example of the output result by the display device in 1st Embodiment. It is a figure which shows an example of the output result by the display device in 1st Embodiment. It is a flow diagram which illustrates the operation of the display device in 1st Embodiment. It is a block diagram which illustrates the specific structure of the display device in 2nd Embodiment. It is a flow diagram which illustrates the operation of the display device in 2nd Embodiment. It is a block diagram which illustrates the structure of the computer which realizes the display device in 1st and 2nd Embodiment.

First, an outline of one embodiment will be described. It should be noted that the drawing reference reference numerals added to this outline are merely examples for facilitating understanding, and the present invention is not intended to be limited to the illustrated embodiment.

FIG. 1 is a block diagram illustrating the configuration of the display device 10 according to the embodiment. Referring to FIG. 1, the display device 10 includes a history information generation unit 14, a clustering unit 15, a cluster hierarchical structure unit 16, and an output unit 18.

The history information generation unit 14 determines a sensor whose value is abnormal for each of a plurality of sensors (for example, the sensor 21 of FIGS. 2 and 3) provided in the target (for example, the analysis target system 200 of FIGS. 2 and 3). Determined as an abnormality sensor. The clustering unit 15 clusters the determined abnormality sensor so as to belong to any of a plurality of groups (for example, groups 1 to 3 in FIGS. 4 to 6). The cluster hierarchy structuring unit 16 determines a hierarchy between the plurality of groups (for example, FIG. 4). The output unit 18 associates the abnormality sensor with a symbol (for example, markers G1-1, G1-2, G2, etc. in FIG. 6) that can distinguish the group to which the abnormality sensor belongs, and uses the symbol to attach the abnormality sensor. It is presented to the user together with information indicating the hierarchical relationship between the groups.

According to the display device 10, a group of sensors obtained from the sensor history information based on the sensor value and a hierarchical structure of the group are presented to the user. At this time, the plurality of sensors are grouped according to the event. Therefore, according to the present embodiment, when a plurality of events occur in the analysis target system, each event can be separated and information corresponding to each event can be output. Furthermore, by making the groups hierarchically structured, even if the events caused in a chain by one root cause event are obtained as a plurality of groups, the causal relationship can be grasped as the hierarchical structure of the group. can. Therefore, the operator can grasp the system status more accurately.

In the following, "abnormality of sensor value output by sensor" and "relationship of sensor value output by different sensors (abnormality)" are simply referred to as "sensor abnormality" and "relationship between sensors (abnormality)", respectively. Also called.

<Embodiment 1>
Next, the display device, the display method, and the program according to the first embodiment will be described with reference to FIGS. 2 to 9.

[composition]
First, a schematic configuration of the display device according to the present embodiment will be described with reference to FIG. FIG. 2 is a block diagram illustrating a schematic configuration of the display device 100 in the present embodiment.

As shown in FIG. 2, the display device 100 in the present embodiment is a device that analyzes a target system (hereinafter referred to as “analysis target system”) 200. The display device 100 includes a history information generation unit 14 and an output unit 18.

The history information generation unit 14 is at least one of each of the sensors 21 and each of the relationships between the sensors 21 based on the processing results of the sensor values output by each of the plurality of sensors 21 provided in the analysis target system 200. Generate one's history information. The number of sensors 21 provided in the analysis target system 200 is not limited to four. The output unit 18 presents to the user cluster information in which each sensor 21 is a group of one or more, based on the generated history information and the causal relationship information between the sensors 21. Here, the cluster information includes an identifier indicating the sensor 21 included in each group and hierarchical structure information between the groups.

The sensor values output by each sensor 21 are various values obtained from the components of the analysis target system 200. For example, as the sensor value, a measured value acquired through a sensor 21 provided in a component of the analysis target system 200 can be mentioned. Examples of such measured values include valve opening degree, liquid level height, temperature, flow rate, pressure, current, voltage and the like. Further, as the sensor value, an estimated value calculated by using these measured values can also be mentioned. Further, as the sensor value, there is also a control signal issued by the information processing apparatus to change the analysis target system 200 to a desired operating state.

As described above, in the present embodiment, the group of the sensors 21 obtained from the history information based on the processing result of the sensor value and the hierarchical structure of the group are presented to the user. At this time, the plurality of sensors 21 are grouped according to the event. Therefore, according to the present embodiment, when a plurality of events occur in the analysis target system 200, each event can be separated and information corresponding to each event can be output. Furthermore, by making the groups hierarchically structured, even if the events caused in a chain by one root cause event are obtained as a plurality of groups, the causal relationship can be grasped as the hierarchical structure of the group. can. Therefore, the operator can more accurately grasp the status of the analysis target system 200.

Next, with reference to FIG. 3, the configuration of the display device 100 in the present embodiment will be described more specifically. FIG. 3 is a block diagram illustrating a specific configuration of the display device 100 in the present embodiment.

As shown in FIG. 3, in the display device 100 of the present embodiment, in addition to the history information generation unit 14 and the output unit 18 described above, the state information collection unit 11, the analysis model acquisition unit 12, the abnormality determination unit 13, and the clustering unit 15, a cluster hierarchical structure unit 16, and a causal relationship acquisition unit 17 may be further provided. Each of these parts will be described later.

Further, as shown in FIG. 3, the display device 100 is connected to the analysis target system 200 via a network. The display device 100 analyzes the abnormality generated in the analysis target system 200 from the sensor value of the analysis target system 200, and outputs the analysis result and additional information. In FIG. 3, the broken line rectangle surrounding the history information generation unit 14, the clustering unit 15, the cluster hierarchical structure unit 16, and the output unit 18 is such that each functional block surrounded by the broken line is the abnormality determination unit 13. Indicates that it operates based on the information output by.

Further, in the present embodiment, the analysis target system 200 includes one or more analyzed devices 20, and each analyzed device 20 is an analysis target. An example of the analysis target system 200 is a power plant system. In this case, examples of the device to be analyzed 20 include a turbine, a feed water heater, and a condenser. Further, the device to be analyzed 20 may include elements that connect devices such as pipes and signal lines. Further, the analysis target system 200 may be the entire system like the above-mentioned power plant system, or may be a part for realizing a part of the functions in a certain system. Further, it may be a group or a mechanism composed of elements that influence each other, such as an ICT (Information and Communication Technology) system, a chemical plant, a power plant, and a power facility.

