JP7334457B2 - Anomaly detection system, anomaly detection device, anomaly detection method and program - Google Patents

Description

The present invention relates to an anomaly detection system, an anomaly detection device, an anomaly detection method, and a program for causing a computer to execute the method for detecting an anomaly from signals such as sound and vibration generated by mechanical equipment.

When an abnormality occurs in mechanical equipment, the abnormality may appear in the sound. In inspections of infrastructure and the like, confirmation of abnormal sounds may be an inspection item, and it is important to detect abnormal sounds and determine whether mechanical equipment is normal or abnormal.

As a conventional technique, a device and a program for detecting an abnormal sound based on running sound data of a railway vehicle for inspection of mechanical equipment such as a railway vehicle have been disclosed (see, for example, Patent Document 1). In the device disclosed in Patent Document 1, sound pressure data in frequency bands such as octave band output of running sound data is subjected to moving average processing in a predetermined smoothing time, and data in each frequency band is converted into a feature vector. treated as In the device of Patent Document 1, the feature vector of the running sound data to be evaluated as to whether it is normal or abnormal is obtained by a one-class support vector machine using the feature vector of the data of the frequency band of the running sound data in the normal state. It is described that the value of the evaluation is used to determine whether the condition is normal or abnormal.

JP 2014-232084 A

In the apparatus disclosed in Patent Document 1, sound pressure data in the frequency band of running sound data is used as a feature vector as sound data to be judged whether it is normal or abnormal. is determined by threshold processing. In the apparatus disclosed in Patent Document 1, when extracting feature vectors, the smoothing time is limited to a certain period of time, so the objects to be judged are limited, and even if there is an abnormality, there is a risk that it will be erroneously judged to be normal. There is

An anomaly detection system according to the present invention includes means for inputting time-series data from a sensor that receives a waveform emitted by an observation target , frequency analysis means for frequency-analyzing the time-series data, and time -series data based on the results of the frequency analysis. An estimating means for estimating the power spectrum of data , an instantaneous likelihood calculating means for calculating an instantaneous likelihood as an index of normality at a certain time based on the power spectrum, and a combined likelihood based on a plurality of instantaneous likelihoods at different times a joint likelihood calculation means for calculating the joint likelihood, a judgment means for judging whether the observed object is normal or abnormal based on the joint likelihood, and power an anomaly cause database for storing spectra; an anomaly estimation means for estimating an anomaly cause based on the anomaly cause database when the determination means determines that an observed object is abnormal; and an instantaneous likelihood calculation means . When the anomaly estimating means estimates the anomaly cause, the power spectrum of the time-series data corresponding to each anomaly cause stored in the anomaly cause database is used to calculate the anomaly time instant The likelihood is calculated, and the abnormality estimating means calculates the probability of each abnormality cause using the instantaneous likelihood at the time of abnormality calculated by the instantaneous likelihood calculating means, and the calculated probability of each abnormality cause and a predetermined threshold value The cause of the abnormality is estimated by determining whether or not the cause of the abnormality is applicable by comparing with .

An anomaly detection apparatus according to the present invention includes frequency analysis means for frequency-analyzing time-series data input from a sensor that receives a waveform emitted by an observation target , and estimates the power spectrum of the time-series data based on the results of the frequency analysis. An estimation means, an instantaneous likelihood calculation means for calculating an instantaneous likelihood that is an index of normality at a certain time based on the power spectrum, and a joint likelihood calculation for calculating a joint likelihood based on a plurality of instantaneous likelihoods at different times. means, determination means for determining whether an object to be observed is normal or abnormal based on the joint likelihood , and an abnormality cause database that stores power spectra of time-series data corresponding to abnormal causes recorded in the past. and abnormality estimation means for estimating the cause of abnormality based on the abnormality cause database when the determination means determines that the observation object is abnormal, and the instantaneous likelihood calculation means determines whether the abnormality estimation means is abnormal When estimating the cause, the power spectrum of the time-series data corresponding to each cause of anomaly stored in the anomaly cause database is used to calculate the instantaneous likelihood at the time of anomaly, which is an index of the data-likeness of each cause of anomaly. The estimating means calculates the probability of each cause of abnormality using the instantaneous likelihood at the time of abnormality calculated by the instantaneous likelihood calculating means, and compares the calculated probability of each cause of abnormality with a predetermined threshold to determine the cause of abnormality. The cause of the abnormality is estimated by determining whether or not it applies .

