JP7218867B2 - Anomaly detection device and anomaly detection method - Google Patents

Description

The present invention relates to an anomaly detection device and an anomaly detection method.

Patent Document 1 discloses a conventional abnormality detection device. This abnormality detection device detects a failure of the combustor. This anomaly detection device includes a sensor and a computer. A sensor detects combustion pressure dynamics data from the combustor. A computer converts the combustion pressure dynamics data sensed by the sensor into a frequency spectrum and produces a feature value within each frequency interval divided into a plurality of frequency intervals. This feature value is stored for the computer to generate a history database. The computer also performs machine learning using feature values indicative of non-failed and failed combustor operation to recognize feature behavior indicative of a failed combustor.

JP 2015-108375 A

However, the anomaly detection device disclosed in Patent Document 1 requires feature values for both the non-failed combustor operation and the failed combustor operation when performing machine learning. For this reason, it is necessary to detect abnormalities well in situations where the data in the case of a failure (data in the abnormal state) is overwhelmingly smaller than the data in the case of no failure (data in the normal state). may not be possible. Also, since this anomaly detection device converts the combustion pressure dynamics data into a frequency spectrum, the time information disappears. For this reason, it is not possible to detect an abnormality when the waveforms of input data do not have similar shapes over time.

The present invention has been made in view of the above-mentioned conventional circumstances, and is capable of appropriately detecting anomalies even when the data to be evaluated for detecting anomalies has an overwhelmingly small ratio of anomalous data to normal data. It is an object of the present invention to provide an anomaly detection device and an anomaly detection method that can detect an anomaly even if the shapes of waveforms, which are input data, do not resemble each other over time. and

The anomaly detection device of the present invention detects an anomaly by utilizing the fact that the generated time-series waveforms differ between normal and anomalous conditions. This anomaly detection device includes a conversion section, a correct image generation section, a machine learning section, and a judgment section. A transform unit transforms the waveform into a graphed multi-dimensional image having a time component and a frequency component. The correct image generator extracts at least one of the time component and the frequency component from the normal waveform, and converts the normal waveform into a multidimensional image to generate a correct image. The machine learning section transforms the normal waveform by the transforming section, inputs the transformed multidimensional image, and learns so that the output image is closer to the correct image. The judgment unit converts the waveform to be evaluated by the conversion unit, inputs the converted multidimensional image to the learned machine learning unit, and judges an abnormality by using an output image that is output.

In addition, the anomaly detection method of the present invention detects an anomaly by utilizing the fact that the generated time-series waveforms differ between normal and anomalous conditions. This anomaly detection method includes a conversion process, a correct image generation process, a learning process, and a judgment process. The transformation step transforms the waveform into a graphed multi-dimensional image having time and frequency components. In the correct image generation step, a characteristic portion of at least one of the time component and the frequency component is extracted from the normal waveform, and a conversion step is performed to convert the normal waveform into a multidimensional image to generate a correct image. In the learning step, the transforming step is performed on the normal waveform, the transformed multidimensional image is input to the machine learning unit, and the machine learning unit learns so that the outputted output image approaches the correct image. The judgment step executes a conversion step on the waveform to be evaluated, inputs the converted multidimensional image to a machine learning unit that has already learned, and judges an abnormality using an output image that is output.

In this anomaly detection device and anomaly detection method, in the learning process, the normal waveform is converted by the conversion unit, the converted multidimensional image is input to the machine learning unit, and the output image is closer to the correct image. to learn. Then, in the determination step, the waveform to be evaluated is transformed by the transformation unit, the transformed multidimensional image is input to the machine learning unit that has already learned, and the abnormality is determined using the output image. Therefore, the abnormality detection device and the abnormality detection method can appropriately detect an abnormality even if the ratio of abnormal data to normal data is overwhelmingly small. In addition, in this anomaly detection device and anomaly detection method, since the output image output from the machine learning unit is obtained by extracting at least one of the time component and the frequency component, the difference between the normal state and the abnormal state is It becomes clear, and an abnormal judgment can be made appropriately.

The correct image generating section of the anomaly detection apparatus of the present invention can generate a correct image by extracting the time point at which the peak portion of the waveform is located as the characteristic portion of the time component. In this case, this abnormality detection device is suitable for time-series waveforms in which peaks occur periodically.