In each of the analyzed devices 20, the sensor 21 provided in each analyzed device 20 measures the sensor value at predetermined timings, and transmits the measured sensor value to the display device 100. Further, in the present embodiment, the sensor 21 is not limited to a sensor 21 having an entity as hardware such as a normal measuring device. That is, the sensor 21 includes software, a control signal output source, and the like, and these are collectively referred to as a “sensor”.

The "sensor value" is a value obtained from the sensor 21. Examples of sensor values include valve opening, liquid level height, temperature, flow rate, pressure, current, voltage, and other measured values measured by measuring equipment installed in the equipment. Other examples of the sensor value include an estimated value calculated from the measured value, a control signal value, and the like. In the following, each sensor value shall be represented by a numerical value such as an integer or a decimal number. In FIG. 3, one sensor 21 is provided for one analyzed device 20. However, the number of sensors 21 provided in one analyzed device 20 is not particularly limited. Further, as a case where an abnormality occurs in the sensor value, not only a case where an abnormality occurs in the measurement target of the sensor 21 but also a case where an abnormality (failure) occurs in the sensor 21 itself can be considered.

Further, in the present embodiment, one data item is assigned to each sensor 21 corresponding to the sensor value obtained from each analyzed device 20. Further, a set of sensor values collected from each device to be analyzed 20 at the timing considered to be the same is referred to as "state information". Further, a set of data items corresponding to the sensor values included in the state information is referred to as a "data item group".

That is, in the present embodiment, the state information is composed of a plurality of data items. Here, "collected at the timing considered to be the same" may mean that each device 20 to be analyzed is measured at the same time or at a time within a predetermined range. Further, "collected at the timing considered to be the same" may mean that the items are collected by a series of collection processes by the display device 100.

Further, in the present embodiment, a storage device (not shown in FIG. 3) for storing the sensor value acquired by the analyzed device 20 may be provided between the analyzed device 20 and the display device 100. Examples of such a storage device include a data server, a DCS (Distributed Control System), a SCADA (Supervisory Control And Data Acquisition), a process computer, and the like. Further, when adopting such a configuration, the analyzed device 20 acquires the sensor value at an arbitrary timing and stores the acquired sensor value in the storage device. Then, the display device 100 reads out the sensor value stored in the storage device at a predetermined timing.

Here, the details of each functional block of the display device 100 will be described. First, the state information collecting unit 11 collects state information from the analysis target system 200. The analysis model acquisition unit 12 acquires the analysis model of the analysis target system 200. The causal relationship acquisition unit 17 acquires causal relationship information between sensors 21 (that is, information indicating a causal relationship between sensor values output by a plurality of sensors 21).

The "analysis model" determines whether each sensor 21 is normal or abnormal according to the sensor value of each of the plurality of sensors 21, and calculates the degree of abnormality indicating how abnormal each sensor 21 is. It is a model used in the above, and is constructed based on all or a part of a plurality of data items constituting the state information of the analysis target system 200. When the state information collected by the state information collecting unit 11 is input, the analysis model is used to determine normality and abnormality for each sensor 21 and to calculate the degree of abnormality.

Further, the analytical model may be a set of a plurality of models. When the analysis model is a set of a plurality of models, the results of normality or abnormality determination for each sensor 21 may be duplicated. Furthermore, the results of normal or abnormal determination for each overlapping sensor 21 in the analytical model may not be consistent. The analysis model may be constructed based on the time series of the state information obtained for the analysis target system 200.

Further, in the present embodiment, the analysis model may be stored in a storage device (not shown in FIG. 3) of the display device 100, or may be input from the outside. In the former case, the analysis model acquisition unit 12 acquires the analysis model from the storage device. On the other hand, in the latter case, the analysis model acquisition unit 12 acquires the analysis model from the outside via an input device such as a keyboard, a network, a recording medium, or the like.

The causal relationship information is information indicating a causal relationship between a plurality of sensors 21, is provided for all or a part of a plurality of data items constituting the state information of the analysis target system 200, and imparts a hierarchical structure to the group. Used to do. The causal relationship information may include an identifier indicating the presence or absence of a causal relationship between the sensors 21. As such an identifier, one that can identify four types of causal relationships can be used. Specifically, one indicating that there is no causal relationship (one type), one indicating that there is a bidirectional causal relationship between the two sensors 21 (one type), and one of the two sensors 21. One that indicates that there is a causal relationship from one to the other (two types of sensors 21 that correspond to the cause and effect are alternately replaced) can be used.

Further, the causal relationship information may be estimated from the time series of the state information acquired by the state information collecting unit 11, or may be estimated from the external information that does not depend on the time series of the state information.

In the former case, the causal relationship acquisition unit 17 uses, for example, a general data analysis technique for estimating the causal relationship between the sensors 21 from the time series of the state information acquired by the state information collection unit 11. This method includes a method of calculating and estimating a cross-correlation function while changing the time difference between two time-series data, a method of using Transfer Entropy, and a regression of the relationship between the two sensors 21. There are a method of estimating by an equation and estimating from the time delay of the coefficient of the regression equation, a method of using Cross Mapping, and the like. The time series of the state information used for estimating the causal relationship may be specified by the user when executing clustering, or may be determined based on a preset rule. When determining the time series of state information used to estimate the causal relationship based on a preset rule, for example, from the time when clustering is executed to the time when the operator goes back a predetermined period. good. Further, it may be from the time when the clustering is executed to the time when the abnormality determination unit 13 determines that the predetermined number of sensors 21 are abnormal. Further, it may be from the time when the clustering is executed to the time when the abnormality determination unit 13 determines that the predetermined number of sensors 21 are abnormal to the time when the abnormality is further advanced by a predetermined period.

On the other hand, in the latter case, the causal relationship acquisition unit 17 may estimate the causal relationship between the sensors 21 from, for example, the knowledge possessed by an expert or the equations related to the system operation.

Further, in the present embodiment, the causal relationship information may be stored in the storage device of the display device 100 (not shown in FIG. 3) or may be input from the outside. In the former case, the causal relationship acquisition unit 17 acquires causal relationship information from the storage device. On the other hand, in the latter case, the causal relationship acquisition unit 17 acquires causal relationship information from the outside via an input device such as a keyboard, a network, a recording medium, or the like.

The abnormality determination unit 13 applies the analysis model acquired by the analysis model acquisition unit 12 to the collected state information, so that at least one of the sensors 21 and the relationship between the sensors 21 is at least one of them. Judgment and calculation are performed for one of them, and the result is output.