An anomaly detection method according to the present invention is an anomaly detection method for determining normality or anomaly using time-series data from a sensor that receives a waveform emitted by an observation object. Estimate the power spectrum of time-series data based on the analysis results, calculate the instantaneous likelihood , which is an index of normality at a given time, based on the power spectrum, and calculate the combined likelihood based on multiple instantaneous likelihoods at different times. Then, based on the joint likelihood, the observed object is judged to be normal or abnormal, and the power spectrum of the time-series data is stored in the anomaly cause database in correspondence with the anomaly causes of abnormalities recorded in the past. is determined to be abnormal, the cause of the abnormality is estimated based on the database of the causes of abnormality. is used to calculate the instantaneous likelihood at the time of anomaly, which is an index of the data-likeness of each cause of anomaly, and the calculated instantaneous likelihood at the time of anomaly is used to calculate the probability of each cause of anomaly. and a predetermined threshold value to determine whether or not the cause of the abnormality applies to the cause of the abnormality, thereby estimating the cause of the abnormality .

The program according to the present invention provides a computer that determines whether the time-series data from the sensor that receives the waveform emitted by the observation object is normal or abnormal, means for frequency analysis of the time-series data, and the result of the frequency analysis. means for estimating the power spectrum of time-series data based on the power spectrum, means for calculating the instantaneous likelihood , which is an index of normality at a certain time based on the power spectrum, and calculating the combined likelihood based on multiple instantaneous likelihoods at different times. means for determining whether an object to be observed is normal or abnormal based on the joint likelihood; and storing the power spectrum of time-series data corresponding to the cause of anomalies recorded in the past in an anomaly cause database. means for estimating the cause of anomalies based on an anomaly cause database when an observed object is determined to be anomalous; Using the power spectrum of the corresponding time-series data, a means to calculate the instantaneous likelihood at the time of anomaly, which is an index of the data-likeness of each anomaly cause, and the accuracy of each anomaly cause using the calculated instantaneous likelihood at the time of anomaly. A means for calculating and a means for estimating the cause of abnormality by determining whether or not the cause of abnormality is applicable by comparing the calculated accuracy of each cause of abnormality with a predetermined threshold value.

According to the present invention, after frequency analysis of time-series data, a power spectrum is estimated based on the frequency analysis result without limiting the analysis target, an instantaneous likelihood is calculated from the estimated power spectrum, and a plurality of instantaneous likelihoods are calculated. It is determined whether or not the signal to be observed is abnormal based on the joint likelihood obtained from the degree. Therefore, it is possible to suppress an erroneous determination that the observed object is normal even if there is an abnormality.

1 is a block diagram showing a configuration example of an anomaly detection system according to Embodiment 1; FIG. 2 is a block diagram showing an example of a hardware configuration of a signal processing unit shown in FIG. 1; FIG. 4 is a flowchart showing procedures of an anomaly detection method executed by the anomaly detection system of Embodiment 1; FIG. 4 is a graph showing an example of instantaneous likelihood calculated in step S104 shown in FIG. 3. FIG. FIG. 11 is a block diagram showing a configuration example of an anomaly detection system according to a second embodiment; FIG. 9 is a flowchart showing procedures of an anomaly detection method executed by an anomaly detection system according to Embodiment 2; FIG. 7 is a graph showing an example of instantaneous likelihood calculated in step S204 shown in FIG. 6. FIG. FIG. 11 is a block diagram showing a configuration example of an anomaly detection system according to a third embodiment; FIG. FIG. 9 is a table showing a configuration example of an abnormality cause DB stored in the storage unit shown in FIG. 8; FIG. FIG. 9 is a block diagram showing one configuration example of a DB generation device that generates an abnormality cause DB stored in the storage unit shown in FIG. 8; 10 is a flow chart showing the procedure of an anomaly detection method executed by an anomaly detection system according to Embodiment 3;

In this embodiment, an abnormality detection system, an abnormality detection device, an abnormality detection method, and a program quantitatively determine whether the mechanical equipment is normal or abnormal based on the sound emitted from the mechanical equipment.