The determination unit of the abnormality detection device of the present invention can determine abnormality using the degree of similarity between the output image and the correct image as an index. In this case, the anomaly detection device can reliably determine the anomaly by quantifying the degree of similarity.

The determination unit of the abnormality detection device of the present invention can determine abnormality using the linearity of the output image as an index. In this case, this abnormality detection device can reliably determine an abnormality by quantifying the linearity.

4 is a conceptual diagram showing the configuration of a learning process in the anomaly detection device of Embodiment 1; FIG. 4 is a conceptual diagram showing the configuration of an inference process in the anomaly detection device of Embodiment 1; FIG. FIG. 4 is a diagram showing conversion from an original waveform to a spectrogram; FIG. 10 illustrates the steps of generating a correct image; FIG. 4 is an explanatory diagram for extracting a peak portion of a waveform; FIG. 4 is a diagram showing an AE input image and an output image; FIG. 10 is a diagram showing an output image and a correct image output from a learned AE; Fig. 3 shows the stages of line detection; It is a table|surface which shows the result evaluated by each evaluation method.

A first embodiment embodying an abnormality detection device of the present invention will be described with reference to the drawings.

<Embodiment 1>
The abnormality detection device of Embodiment 1 detects abnormality (elongation of the chain) of the chain conveyor. This anomaly detection device detects an anomaly by executing the learning process shown in FIG. 1 and the inference process shown in FIG. As shown in FIGS. 1 and 2, this anomaly detection device includes a sensor 10, a data collection device 11, and computers 20A and 20B. Sensor 10 is an acceleration sensor mounted on the rail near the drive motor of the chain conveyor. Data collection device 11 collects data from sensor 10 .

Computer 20A is used in the learning process and has a learning program installed. The computer 20A functions as a conversion section 30, a correct image generation section 40, and a machine learning section 50 by executing a learning program.
The computer 20B is used in the inference process and has an anomaly detection program installed. The computer 20B functions as a conversion section 30, a correct image generation section 40, and a determination section 60 by executing an anomaly detection program.
In other words, this anomaly detection device includes a conversion section 30 , a correct image generation section 40 , a machine learning section 50 and a judgment section 60 .

The sensor 10 transmits the detected acceleration data to the computers 20A and 20B via the data collection device 11. FIG. The acceleration data detected by the sensor 10 is time-series waveform data. The data collecting device 11 collects the acceleration data transmitted from the sensor 10 every predetermined period for an arbitrary sampling period (for example, every 10 minutes for 5 seconds) (see "original waveform" shown in FIG. 3). For this reason, there is no concept of a definite start time and end time, and when the collected waveforms themselves are compared, the shapes of the waveforms are not similar over the entire area.

As shown in FIG. 3, the conversion unit 30 converts an input waveform (original waveform) or a peak waveform described later (see FIG. 4B) into a spectrogram. A spectrogram is a three-dimensional graph in which the horizontal axis represents time, the vertical axis represents frequency, and the intensity of the signal component is represented by color. That is, the conversion unit 30 converts the input waveform into a graphed multidimensional image having time components and frequency components.

As shown in FIGS. 1 and 2, the correct image generation unit 40 generates waveforms in arbitrary sampling periods transmitted from the sensor 10 to the computers 20A and 20B via the data collection device 11 while the chain conveyor is in operation. Generate a correct image from That is, the correct image generation unit 40 extracts the characteristic portion of the time component of the waveform to generate a peak waveform, and also generates a correct image converted into a spectrogram by the conversion unit 30 .

More specifically, the correct image generation unit 40 sets the characteristic portion of the time component of the waveform to the time point at which the peak portion of the waveform is located. As for the peak portion of this waveform, as shown in FIG. 5B, the maximum value within the first set time (for example, 0.75 seconds) of data in an arbitrary sampling period is extracted as the first peak portion. Then, as shown in FIGS. 5(C) and 5(D), the extraction of the maximum value of the set times that are the same as or different from the first set time from the previous peak is repeated as the next peak. Then, as shown in FIG. 5D, the sampling period of the waveform data ends when the peak portion is extracted within a predetermined time (for example, 0.75 seconds) from the final point of the sampling period. In FIGS. 5(B) to 5(D), circles drawn at the tips of the waveforms indicate extracted peak portions.