In the present embodiment, the history information generation unit 14 generates history information from the result output by the abnormality determination unit 13 in a predetermined period. The historical information is output by abnormal or normal of the relationship between the sensors 21 included in the analysis model or the sensors 21 (that is, abnormal / normal of the data output by each sensor 21 or different sensors 21) in a predetermined period. Contains time-series data regarding abnormal / normal relationships between sensor values. Specifically, the history information includes the identifier of the data item or the combination of the data items of the sensor 21 and the normal or abnormal determination result (time series data) acquired along the time series for each data item or the combination of the data items. ) And. Here, depending on the analysis model, the identifier of the data item of the sensor 21 or the combination of the data items included in the history information may be duplicated.

Further, the history information includes, for example, one or more time-series data of the following (1) to (3).

(1) "Time-series data of normal or abnormal judgment results"
The history information includes, for example, data holding information indicating normality or abnormality, which is a determination result of the data, for each time of the determined data or for each time of the state information to which the determined data belongs. Further, for example, when a plurality of normal or abnormal determination results are obtained for one sensor 21, they are statistically processed so that time-series data of the normal or abnormal determination results for one sensor 21 is generated. You may do it. For example, in such processing, when the decision is made by majority vote at each time, a threshold value is set for the aggregated value of the judgment result at each time, and the magnitude relationship between the aggregated value and the threshold value and the determination result are ruled in advance. There are cases where it is decided. As another process, the judgment result of normality or abnormality of the relationship between the sensors 21 is determined for the graph structure in which the sensor 21 is a point and the relationship between the sensors 21 (for example, a correlation model described later) is a line. There is one that calculates the normality or abnormality determination result of the sensor 21 from the graph pattern given as information. The calculation target of such processing may be a determination result at a certain time, or may be a determination result for a specific period.

(2) "Time-series data of features generated from normal or abnormal judgment results"
For example, feature quantity time series data contains information about the length of time during which normal or abnormal occurrences occur consecutively. Further, the time-series data of the feature amount may include, for example, the number of times that normal or abnormal occurs continuously or discontinuously in a predetermined period. Further, the feature quantity time series data may include, for example, information regarding the total of the periods in which the features have occurred.

(3) "Time-series data of the degree of abnormality indicating the degree of abnormality of the sensor value"
The time-series data of the degree of abnormality of the sensor 21 includes a value estimated by the degree of abnormality of the sensor 21. Further, the time-series data of the degree of abnormality of the sensor 21 may include, for example, information regarding the difference between the prediction of the sensor value and the actual measurement (difference between the prediction and the actual measurement, the error ratio between the prediction and the actual measurement) at a predetermined time. Further, the time series data of the degree of anomaly of the sensor 21 may include, for example, a contribution to the ^{Q statistic or the T 2 statistic in the multivariate statistical process control.}

Further, in the present embodiment, the history information generation unit 14 may acquire the information necessary for generating the history information not only from the abnormality determination unit 13 described above but also from the analysis model acquisition unit 12.

The clustering unit 15 clusters each of the plurality of sensors 21 into one or more groups based on the generated history information. The clustering unit 15 clusters the sensors 21 included in the analysis model into one or more groups based on, for example, the time-series data in the above-mentioned predetermined period included in the history information.

First, the clustering unit 15 assigns a data item or a combination of data items to a member of a group by a clustering algorithm. When a combination of data items (corresponding to the relationship between the sensors 21) is included as a member of the group, the clustering unit 15 applies statistical processing to the combination of data items to estimate the data item related to the abnormality. Make sure that the members of the group consist only of data items.

The clustering unit 15 uses a data item or a data item using a clustering algorithm used in data mining such as Ising model clustering, k-means, x-means, NMF (Non-negative Matrix Factorization), Convolutive-NMF, and affinity propagation. Combinations of may be clustered.

Further, the time-series data included in the history information in the above-mentioned predetermined period may have a one-dimensional feature amount (scalar value, for example, an abnormal duration) defined at each time. In this case, in addition to the clustering algorithm used in the above-mentioned data mining, the clustering unit 15 can also use the change point detection or time series segmentation algorithm used in the data mining. In another example, the feature amount included in the history information is not limited to one dimension.

Further, the clustering unit 15 may execute the clustering a plurality of times by sequentially using the result of the clustering.

For the estimation of the data items related to the anomaly, for example, a graph pattern mining method may be used as the statistical processing performed on the combination of the data items. Specifically, for a graph structure in which the sensor 21 is a point and the relationship between the sensors 21 (for example, a correlation model described later) is a line, information on the determination result of normality or abnormality of the relationship between the sensors 21 is information. The normality or abnormality determination result of the sensor 21 may be calculated from the graph pattern given as.

Further, the clustering unit 15 estimates the abnormal start time for each group as cluster information. The abnormal start time for each group is estimated from the history information assigned to each group when the data items and the combinations of the data items are clustered. For example, the time when one of the data items or the combination of the data items included in each group is determined to be abnormal for the first time is set as the start time of the abnormality. In another example, the time when one of the data items or the combination of the data items included in each group is continuously determined to be abnormal is set as the start time of the abnormality.

The cluster hierarchical structure unit 16 gives a hierarchical structure to the group generated by the clustering unit 15 based on the causal relationship information between the sensors 21 acquired by the causal relationship acquisition unit 17 and the abnormal start time for each group.

When it is estimated that there is a causal relationship between groups, the cluster hierarchical structure unit 16 gives a hierarchical structure based on the direction of causality to the groups. On the other hand, the cluster hierarchical structuring unit 16 does not assign a hierarchical structure to the groups for which no causal relationship is found for any of the groups.

The cluster hierarchy structuring unit 16 estimates the direction of causality between groups based on the abnormal start time for each group. Specifically, the cluster hierarchical structuring unit 16 sets the direction from the group having an early abnormal start time to the group having a late abnormal start time as the causal direction.

The cluster hierarchy structuring unit 16 aggregates the number of causal relationships along the estimated causal direction between all or some of the two groups, and determines the causal relationships between the groups based on the aggregated value. As the determination condition, the cluster hierarchy structure unit 16 may use, for example, a condition that the aggregated value is equal to or more than a preset number. Further, the cluster hierarchy structuring unit 16 may use as a determination condition that the value obtained by dividing the aggregated value by the number of combinations between the members of the two groups is equal to or more than a preset number.