Embodiment 1.
The configuration of the anomaly detection system according to the first embodiment will be described.
FIG. 1 is a block diagram showing a configuration example of an anomaly detection system according to Embodiment 1. FIG. The anomaly detection system 1 has input means 20 and a signal processing section 10 . The input means 20 has a microphone 21 and a recording device 22 . The signal processing unit 10 has frequency analysis means 11 , estimation means 12 , instantaneous likelihood calculation means 13 , joint likelihood calculation means 14 and determination means 15 .

The microphone 21 receives radiation sound from the object to be observed, converts an acoustic signal of the received radiation sound into an electrical signal, and outputs the electrical signal to the recording device 22 . Although the signal received by the microphone 21 is sound in the first embodiment, the received signal is not limited to sound and may be vibration. Further, the sensor that acquires signal information such as sound and vibration emitted by the observation object is not limited to the microphone 21 .

The recording device 22 has an electronic circuit (not shown) such as an amplifier and a filter, and an A/D (Analog to Digital) converter (not shown). The recording device 22 receives the electrical signal output from the microphone 21, generates acoustic data by digitizing the electrical signal, and outputs the acoustic data to the signal processing unit 10 as time-series data.

The frequency analysis means 11 Fourier-transforms the time-series data and performs frequency analysis. Fourier transform is, for example, Fast Fourier Transform (FFT). The frequency analysis means 11 performs frequency analysis on the input acoustic data (time waveform). The frequency analysis means 11 outputs frequency domain data (complex numbers) of acoustic data.

The estimation means 12 performs time integration processing and normalization processing. In the time integration process, the estimation means 12 receives the frequency domain data (complex number), squares the absolute value of the frequency domain data (complex number), and converts the result of the square of the absolute value of each frequency into the time direction Integrate to . The estimating means 12 outputs time integration data, which is the result of time integration, by the time integration process. In the normalization process, the estimation means 12 receives the time integral data and converts the time integral data into normalized data using a certain average value and standard deviation. The estimation means 12 outputs normalized data as a result of the normalization process. Normalized data corresponds to a power spectrum indicating frequency distribution.

The instantaneous likelihood calculation means 13 calculates an instantaneous likelihood, which is an index of normality, from the size of the normalized data, and outputs the instantaneous likelihood. The joint likelihood calculation means 14 receives an instantaneous likelihood at a certain time, combines it with an instantaneous likelihood acquired at a time before the certain time, calculates a joint likelihood from a plurality of instantaneous likelihoods, and calculates the joint likelihood Print degrees.

The determination means 15 performs threshold processing. The determination means 15 determines whether or not the radiation sound of the object to be observed is normal or abnormal by determining whether or not the combined likelihood exceeds a certain value with the combined likelihood as input in the threshold processing. to judge whether The judgment means 15 outputs the judgment result of the threshold processing.

An example of the hardware configuration of the signal processing unit 10 shown in FIG. 1 will be described. 2 is a block diagram showing an example of a hardware configuration of a signal processing unit shown in FIG. 1. FIG. The signal processing unit 10 has a memory 31 that stores programs, and a CPU (Central Processing Unit) 32 that executes processes according to the programs stored in the memory 31 . The memory 31 is, for example, a non-volatile memory such as flash memory.

In the first embodiment, a case where the hardware of the signal processing unit 10 is composed of the CPU 32 and the memory 31 will be described, but the present invention is not limited to this case. The signal processing unit 10 may be provided with a dedicated circuit such as an ASIC (Application Specific Integrated Circuit) that executes some or all of the functions included in the signal processing unit 10 shown in FIG.