In this way, the correct image generation unit 40 generates a peak waveform from the waveform from which the peak portion is extracted by setting the values other than 100 pixels before and after the peak portion to 0 (see FIG. 4B). Then, the correct image generation unit 40 converts the peak waveform into a spectrogram in the conversion unit 30 to generate a correct image (see FIG. 4(C)). This correct image is a spectrogram near the periodically occurring peaks of the waveform.

<Learning process>
In the learning process, the correct image generation unit 40, as shown in FIG. A correct image is generated from the waveform (normal waveform). That is, the correct image generation unit 40 in the learning process extracts the characteristics of the time component of the normal waveform to generate a peak waveform (see FIG. 4B), and the correct image converted into the spectrogram by the conversion unit 30. is generated (see FIG. 4(C)).

The machine learning unit 50 executed in the learning process uses AE (Auto Encoder).
The machine learning unit 50 inputs the spectrogram (input image) obtained by converting the normal waveform by the conversion unit 30 to the AE, evaluates the degree of matching between the output image output from the AE and the correct image, and determines whether the output image is the correct one. Update (learn) the AE to be closer to the image.
As shown in FIG. 6, in this anomaly detection apparatus, the input image input to the AE in the learning process is a spectrogram image. Images only.

<Inference process>
In the inference process, the correct image generation unit 40, as shown in FIG. A correct image is generated from the waveform to be evaluated, which is a waveform. In other words, in the inference process, not only the waveform when the chain conveyor is operating normally (normal waveform), but also the waveform when the chain conveyor is operating abnormally (abnormal waveform) is included in the computer 20B in real time. and a correct image is generated using these waveforms. That is, the correct image generation unit 40 in the inference process extracts the characteristics of the time component of the normal waveform or the abnormal waveform to generate a peak waveform, and also generates a correct image converted into a spectrogram by the conversion unit 30. .

The decision unit 60 in the inference process introduces and utilizes the learned AE that has been sufficiently learned in the learning process to the computer 20B. It should be noted that bringing the AE to a sufficiently learned state in the learning process will be described later.
This determination unit 60 converts the waveform (acceleration data) to be evaluated by the conversion unit 30, inputs the converted spectrogram to the trained AE, and compares the output image output from the trained AE with the correct image to obtain an image. Abnormality is determined by evaluation.
In this anomaly detection device, as shown in FIG. 6, the input image input to the trained AE in the inference process is an image of a spectrogram, but the output image output from the trained AE is a peak of a waveform that occurs periodically. It is only an image of the nearby spectrogram.

The learned AE learns only with normal waveforms, and captures only the characteristics of normal waveforms. Therefore, when a spectrogram obtained by transforming the normal waveform is input to the trained AE, the output image and the correct image are similar. However, when a spectrogram obtained by converting the abnormal waveform is input to the learned AE, it is not possible to construct a part that can be constructed in the normal state, and the abnormal part tends to disappear from the output image. As a result, when the output image output from the learned AE and the correct image are compared, a large difference appears, which makes it easier to detect an abnormality.

Here, the following three methods can be used for image evaluation by comparing the output image and the correct image.
<PSNR>
First, the first method uses the peak S/N ratio between the output image output from the trained AE and the correct image, that is, the PSNR (Peak signal-to-noise ratio) shown in Equation 1 as an index. to evaluate. This PSNR indicates the similarity between the output image and the correct image, and the higher the similarity between the output image and the correct image, the higher the value. That is, in the first method, it can be determined that a PSNR value higher than a specific value is normal, and a PSNR value lower than a specific value is abnormal. Note that MSE in Equation 1 is the mean squared error, and MAX is 255.