For example, as shown in FIG. 4, the output unit 18 uses a user (for example, an operation) of a group of sensors 21 obtained by clustering by the clustering unit 15 and a hierarchical structure obtained by calculation by the cluster hierarchical structuring unit 16. Person) or present to the system. Further, as shown in FIG. 5, for example, the output unit 18 may further output the result of estimating the time range in which the occurrence of an abnormality is suspected for each group of the sensors 21. Note that FIGS. 4 and 5 are merely examples of output results by the display device 100 in the present embodiment, and the output results are not limited to the illustrated embodiments.

Further, in the present embodiment, the output unit 18 may output, in addition to the group, the degree of abnormality of the sensor 21 belonging to the group of interest, its statistical value, or its recalculated value at a predetermined time. The method of presenting the group of sensors 21 by the output unit 18 is not limited to these methods.

Further, the output unit 18 may present a group of sensors 21 in the form of a list of sensor names. Further, as shown in FIG. 6, the output unit 18 may present a set of groups connected by a hierarchical structure and a hierarchical structure as identifiable markers (identifiers) on the system configuration diagram. In the latter case, that is, when the group of the sensors 21 is presented on the system configuration diagram as a marker that can distinguish the set of groups connected by the hierarchical structure and the hierarchical structure, the output unit 18 corresponds to the hierarchical structure of the markers. The parts may indicate the order of times in which the occurrence of anomalies is suspected. Further, the output unit 18 may configure a marker so that a group having no hierarchical structure and a group having a hierarchical structure can be distinguished.

FIG. 6 is a diagram showing an example of an output result by the display device 100 in the present embodiment. The analysis target system shown in FIG. 6 is a power plant system. Further, in FIG. 6, the numbers immediately after G in G1-1, G1-2, and G2 are numbers assigned to a set of hierarchical groups. On the other hand, the number following the hyphen (−) is the number assigned to the hierarchy in the set of groups. The presence or absence of a hyphen in the label indicates the presence or absence of a hierarchical structure. The output unit 18 is not limited to the character string as the expression method for indicating the presence or absence of the hierarchical structure, and may use other expression methods such as color and shape. In FIG. 6, a marker in which a group and a hierarchical structure can be identified is constructed by a label in which these two types of numbers are combined. The output unit 18 is not limited to the character string, and may use other expression methods such as color and shape as the expression method used to make the set of groups connected by the hierarchical structure and the hierarchical structure distinguishable. .. Further, the method of expressing a set of groups or a single representation of a hierarchical structure is not limited to the illustrated mode. Further, the number of layers is not limited to two, and may have a multi-layered structure.

Further, the output unit 18 may emphasize and present only a set of groups connected by a hierarchical structure and a part of the hierarchical structure.

Further, the output unit 18 may present only a set of groups connected by a hierarchical structure and a part of the hierarchical structure.

Further, the output unit 18 may present a set of groups connected by a hierarchical structure by switching the set of groups to be displayed according to the order of times when an abnormality is suspected to occur. At this time, the output unit 18 may switch the set of emphasized groups instead of completely switching the display. Further, the output unit 18 may automatically perform such switching at predetermined time intervals. Further, the output unit 18 may repeat a series of displays including this switching a predetermined number of times or until there is an operation by the user.

Further, the output unit 18 may display a part of a set of groups connected by a hierarchical structure. At this time, the output unit 18 may switch a set of emphasized groups or a group instead of completely switching the display.

Further, the output unit 18 may present a set of groups connected by a hierarchical structure by switching the set of groups to be displayed according to the order of times when an abnormality is suspected to occur. At this time, the output unit 18 may switch the set of emphasized groups instead of completely switching the display. Further, the output unit 18 may execute such switching according to the operation of the user, or may automatically switch at predetermined time intervals. Further, the output unit 18 may repeat a series of displays including such switching a predetermined number of times or until there is an operation by the user.

Further, the output unit 18 may present at least one of the causal relationship information within the group and the causal relationship information between the groups. When both are switched and displayed, the output unit 18 may execute this switching according to a user's operation, or may automatically switch at predetermined time intervals. Further, the output unit 18 may repeat a series of displays including such switching a predetermined number of times or until there is an operation by the user. Further, the output unit 18 may display the causal relationship information in the group and the causal relationship information between the groups by using different expression methods. For example, the output unit 18 expresses the causal relationship information between the groups by the label assigned to the group, while the causal relationship information in the group is the result sensor from the causal sensor 21 as shown in FIG. It may be expressed as an arrow to 21.

Further, as shown in FIG. 8, the output unit 18 displays the time-series data of the abnormality degree index (indicating the abnormality degree) regarding the system or the device in the time zone corresponding to the abnormality start time of each group, and is a symbol of each group. May be added and output. By outputting in this way, the degree of abnormality and the transition of the abnormal state can be collectively grasped, so that the user can efficiently grasp the status of the analysis target system 200.

Further, the output unit 18 presents the ratio of the physical quantity type of the sensor 21 included in the group or the set of the sensors 21 and the ratio of the system of the sensor 21 included in the group of the sensors 21 as a pie chart or a list. You may. The "system" indicates a structural unit of a functional system. The "system" may be specified in advance by the operator.

[motion]
Next, the operation of the display device 100 in the present embodiment will be described with reference to FIG. FIG. 9 is a flow chart illustrating the operation of the display device 100 in the present embodiment. In the following description, FIGS. 2 and 3 will be referred to as appropriate. Further, in the present embodiment, the display method is implemented by operating the display device 100. Therefore, the display method according to the present embodiment will be described by the following operation of the display device 100.

Here, as an example, it is assumed that the analysis model acquisition unit 12 has acquired the analysis model in advance. Further, it is assumed that the causal relationship acquisition unit 17 has acquired the causal relationship information between the sensors 21 in advance.

As shown in FIG. 9, the state information collecting unit 11 collects state information in a predetermined period from the analysis target system 200 (step S1).

Next, the abnormality determination unit 13 determines the sensor value included in the state information for each time using the analysis model acquired in advance by the analysis model acquisition unit 12 (step S2). As an example, the abnormality determination unit 13 determines whether the relationship between the sensor 21 or the sensor 21 belongs to normal or abnormal for each time. As another example, the abnormality determination unit 13 determines the degree of abnormality of the sensor 21 or the relationship between the sensors 21 for each time.