Next, the operating procedure of the abnormality detection system 1 shown in FIG. 1 will be described. FIG. 3 is a flow chart showing the procedure of an anomaly detection method executed by the anomaly detection system according to the first embodiment.

Let x(t) represent the radiated sound of the observed object as a function of time. t is a character representing time. A radiated sound x(t) is received by the microphone 21 and its output is y(t). The recording device 22 receives the microphone output y(t) and outputs a digitized output y[n]. n is the discretized time.

In the FFT processing of step S101, the frequency analysis means 11 applies fast Fourier transform to the digitized y[n] to calculate frequency domain data Y[k]. k is the frequency index.

In the time integration process of step S102, the estimation means 12 performs two processes, an amplitude square process and an integration process, on the frequency domain data Y[k]. Here, an index in the time direction is also added to the frequency domain data, and the frequency domain data is expressed as Ym[k]. m is a time index given to the frequency domain data.

The estimating means 12 calculates the squared amplitude value Am[k] based on the equation (1) in the squared amplitude process in the time integration process.

In the integration process within the time integration process, the estimating means 12 receives the amplitude square value Am[k] as an input and calculates the time integration process output IAm[k] shown in Equation (2). In equation (2), M is the number of amplitude squared values used in the integration process.

In the normalization process of step S103, the estimating means 12 inputs the time integration process output IAm[k], and also uses the mean value mean[k] and the standard deviation std[k] to obtain the formula (3). Transform the indicated time integration processing output IAm[k] to calculate the normalized output NAm[k].

In Equation (3), the mean value mean[k] and the standard deviation std[k] are values estimated from the output of time integration processing for normal radiation sound from the same observation object recorded in the past. The estimation means 12 calculates the mean value mean[k] and the standard deviation std[k] using equations (4) and (5).

In Equation (5), Q is the number of time-integrated outputs for normal radiation sound from the same observation object recorded in the past. By applying this normalization process, the magnitude of the time-integrated output of the radiation sound when the object to be observed is normal has an average of 0 and a standard deviation of 1 for each frequency.

In the instantaneous likelihood calculation process of step S104, the instantaneous likelihood calculation means 13 receives the normalized output NAm[k] as an input, and according to Equation (6), an index of the likelihood that the normalized output belongs to normal data. Compute some instantaneous likelihood Lm[k]. The instantaneous likelihood calculation means 13 outputs the instantaneous likelihood after calculating the instantaneous likelihood using the equation (6).

In the joint likelihood calculation process of step S105, the joint likelihood calculation means 14 uses the past (J−1) instantaneous likelihoods as inputs in addition to the instantaneous likelihood Lm[k], and uses equation (7). to calculate the joint likelihood ILm[k]. The joint likelihood calculator 14 outputs the joint likelihood after calculating the joint likelihood using the equation (7).

In the threshold processing in step S106, the judging means 15 receives the joint likelihood ILm[k] as an input and determines whether the radiation sound of the observation object is normal or abnormal according to the judgment criteria shown in the following equation (8). to determine whether

In the judgment criteria shown in Equation (8), δ[k] is a threshold value that determines whether joint likelihood is obtained from normal data or from abnormal data. The determination means 15 can determine whether the observed radiated sound of the object to be observed is normal or abnormal for each frequency by using the determination criteria shown in Equation (8).

Effects of the first embodiment will be described. Anomaly detection system 1 of Embodiment 1 includes input means 20 for inputting time-series data from sensors, frequency analysis means 11, estimation means 12, instantaneous likelihood calculation means 13, and combined likelihood calculation means 14 and determination means 15 . The frequency analysis means 11 frequency-analyzes time-series data. Estimating means 12 estimates the power spectrum based on the result of the frequency analysis. An instantaneous likelihood calculation means 13 calculates an instantaneous likelihood based on the power spectrum. A joint likelihood calculator 14 calculates a joint likelihood based on a plurality of instantaneous likelihoods. The determination means 15 determines normality or abnormality based on the joint likelihood.