<Image matching rate>
The second method uses the image matching rate as an index for evaluation. As shown in FIG. 6, this method compares the same pixels in the output image output from the trained AE and the correct image, and calculates the ratio of pixels with small luminance difference. That is, evaluation is performed using the image matching rate shown in Equation 2 as an index. Here, the threshold value of the luminance difference to be regarded as a matching pixel is set to ±5. This image matching rate also indicates the degree of similarity between the output image and the correct image, and the higher the degree of similarity between the output image and the correct image, the higher the value. That is, in the second method, it can be determined that an image matching rate value higher than a specific value is normal, and that an image matching rate lower than a specific value is abnormal.

<Linear detection>
The third method, as shown in FIG. 8, uses a probabilistic Hough transform (method for detecting straight lines from an image) to detect straight lines from an output image output from a trained AE, and evaluates the linearity. Evaluate as an index. Specifically, the output image (see FIG. 8A) is converted to grayscale (see FIG. 8B). Then, edge detection is performed by the Canny method (see FIG. 8(C)), and probabilistic Hough transform is performed (see FIG. 8(D)). The number of straight lines and the average length of the image after Hough transform are quantified and evaluated.
When the AE is correctly reconstructed (normal), the output image output from the trained AE is an image with vertical straight lines. Many straight lines with shorter lengths are output compared to the case where From this, it can be determined that a small number of straight lines and a long average length is normal, and that a large number of straight lines and a short average length is abnormal.

Next, an abnormality detection method using the above-described abnormality detection device will be described below.
This anomaly detection method first executes a learning process to train the AE, and then utilizes the trained AE to execute an inference process. The learning process, as shown in FIG. 1, includes a conversion process, a correct image generation process, and a learning process. The inference process, as shown in FIG. 2, comprises a conversion process, a correct image generation process, and a judgment process.

In the learning process of this abnormality detection method, as shown in FIG. 1, in the conversion step, the normal waveform (acceleration data) is input to the conversion unit 30 and converted into a spectrogram.
Further, in the correct image generation step, the correct image generation unit 40 extracts a characteristic portion (time point at which the peak portion of the waveform is located) of the time component of the normal waveform (acceleration data) (see FIG. 4B). At the same time, a conversion process is executed to generate a correct image converted into a spectrogram by the conversion unit 30 (see FIG. 4(C)). This correct image is a spectrogram near the periodically occurring peaks of the waveform.

Next, in the learning process, the machine learning unit 50 repeats steps (1) to (4) shown below until the output image output from the AE and the correct image are close to each other. Put it in a learned state and save this learned AE.
(1) Prepare a plurality of spectrograms (input images) (for example, several tens to several thousand) obtained by converting the normal waveform by the conversion unit 30 in the conversion process, and input them to the AE.
(2) Generate an output image output from the AE.
(3) Evaluate the degree of matching between the output image and the correct image.
(4) Update (learn) the AE so that the output image is closer to the correct image.
Thus, in this anomaly detection method, as shown in FIG. 6, in the learning process, the input image input to the AE is a spectrogram image, but the output image output from the AE is a waveform that is periodically generated. It is only an image of the spectrogram near the peak.

In the inference process of this anomaly detection method, as shown in FIG. 2, in the conversion step, the waveform (acceleration data) to be evaluated is input to the converter 30 in real time and converted into a spectrogram. Waveforms to be evaluated are not limited to normal waveforms, and may include abnormal waveforms.
Further, in the correct image generation step, the correct image generation unit 40 extracts the characteristic portion of the time component of the waveform (acceleration data) to be evaluated (the time point at which the peak portion of the waveform is located), and executes the conversion step to convert A correct image converted into a spectrogram is generated in a section 30 . This correct image is a spectrogram near the periodically occurring peaks of the waveform.

Next, in the determination step, the determination unit 60 inputs the spectrogram obtained by converting the waveform to be evaluated by the conversion unit 30 in the conversion step into the learned AE, evaluates the outputted output image, and determines abnormality. The evaluation of the output image is the three methods described above (PSNR, image matching rate, line detection).

The waveform to be evaluated, which is transmitted from the sensor 10 attached to the rail near the drive motor of the chain conveyor actually in operation via the data collection device 11, is detected as abnormal using the abnormality detection device and the abnormality detection method described above. FIG. 8 shows the result of detection of .
8A to 8C show that the chain conveyor is operated in an abnormal state in which the chain is stretched, and the abnormal waveforms that are transmitted from the sensor 10 through the data collection device 11 and collected by the computer 20B are evaluated. It is what I did. In addition, d to g in FIG. 8 operate the chain conveyor in a normal state in which the chain is cut to an appropriate length, and the normal waveform transmitted from the sensor 10 and collected by the computer 20B is evaluated. It is what I did.