Next, the history information generation unit 14 generates history information from the determination result of the relationship between the sensors 21 or the sensors 21 by the abnormality determination unit 13 (step S3). Specifically, the history information generation unit 14 acquires the determination result of normality or abnormality of the relationship between the sensor 21 or the sensor 21 by the abnormality determination unit 13 in chronological order, and the determination acquired in chronological order. The result (that is, time series data) is used as historical information.

Next, the clustering unit 15 clusters the sensors 21 included in the analysis model into one or more groups based on the history information generated in step S3 (step S4). Specifically, the clustering unit 15 clusters each sensor 21 by using the above-mentioned clustering method based on the time-series data regarding the abnormality or normality of each sensor 21 in a predetermined period included in the history information.

Next, the cluster hierarchical structuring unit 16 hierarchically structures the group generated in step S4 based on the causal relationship information between the sensors 21 acquired from the causal relationship acquisition unit 17 (step S5).

Next, the output unit 18 presents the group of sensors 21 obtained by clustering in step S4 and the hierarchical structure obtained in step S5 to a user (for example, an operator), a system, or the like (step S6). ..

This completes the processing in the display device 100. Further, when the state information is output from the analysis target system 200 after the elapse of the predetermined period, the display device 100 executes steps S1 to S6 again.

[effect]
As described above, in the present embodiment, the display device 100 can separate the events by clustering even when a plurality of events are included. Therefore, the display device 100 can output information for each event. Furthermore, since the groups are hierarchically structured, even if the events caused in a chain by one root cause event are obtained as a plurality of groups, the causal relationship can be grasped as the hierarchical structure of the group. The operator can more accurately grasp the status of the analysis target system 200.

That is, in the present embodiment, since the sensors 21 are clustered based on the time-series data regarding the abnormality or normality of all the sensors 21 included in the analysis model, the sensors 21 are clustered for each change in the time-series regarding the abnormality or normality. Will be done. Therefore, even if a plurality of types of abnormalities occur consecutively and the occurrence time is different for each type of abnormality, each sensor 21 is in a state of being divided according to the type of abnormality. As a result, the user can obtain information for each type of abnormality. Further, according to the present embodiment, even if the events caused in a chain by one root cause event are obtained as a plurality of groups, the causal relationship between them can be grasped as a hierarchical structure of the group. Therefore, the operator can more accurately grasp the status of the analysis target system 200.

Subsequently, a modification of the present embodiment will be described below. In the following, the differences from the first embodiment described above will be mainly described.

<Modification 1>
In the first modification, the history information generation unit 14 specifies the length of time when each sensor 21 is determined to be abnormal for each sensor 21, and the specified time length is used as the history information. In the first modification, the history information includes the identifier of the data item of the sensor 21 and the length of time when the sensor 21 is determined to be abnormal. Further, the history information generation unit 14 obtains the ratio at which the individual sensors 21 are determined to be abnormal in a predetermined period, and multiplies the obtained ratio by a predetermined period to obtain the time during which the sensor 21 is determined to be abnormal. You may specify the length. As another method, the history information generation unit 14 may specify the length of time when the sensor 21 is determined to be abnormal by summing up the periods when the individual sensors 21 are determined to be abnormal in a predetermined period. good. As yet another method, the history information generation unit 14 determines that the sensor 21 is abnormal by totaling the number of times each sensor 21 is determined to be abnormal or the number of transitions from normal to abnormal in a predetermined period. You may specify the length of time that has been spent.

Here, the length of time when each sensor 21 is determined to be abnormal is also time-series information regarding abnormality or normality. Therefore, even when the modified example 1 is adopted, the same effect as that of the first embodiment described above can be obtained. Further, since the length of time when the sensor 21 is determined to be abnormal is one-dimensional data, according to the first modification, the clustering unit 15 is clustered with less computational resources than the first embodiment described above. Can be calculated.

<Modification 2>
In the second modification, the history information generation unit 14 specifies the length of time for which each sensor 21 is continuously determined to be abnormal for each sensor 21, and the specified time length is used as history information. .. In the second modification, the history information includes the identifier of the data item of the sensor 21 or the combination of the data items, and the time during which the sensor 21 is continuously determined to be abnormal with the latest time as the end point in a predetermined period (hereinafter, "" It includes the length of "continuation abnormal time".

Further, the history information generation unit 14 may calculate the length of the continuous abnormal time by using statistical processing. This is because when the sensor data fluctuates due to sensor noise or disturbance, the degree of abnormality is low, and the judgment of normality or abnormality may fluctuate between normality and abnormality.

Specifically, the history information generation unit 14 first divides a predetermined period into a plurality of periods, and determines whether or not the ratio of the time determined to be abnormal is larger than the predetermined threshold value for each divided period. .. Then, the history information generation unit 14 identifies a plurality of division period groups in which the determination result is continuously abnormal, with the latest time of the predetermined period as the end point, and determines the length of the specified division period group. , The length of the continuous abnormal time. It should be noted that duplication of normal or abnormal determination results for each sensor 21 and each relationship between the sensors 21 may or may not be permitted during a predetermined period.

Further, the predetermined threshold value used for the determination in the division period may be set by giving an arbitrary numerical value by the user. Further, a predetermined threshold value may be set based on the confidence interval of the Poisson distribution in the length of the division period when the fluctuation of normal or abnormal is assumed to be random.

Further, when the history information generation unit 14 temporarily becomes normal at intervals shorter than a predetermined length and then becomes abnormal again, the history information generation unit 14 ignores the normal period (that is, considers it as abnormal). May be good. Even with such a method, it may be possible to calculate an effective continuation abnormal time.

Such continuous abnormal time is also time series data regarding abnormality or normality. Therefore, even when the modified example 2 is adopted, the same effect as that of the first embodiment described above can be obtained. Further, since the continuous abnormal time is one-dimensional data, the clustering unit 15 can execute the clustering calculation with a small amount of calculation resources in the modification 2 as in the modification 1. Further, in the second modification, since the sensor 21 is clustered based on the continuous abnormal time, the clustering is performed in consideration of the fluctuation in the determination of normality or abnormality. Therefore, according to the modification 2, it is possible to present a more accurate group of sensors 21.

<Modification 3>
In the third modification, the calculation target of the history information is limited to the relationship between the two sensors 21. That is, the combination of data items is limited to the combination of the two sensors 21. This corresponds to the special case of the first embodiment. Therefore, in the modified example 3, the analysis model acquired by the analysis model acquisition unit 12 is different from the above-mentioned first embodiment.