According to the first embodiment, after frequency analysis of time-series data, the power spectrum is estimated based on the frequency analysis result without limiting the analysis target, the instantaneous likelihood is calculated from the estimated power spectrum, and a plurality of It is determined whether or not the signal to be observed is abnormal based on the combined likelihood obtained from the instantaneous likelihood of . Therefore, it is possible to suppress an erroneous determination that the observed object is normal even if there is an abnormality.

In the first embodiment, for example, the normalized output is obtained by using the average value and standard deviation of the time-integrated output for each frequency obtained from the normal sound data recorded in the past. By using the instantaneous likelihood using this normalized output, it is possible to quantify the degree of divergence from the normal state for each frequency of the radiation sound from the observation object.

FIG. 4 is a graph showing an example of instantaneous likelihood calculated in step S104 shown in FIG. The horizontal axis of FIG. 4 is the normalized output, and the vertical axis is the instantaneous likelihood. The instantaneous likelihood shown in FIG. 4 is an example of the instantaneous likelihood Lm ₀ [k ₀ ] for a certain time m0 and a certain frequency k0. With the normalized output NAm ₀ [k ₀ ] as input, the instantaneous likelihood is calculated using equation (6). As shown in the example of FIG. 4, the more the normalized output deviates from the average value, that is, the more the value on the horizontal axis deviates from 0, the smaller the instantaneous likelihood.

In Embodiment 1, the joint likelihood calculation means 14 multiplies one or more instantaneous likelihood values in the time direction to obtain joint likelihoods. The determining means 15 applies threshold processing using Equation (8) to the acquired combined likelihood to determine whether it is normal or abnormal. By using the joint likelihood, it is possible to finally determine that there is an abnormality only when the determining means 15 can continuously determine that there is an abnormality for a certain period of time. With this mechanism, it is possible to reduce the influence of false alarms due to accidental determination of abnormalities.

Embodiment 2.
The anomaly detection system according to the second embodiment determines normality or anomaly based on data of observation objects observed in the past when the object was normal. In the second embodiment, the same reference numerals are assigned to the same configurations as those described in the first embodiment, and detailed description thereof will be omitted.

The configuration of the anomaly detection system according to the second embodiment will be described.
FIG. 5 is a block diagram showing a configuration example of an anomaly detection system according to the second embodiment. The anomaly detection system 1a has an input means 20 and a signal processing section 10a. The signal processing unit 10 a has frequency analysis means 11 , estimation means 12 a , instantaneous likelihood calculation means 13 a , joint likelihood calculation means 14 and determination means 15 .

The estimation means 12a performs time integration processing and second normalization processing. In the time integration process, the estimation means 12 receives the frequency domain data (complex number), squares the absolute value of the frequency domain data (complex number), and converts the result of the square of the absolute value of each frequency into the time direction , and obtain time integral data. In the second normalization process, the estimating means 12a receives the time-integrated data for the radiation sound from the same observation object recorded in the past under normal conditions, and uses a certain average value and standard deviation to obtain the time-integrated data. Convert to normalized data. The estimation means 12a outputs normalized data as a result of the second normalization process.

The instantaneous likelihood calculation means 13a holds the distribution shape of the output of the time integration process in the normal state for each frequency based on the data recorded in the past. The instantaneous likelihood calculation means 13a calculates an instantaneous likelihood, which is an index of normality, from the size of the normalized data, and outputs the instantaneous likelihood. The data recorded in the past and the distribution shape for each frequency of the output of the time integration processing in the normal state are stored in the memory 31 .

The hardware configuration of the signal processing unit 10a of the second embodiment is the same as the configuration of the signal processing unit 10 described in the first embodiment, so detailed description thereof will be omitted. The functions provided by the signal processing unit 10a may be executed by the CPU 32 shown in FIG. 2, and a circuit that executes some or all of the functions provided by the signal processing unit 10a is configured by a dedicated circuit such as an ASIC. may

Next, the operating procedure of the abnormality detection system 1a shown in FIG. 5 will be described. FIG. 6 is a flow chart showing procedures of an anomaly detection method executed by an anomaly detection system according to the second embodiment.