There are variations in values in each evaluation of waveforms a to c, which are abnormal waveforms, and each evaluation of waveforms d to g, which are normal waveforms. The value is smaller than the values of d to g. As for the number of straight lines in straight line detection, the general tendency is that the values of a to c are larger than the values of d to g, and the average length of the values of a to c is higher than the values of d to g. short.

In this way, when evaluating using the PSNR as an index, which is the first evaluation method described above, it is possible to determine that a PSNR value higher than a specific value is normal, and that a PSNR value lower than a specific value is abnormal. can. In addition, when evaluating using the image matching rate as an index, which is the second evaluation method described above, if the value of the image matching rate is higher than a specific value, it is determined to be normal, and if it is lower than the specific value, it is determined to be abnormal. be able to. In addition, when evaluating linearity as an index, which is the third evaluation method described above, a small number of straight lines and a long average length are normal, and a large number of straight lines and a short average length are abnormal. can be determined to be When each index is evaluated and an abnormality is determined, values of at least three points are averaged for determination.

As described above, the anomaly detection device of the first embodiment detects an anomaly by utilizing the fact that the generated time-series waveforms differ between normal and anomalous times. This anomaly detection device includes a conversion section 30 , a correct image generation section 40 , a machine learning section 50 and a judgment section 60 . A converter 30 converts the waveform into a spectrogram. The correct image generation unit 40 extracts the peak portion of the normal waveform, and the conversion unit 30 converts it into a spectrogram to generate a correct image. The machine learning unit 50 transforms the normal waveform by the transforming unit 30, inputs the transformed spectrogram to the AE, and learns so that the output image approaches the correct image. The judgment unit 60 converts the waveform to be evaluated by the conversion unit 30, inputs the converted spectrogram to the trained AE, and judges an abnormality using an output image.

In addition, the abnormality detection method of the first embodiment detects an abnormality by utilizing the fact that the generated time-series waveforms are different between normal and abnormal conditions. This anomaly detection method includes a conversion process, a correct image generation process, a learning process, and a judgment process. A conversion step converts the waveform to a spectrogram. In the correct image generating step, a correct image is generated by extracting a peak portion, which is a characteristic portion of the time component, from the normal waveform and performing a conversion step to convert it into a spectrogram. In the learning process, the transforming process is performed on the normal waveform, the transformed spectrogram is input to the AE, and the AE learns so that the output image is closer to the correct image. The judgment step executes a conversion step on the waveform to be evaluated, inputs the converted spectrogram to the learned AE, and judges an abnormality using an output image.

In the learning process of the anomaly detection device and anomaly detection method of the first embodiment, the normal waveform is converted by the conversion unit 30, the converted spectrogram is input to the AE, and the output image is closer to the correct image. to learn. Then, in the determination step, the waveform to be evaluated is transformed by the transformation unit 30, the transformed spectrogram is input to the learned AE, and an abnormality is determined using an output image. Therefore, the abnormality detection device and the abnormality detection method can appropriately detect an abnormality even if the ratio of abnormal data to normal data is overwhelmingly small. In addition, in this anomaly detection device and anomaly detection method, since the output image output from the trained AE is obtained by extracting the peak portion, which is the characteristic portion of the time component, the difference between the normal state and the abnormal state can be clearly seen. Therefore, it is possible to appropriately judge an abnormality.

The correct image generation unit 40 in the correct image generation process of the anomaly detection apparatus of the first embodiment extracts the point in time at which the peak portion of the waveform is located as the characteristic portion of the time component to generate the correct image. Therefore, this anomaly detection device is suitable for time-series waveforms in which peaks occur periodically.

The judging unit 60 in the judging process of the anomaly detection apparatus of the first embodiment judges an anomaly using the degree of similarity (PSNR, image matching rate) between the output image and the correct image as an index. Therefore, this anomaly detection device can reliably determine an anomaly by quantifying the degree of similarity.