In the modification 3, the analysis model acquisition unit 12 acquires a set of one or more correlation models as an analysis model. The correlation model is configured so that a predetermined sensor value can be estimated by inputting a sensor value of a predetermined one or more sensors 21. The correlation model includes a regression equation that estimates a particular sensor value using one or more sensor values other than the data item, and an allowable range of the estimation error.

By applying the correlation model to the collected state information, the abnormality determination unit 13 determines normality or abnormality for each sensor 21, that is, for each correlation model, and outputs a determination result.

In the modification 3, the history information generation unit 14 specifies the length of time continuously output when the correlation model is abnormal, and creates the specified time length as history information. The historical information includes the length of time that the correlation model continuously determines to be abnormal with the latest time in a predetermined period as the end point. Specifically, the history information includes the identifier of the correlation model, the data item included in the correlation model, and the time when the correlation model continuously determines that the abnormality is abnormal with the latest time of a predetermined period as the end point (hereinafter, "correlation model abnormality continuation"). Includes the length of "time".

Further, the history information generation unit 14 may calculate the length of the correlation model abnormality duration by using statistical processing. This is because when the sensor data fluctuates due to sensor noise or disturbance, the degree of abnormality is low, and the judgment of normality or abnormality may fluctuate between normality and abnormality. Further, the history information generation unit 14 may acquire the information necessary for generating the history information from the analysis model acquisition unit 12 and the abnormality determination unit 13.

Specifically, the history information generation unit 14 first divides a predetermined period into a plurality of periods, and determines whether or not the ratio of the time determined to be abnormal is larger than the predetermined threshold value for each divided period. .. Then, the history information generation unit 14 identifies a plurality of division period groups in which the determination result is continuously abnormal, with the latest time of the predetermined period as the end point, and determines the length of the specified division period group. Correlation model The length of the continuation abnormal time. It should be noted that duplication of normal or abnormal determination results for each sensor 21 may or may not be permitted during a predetermined period.

Further, the predetermined threshold value used for the determination in the division period may be set by giving an arbitrary numerical value by the user, and is the length of the division period when it is assumed that the fluctuation of normal or abnormal is random. It may be set based on the confidence interval of the Poisson distribution.

In the third modification, the clustering unit 15 clusters the sensors 21 into one or more groups based on the time series data regarding the abnormality or normality of all the correlation models included in the analysis model in a predetermined period.

Specifically, the clustering unit 15 first groups each correlation model included in the analysis model into one or more groups based on the time series data regarding the abnormality or normality of all the correlation models included in the analysis model in a predetermined period. Cluster to. Subsequently, the clustering unit 15 clusters each sensor 21 based on the clustering result of the correlation model.

For example, the clustering unit 15 counts the number of times each sensor 21 appears in the correlation model in each group, and assigns each sensor 21 to the group having the largest number of appearances. At this time, if there are groups having the same number of times, the sensors 21 may be allocated to each of the groups having the same value in duplicate, or may be assigned to any one group based on a predetermined rule.

Further, in the modification 3, the clustering unit 15 uses clustering algorithms used in data mining, such as Ising model clustering, k-means, x-means, NMF (Non-negative Matrix Factorization), Convolutive-NMF, and affinity propagation. It may be used to cluster the correlation model.

Further, for example, the time-series data regarding the abnormality or normality of the total correlation model in a predetermined period may be a one-dimensional feature amount with respect to time (for example, the duration of the abnormality). In this case, the clustering unit 15 may use a change point detection or time series segmentation algorithm used in data mining in addition to the clustering algorithm used in data mining.

<Modification example 4>
In the fourth modification, the cluster hierarchy structuring unit 16 performs the hierarchy only between the groups having the closest abnormal start times. With this configuration, the hierarchical structure of the group does not involve branching, so it is possible to suppress the complexity of the output result.

<Program>
The program according to this embodiment causes a computer to execute steps S1 to S6 shown in FIG. By installing and executing such a program on a computer, the display device 100 and the display method according to the present embodiment can be realized. In this case, the CPU (Central Processing Unit) of the computer has a state information collection unit 11, an analysis model acquisition unit 12, an abnormality determination unit 13, a history information generation unit 14, a clustering unit 15, a cluster hierarchical structure unit 16, and a causal relationship acquisition. Processing is performed while functioning as a unit 17 and an output unit 18.

Further, the program in the present embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer has a state information collection unit 11, an analysis model acquisition unit 12, an abnormality determination unit 13, a history information generation unit 14, a clustering unit 15, a cluster hierarchical structure unit 16, and a causal relationship acquisition unit 17. , And may function as any of the output units 18.

Further, the program in the present embodiment is stored in the storage device of the computer that realizes the display device 100, is read out by the CPU of the computer, and is executed. In this case, the program may be provided as a computer-readable recording medium or may be provided via a network.

<Embodiment 2>
Next, the display device, the display method, and the program according to the second embodiment will be described with reference to FIGS. 10 and 11.

[composition]
First, the configuration of the display device according to the second embodiment will be described with reference to FIG. FIG. 10 is a block diagram illustrating a specific configuration of the display device 300 in the present embodiment.

As shown in FIG. 10, the display device 300 in the present embodiment is different from the display device 100 in the first embodiment shown in FIGS. 2 and 3, and includes an abnormality detection unit 19. Other than this, the display device 300 has the same configuration as the display device 100. Hereinafter, the differences between the present embodiment and the first embodiment will be mainly described.

The abnormality detection unit 19 detects an abnormality in the analysis target system 200, the analyzed device 20, or the sensor 21 based on the state information collected by the state information collection unit 11. Specifically, the abnormality detection unit 19 collates the sensor value included in the state information with a predetermined abnormality detection condition, and detects the abnormality when the sensor value satisfies the abnormality detection condition.

Further, in the present embodiment, the abnormality detection condition is set by using the sensor value of the specific sensor 21, the increase / decrease range of the sensor value, and the like, and further by combining these. Further, the abnormality detection condition may be an abnormality detection condition set in the analysis model.

In the present embodiment, the history information generation unit 14 generates history information based on the time when an abnormality is detected by the abnormality detection unit 19. For example, the target period for generating historical information may be a predetermined period in the past based on the time when an abnormality is detected. The length of the predetermined period may be arbitrarily specified by the user. Further, the starting point of the predetermined period may be the oldest time in the period in which the abnormality occurred, which was analyzed using the analysis model, or the time when the immediately preceding clustering was executed. Further, the end point of the predetermined period may be a time point that is moved back and forth by a predetermined adjustment, such as a time point in which the time point at which the abnormality is detected is shortened by a predetermined period or a time point in which the time point is extended by a predetermined period.