In the second embodiment, as in the first embodiment, the radiated sound of the object to be observed is represented by x(t) as a function of time. A radiated sound x(t) is received by the microphone 21 and its output is y(t). The recording device 22 receives the microphone output y(t) and outputs a digitized output y[n]. Here, t is a character representing time and n is the discretized time.

Since each of steps S201, S202, S205 and S206 shown in FIG. 6 is the same processing as each of steps S101, S102, S105 and S106 described with reference to FIG. detailed description is omitted.

The second normalization process in step S203 shown in FIG. 6 differs from the normalization process in step S103 described with reference to FIG. 3 in the method of calculating the average value and standard deviation. Therefore, the normalized output of the second normalization process also differs from the normalization process of step S103 shown in FIG.

In the second normalization process of step S203, the estimating means 12a uses the time-integrated output of the radiation sound from the same observation object recorded in the past under normal conditions to obtain the probability density function p( IAm[k]) is obtained. p(IAm[k]) is the number of data whose magnitude is within the range of IAm[k]-(1/2)dx to IAm[k]+(1/2)dx. It is the value divided by Q. Here, dx is a parameter set when calculating the probability density distribution.

The estimation means 12a calculates the mean value mean ₂ [k] and the standard deviation std ₂ [k] using the probability density function p(IAm[k]) and equations (9) and (10).

In the second normalization process in step S203, the estimating means 12a receives the time integration process output IAm[k] as an input, uses the mean value mean ₂ [k] and the standard deviation std ₂ [k], and calculates the formula (11) , convert the time integration processing output IAm[k] to calculate the normalized output NA2m[k].

The estimation means 12a also normalizes the probability density function p(IAm[k]) using the mean value mean ₂ [k] and the standard deviation std ₂ [k], and converts the normalized probability density function p ₂ (NA2m[k]).

In the second instantaneous likelihood calculation process of step S204, the instantaneous likelihood calculation means 13a uses the normalized output NA2m[k] and the normalized probability density function P ₂ (NA2m[k]) to calculate the instantaneous likelihood Obtain L2m[k]. The instantaneous likelihood calculation means 13a calculates, for example, the instantaneous likelihood L2m ₀ [k] for a given time m ₀ using Equation (12). The instantaneous likelihood calculation means 13a outputs the instantaneous likelihood L2m ₀ [k] calculated by Equation (12).

Effects of the second embodiment will be described. In the normalization process and the instantaneous likelihood calculation process of the first embodiment, the average value and the standard deviation of the normal time integration process output are estimated on the assumption that the normal time integration process output has a normal distribution, and these values are used. calculated the normalized output, and also calculated the instantaneous likelihood. However, the distribution of the output of time integration processing during normal operation is not necessarily a normal distribution. In this case, in the first embodiment, it may not be possible to appropriately determine normality or abnormality using the time integration processing output.
Therefore, in the second embodiment, the probability density distribution of the value is estimated using the output of the time integration process based on the normal data observed in the past, and the average value and the standard deviation are calculated based on the distribution. By computing , we can better estimate the normalized output and the instantaneous likelihood.

FIG. 7 is a graph showing an example of instantaneous likelihood calculated in step S204 shown in FIG. The horizontal axis of FIG. 7 is the normalized output, and the vertical axis is the instantaneous likelihood. FIG. 7 shows an image of performing the second instantaneous likelihood process using the output of the second normalization process and the normalized probability density function. As shown in FIG. 7, the instantaneous likelihood calculated based on the data observed in the past under normal conditions has a peak in the normalized output with a value different from the averaged normalized output shown in FIG. be seen.

Embodiment 3.
The anomaly detection system of the third embodiment estimates the cause of an anomaly when an observed object is determined to be an anomaly. In the third embodiment, the same reference numerals are assigned to the same configurations as those described in the first and second embodiments, and detailed description thereof will be omitted.