The judging unit 60 in the judging process of the anomaly detection apparatus of the first embodiment judges an anomaly using the linearity of the output image (average number of straight lines and length) as an index. Therefore, this abnormality detection device can reliably determine an abnormality by quantifying the linearity.

The present invention is not limited to the first embodiment explained by the above description and drawings, and the following embodiments are also included in the technical scope of the present invention.
(1) In the first embodiment, an abnormality of the chain conveyor is detected from the waveform of the acceleration sensor attached to the rail near the drive motor of the chain conveyor. If so, it is possible to detect abnormalities not only in other factory equipment, but also in factory equipment.
(2) In the first embodiment, the peak portion, which is the characteristic portion of the time component of the waveform, is extracted, but characteristic portions other than the peak portion may be extracted. Also, the frequency component of the waveform may be extracted as the characteristic portion. Also, both the time component and the frequency component of the waveform may be extracted as the characteristic portion.
(3) Although AE is used as a deep learning method in the first embodiment, other deep learning methods such as VAE (Variational Auto Encoder) may be used.
(4) In the first embodiment, as shown in FIG. Abnormality may be determined based on similarity to normal data using feature expression data.
(5) Abnormality does not necessarily have to be found in the characteristic portion of the waveform to be extracted. This is because the correct image is obtained by extracting the peak information and contains only the peak information, but the output image output through the trained AE contains information other than the peak. This is because even if there is abnormal data only in the part that is not extracted (the part that is not extracted), the output image of the learned AE is an image in which the abnormal data is incorporated, and thus there is a difference from the correct image.
(6) AE learning uses only the normal waveforms, but a small amount of abnormal waveforms may also be used. In particular, detection accuracy is improved when not AE but VAE (Variational Auto Encoder) is used for the learning model.
(7) In the inference process, the waveform to be evaluated is evaluated in real time to determine abnormality, but a plurality of waveforms may be collectively evaluated and determined.
(8) Learning may use a computer on the cloud instead of using a computer terminal.
(9) The same computer may be used for the learning process and the inference process.

DESCRIPTION OF SYMBOLS 10... Sensor, 20... Computer, 30... Conversion part, 40... Correct image generation part, 50... AE (machine learning part), 60... Judgment part

Claims (5)

An anomaly detection device that detects an anomaly by utilizing the fact that time-series waveforms generated differ between normal and anomalous conditions,
a conversion unit that converts the waveform into a graphed multidimensional image having a time component and a frequency component;
a correct image generation unit that extracts at least one characteristic part of a time component or a frequency component from the normal waveform and generates a correct image converted into a multidimensional image by the conversion unit;
a machine learning unit that transforms the waveform in a normal state by the transforming unit, inputs the transformed multidimensional image, and learns so that an output image output is closer to the correct image;
a judgment unit that converts the waveform to be evaluated by the conversion unit, inputs the converted multidimensional image to the machine learning unit that has been trained, and judges an abnormality using an output image that is output;
An anomaly detection device comprising: 2. The anomaly detection apparatus according to claim 1, wherein the correct image generation unit extracts a time point at which a peak portion of the waveform is positioned as a characteristic portion of the time component to generate the correct image. 3. The anomaly detection device according to claim 1, wherein the judging unit judges an anomaly using a degree of similarity between the output image and the correct image as an index. 3. The abnormality detection device according to claim 1, wherein the judgment unit judges the abnormality using the linearity of the output image as an index. An anomaly detection method for detecting an anomaly by utilizing the fact that time-series waveforms generated are different between normal and anomalous conditions,
a transforming step of transforming the waveform into a graphed multi-dimensional image having time and frequency components;
A correct image generating step of extracting at least one characteristic portion of a time component or a frequency component from the normal waveform and performing the converting step to convert the waveform into a multidimensional image to generate a correct image;
Learning to perform the conversion step on the normal waveform, input the converted multidimensional image to the machine learning unit, and make the machine learning unit learn so that the output image approaches the correct image. process and
a judgment step of performing the conversion step on the waveform to be evaluated, inputting the converted multidimensional image to the machine learning unit that has been learned, and judging an abnormality using an output image that is output;
An anomaly detection method, comprising:

Images