The causal relationship acquisition unit 17 may estimate the causal relationship information from the time series of the state information acquired by the state information collection unit 11, or acquire the causal relationship information from the external information that does not depend on the time series of the state information. May be good.

In the former case, the causal relationship acquisition unit 17 may use, for example, a general data analysis technique in order to estimate the causal relationship between the sensors 21 from the time series of the state information acquired by the state information collection unit 11. As this method, a method of calculating and estimating a cross-correlation function while changing the time difference between two time-series data, a method of using transfer entropy, and a regression equation for the relationship between two sensors 21. There are a method of estimating with and estimating from the time delay of the coefficient of the regression equation, and a method of using Cross Mapping. The time series of the state information used for estimating the causal relationship may be specified by the user when performing clustering, or may be determined based on a preset rule. When the time series of the state information used for the estimation of the causal relationship is determined based on the preset rule, for example, it may be from the time when the clustering is executed to the time when the operator goes back for a predetermined period. Further, it may be from the time when the clustering is executed to the time when the abnormality determination unit 13 determines that the predetermined number of sensors 21 are abnormal. Further, it may be from the time when the clustering is executed to the time when the abnormality determination unit 13 determines that the predetermined number of sensors 21 are abnormal to the time when the abnormality is further advanced by a predetermined period. Further, the period may be set based on a predetermined rule based on the time when the abnormality detection unit 19 detects the abnormality.

On the other hand, in the latter case, the causal relationship acquisition unit 17 may estimate the causal relationship between the sensors 21 from, for example, the knowledge possessed by an expert or the equations related to the system operation.

[motion]
Next, the operation of the display device 300 in this embodiment will be described with reference to FIG. FIG. 11 is a flow chart illustrating the operation of the display device 300 in the present embodiment. In the following description, FIG. 10 will be referred to as appropriate. In the present embodiment, the display method is implemented by operating the display device 300. Therefore, the display method according to the present embodiment will be described by the following operation of the display device 300.

Here, as a premise, it is assumed that the analysis model acquisition unit 12 has acquired the analysis model in advance.

As shown in FIG. 11, the state information collecting unit 11 collects state information in a predetermined period from the analysis target system 200 (step S11).

Next, the abnormality detection unit 19 executes abnormality detection based on the state information collected in step S11, and determines whether or not the abnormality could be detected (step S12). If no abnormality is detected as a result of the determination (No in step S12), step S11 is executed again after the lapse of a predetermined period.

On the other hand, when an abnormality is detected as a result of the determination (Yes in step S12), the abnormality determination unit 13 applies the state information to the analysis model acquired in advance by the analysis model acquisition unit 12, and for each sensor 21 , Normality or abnormality at each time is determined (step S13).

Next, the history information generation unit 14 determines whether the relationship between the sensor 21 or the sensor 21 is normal or abnormal by the abnormality determination unit 13 for a predetermined period in the past based on the time when the abnormality is detected in step S12. To generate history information from (step S14).

Next, the clustering unit 15 clusters the sensors 21 included in the analysis model into one or more groups based on the historical information generated in step S14 (step S15).

Next, the cluster hierarchical structuring unit 16 hierarchically structures the group generated in step S15 based on the causal relationship information between the sensors 21 acquired from the causal relationship acquisition unit 17 (step S16).

Next, the output unit 18 presents the hierarchical structure of the group of the sensors 21 obtained by the clustering in step S15 and the group obtained in step S16 to the user (for example, the operator), the system, and the like (step S17). ..

This completes the processing in the display device 300. Further, when the state information is output from the analysis target system 200 after the elapse of a predetermined period, the display device 300 again executes steps S11 to S17 in FIG.

[effect]
As described above, according to the display device 300 of the present embodiment, the same effect as that of the display device 100 of the first embodiment can be obtained. Further, in the present embodiment, since the abnormality is detected, the period for which the history information is generated is automatically set. Therefore, according to the present embodiment, it is possible to significantly reduce the load on the system operation by the operator.

<Program>
The program in this embodiment causes a computer to execute steps S11 to S17 shown in FIG. By installing and executing this program on a computer, the display device 300 and the display method according to the present embodiment can be realized. In this case, the CPU (Central Processing Unit) of the computer has a state information collection unit 11, an analysis model acquisition unit 12, an abnormality determination unit 13, a history information generation unit 14, a clustering unit 15, a cluster hierarchical structure unit 16, and a causal relationship acquisition. It functions as a unit 17, an output unit 18, and an abnormality detection unit 19 to perform processing.

Further, the program in the present embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer has a state information collection unit 11, an analysis model acquisition unit 12, an abnormality determination unit 13, a history information generation unit 14, a clustering unit 15, a cluster hierarchical structure unit 16, and a causal relationship acquisition unit 17. , The output unit 18, and the abnormality detection unit 19.

Further, the program in the present embodiment may be stored in a storage device of a computer that realizes the display device 300, and may be read out and executed by the CPU of the computer. In this case, the program may be provided as a computer-readable recording medium or may be provided via a network.

By the way, the first and second embodiments described above have described the case where the analysis target system 200 is a power plant system, but the analysis target system 200 is not limited to this in the present invention. Examples of the analysis target system 200 include IT (Information Technology) systems, plant systems, structures, transportation equipment, and the like. Even in these cases, the display device 100 (or 300) can cluster the data items by using the item of data included in the information indicating the state of the analysis target system as the data item.

Further, in the first and second embodiments described above, each functional block of the display device 100 (or 300) is realized by a storage device or a CPU that executes a computer program stored in a ROM (Read Only Memory). I mainly explained the example. However, the present invention is not limited to this. In the present invention, in the display device 100 (or 300), the entire functional block may be realized by dedicated hardware, or a part of the functional block is realized by hardware and the rest is realized by software. May be good.

Further, in the present invention, the above-mentioned first and second embodiments may be combined as appropriate. Furthermore, the present invention is not limited to each of the above-described embodiments, and can be implemented in various embodiments.

(Physical configuration)
Here, a computer that realizes a display device by executing the programs in the first and second embodiments will be described with reference to FIG. FIG. 12 is a block diagram showing as an example a computer that realizes the display devices 100 and 300 according to the first and second embodiments.

Referring to FIG. 12, the computer 110 includes a CPU (Central Processing Unit) 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. Each of these parts is connected to each other via a bus 121 so as to be capable of data communication.

The CPU 111 expands the programs (codes) of the first or second embodiment stored in the storage device 113 into the main memory 112, executes them in a predetermined order, and performs various operations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). Further, the program according to the first or second embodiment is provided in a state of being stored in a computer-readable recording medium 120. The program in the present embodiment may be distributed on the Internet connected via the communication interface 117.

Further, specific examples of the storage device 113 include a semiconductor storage device such as a flash memory in addition to a hard disk drive (HDD). The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as keyboards and mice. The display controller 115 is connected to the display device 119 and controls the display on the display device 119.

The data reader / writer 116 mediates the data transmission between the CPU 111 and the recording medium 120, reads the program from the recording medium 120, and writes the processing result in the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and another computer.

Specific examples of the recording medium 120 include a general-purpose semiconductor storage device such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), a magnetic storage medium such as a flexible disk, or a CD. -Examples include optical storage media such as ROM (Compact Disk Read Only Memory).

As described above, according to the above embodiment, when a plurality of types of abnormalities occur in the system to be analyzed, the abnormalities are separated according to the types, and information for each type can be output. Can be done. The present invention, as an example, can be suitably applied to applications for system abnormality diagnosis.

In the present invention, the following forms are possible.
[Form 1]
This is the display method according to the first aspect.
[Form 2]
The hierarchy among the plurality of groups is determined based on the causal relationship between the abnormality sensors belonging to the plurality of groups.
The display method according to the first embodiment.
[Form 3]
The causal relationship between the plurality of groups is determined based on the causal relationship between the abnormality sensors belonging to the plurality of groups.
The display method according to the second embodiment.
[Form 4]
The symbol can identify the future of the anomaly start time estimated in the group to which the anomaly sensor corresponding to the symbol belongs.
The display method according to any one of embodiments 1 to 3.
[Form 5]
In the step of presenting to the user, information indicating the range of the abnormal time estimated in each group is further presented to the user.
The display method according to any one of embodiments 1 to 4.
[Form 6]
In the step of presenting to the user, the symbol is presented to the user by superimposing it on a diagram showing the object.
The display method according to any one of embodiments 1 to 5.
[Form 7]
The step includes displaying at least one of the information indicating the hierarchical relationship of the plurality of groups and the information indicating the causal relationship between the abnormality sensors belonging to each group.
The display method according to any one of embodiments 1 to 6.
[Form 8]
A step of displaying the time-series data of the degree of abnormality of the target by adding information indicating each group to a time zone in which each group indicates an abnormality is included.
The display method according to any one of embodiments 1 to 7.
[Form 9]
This is the display device according to the second aspect.
[Form 10]
This is the program according to the third aspect.

The entire disclosure of the above patent documents shall be renormalized and described in this document. Within the framework of the entire disclosure (including the scope of claims) of the present invention, the embodiments can be changed and adjusted based on the basic technical idea thereof. Further, various combinations or selections of various disclosure elements (including each element of each claim, each element of each embodiment, each element of each drawing, etc.) are possible within the framework of all disclosure of the present invention. be. That is, it goes without saying that the present invention includes all disclosure including claims, various modifications and modifications that can be made by those skilled in the art in accordance with the technical idea. In particular, with respect to the numerical range described in this document, any numerical value or small range included in the range should be construed as being specifically described even if not otherwise described.

10, 100, 300 Display device 11 Status information collection unit 12 Analysis model acquisition unit 13 Abnormality judgment unit 14 History information generation unit 15 Clustering unit 16 Cluster hierarchy structuring unit 17 Causal relationship acquisition unit 18 Output unit 19 Anomaly detection unit 20 Device 21 Sensor 110 Computer 111 CPU (Central Processing Unit)
112 Main memory 113 Storage device 114 Input interface 115 Display controller 116 Data reader / writer 117 Communication interface 118 Input device 119 Display device 120 Recording medium 121 Bus 200 Analysis target system

Claims (10)

A step of determining a plurality of abnormal sensors as abnormality sensors from the judgment result of normality or abnormality of the value for each of the plurality of sensors provided in the target.
Each of the determined abnormality sensors is clustered into a plurality of groups based on the determination result, the feature amount generated from the determination result, or the time-series data of the degree of abnormality indicating the degree to which the value is abnormal. Steps to do and
A step of presenting information indicating the plurality of groups to the user, and the like.
A display method characterized by that. The display method according to claim 1, wherein the clustering step clusters each of the determined abnormality sensors into a plurality of groups based on the time when the determined abnormality sensor detects an abnormality. The information indicating the plurality of groups includes a hierarchy determined based on the causal relationship between the plurality of groups.
The display method according to claim 1 or 2. The causal relationship between the plurality of groups is determined based on the causal relationship between the abnormality sensors belonging to the plurality of groups.
The display method according to claim 3. The step includes displaying at least one of the information indicating the hierarchical relationship of the plurality of groups and the information indicating the causal relationship between the abnormality sensors belonging to each group.
The display method according to claim 3 or 4. In the step of presenting to the user, information indicating the range of the abnormal time estimated in each group is further presented to the user.
The display method according to any one of claims 1 to 5. A step of displaying the time-series data of the degree of abnormality of the target by adding information indicating each group to a time zone in which each group indicates an abnormality is included.
The display method according to any one of claims 1 to 6. The information indicating the plurality of groups is displayed as a symbol that can identify the future of the abnormality start time estimated in the group to which the abnormality sensor belongs.
The display method according to any one of claims 1 to 7. A history information generator that determines multiple abnormal sensors as abnormal sensors from the normal or abnormal judgment results of the values for each of the plurality of sensors provided in the target.
Each of the determined abnormality sensors is clustered into a plurality of groups based on the determination result, the feature amount generated from the determination result, or the time-series data of the degree of abnormality indicating the degree to which the value is abnormal. Clustering part and
An output unit that presents information indicating the plurality of groups to the user.
A display device characterized by that. A process of determining a plurality of abnormal sensors as abnormality sensors from the judgment result of normality or abnormality of the value for each of the plurality of sensors provided in the target.
Each of the determined abnormality sensors is clustered into a plurality of groups based on the determination result, the feature amount generated from the determination result, or the time-series data of the degree of abnormality indicating the degree to which the value is abnormal. And the processing to do
The process of presenting the information indicating the plurality of groups to the user and the process of presenting the computer to perform the process are performed.
A program characterized by that.

Images