The configuration of the anomaly detection system according to the third embodiment will be described. FIG. 8 is a block diagram showing a configuration example of an anomaly detection system according to the third embodiment. The anomaly detection system 1 b has input means 20 , a signal processing section 10 b and a storage section 25 . The storage unit 25 is, for example, an HDD (Hard Disk Drive) device. The storage unit 25 has an abnormality cause database (DB) that stores data related to radiation sound of an observation object corresponding to an abnormality cause of an abnormality observed in the past. The signal processing unit 10b includes frequency analysis means 11, estimation means 12a, instantaneous likelihood calculation means 13a, joint likelihood calculation means 14, determination means 15, anomaly estimation means 12b, and anomaly accuracy calculation means 16. , and accuracy comparison means 17 .

9 is a table showing a configuration example of an abnormality cause DB stored in the storage unit shown in FIG. 8. FIG. As shown in FIG. 9, the abnormality cause DB stores average values and standard deviation values of data corresponding to each abnormality cause.

The abnormality estimating means 12b performs the third normalization process when the determination means 15 determines that the threshold value is abnormal. In the third normalization process, the abnormality estimating means 12b refers to the time integral data acquired from the estimating means 12a and the data stored in the abnormal sound cause DB. The anomaly estimating means 12b receives the average value and standard deviation for each anomaly cause and converts them into normalized data. The abnormality estimator 12b outputs the result of the third normalization process as normalized data.

The instantaneous likelihood calculation means 13a calculates the instantaneous likelihood, which is an index of data-likeness due to each abnormality cause, from the size of the normalized data, and outputs the instantaneous likelihood. The abnormality accuracy calculation means 16 calculates the accuracy of each abnormality cause and outputs the accuracy for each abnormality cause. Accuracy comparison means 17 compares the accuracy of each abnormality cause and outputs an abnormality cause estimation result.

Here, an example of a DB generation device that generates an abnormality cause DB will be described. FIG. 10 is a block diagram showing one configuration example of a DB generation device that generates an abnormality cause DB stored in the storage unit shown in FIG. The DB generation device 2 has an input means 20, a storage section 25, and a signal processing section 10c. The signal processing unit 10 c has frequency analysis means 11 , time integration processing means 18 and data recording means 19 . The hardware of the signal processing unit 10c is, for example, a microcomputer.

When the microphone 21 receives radiation sound from an observation object in an abnormal state due to a certain cause, the microphone 21 converts an acoustic signal of the received radiation sound into an electric signal and outputs the electric signal to the recording device 22 . The recording device 22 digitizes the electrical signal output from the microphone 21 to generate acoustic data, and outputs the abnormal state acoustic data to the frequency analysis means 11 as time-series data.

The time integration processing means 18 receives the frequency domain data (complex number) received from the frequency analysis means 11, squares the absolute value of the frequency domain data (complex number), and squares the absolute value of each frequency. Integrate in the time direction. From the time integration process, time integration data, which is the result of this time integration, is output. Data recording means 19 calculates the average value and standard deviation of the time integral data. The data recording means 19 saves the average value and standard deviation of the time integral data in the storage unit 25 in association with each cause of abnormality to generate an abnormality cause database.

Here, in order to explain the device for generating the abnormality cause DB, the DB generation device 2 shown in FIG. 10 was referred to separately from the abnormality detection system 1b shown in FIG. may be included in the anomaly detection system 1b shown in FIG. For example, the estimating means 12a of the signal processing section 10b may have the function of time integration processing executed by the time integration processing means 18, and the signal processing section 10b may have the data recording means 19. FIG.

The hardware configuration of the signal processing unit 10b of the third embodiment is the same as the configuration of the signal processing unit 10 described in the first embodiment, so detailed description thereof will be omitted. The functions provided by the signal processing unit 10b may be executed by the CPU 32 shown in FIG. 2, and a circuit that executes some or all of the functions provided by the signal processing unit 10b is configured by a dedicated circuit such as an ASIC. may

In the third embodiment, the abnormality cause DB stores the average value and standard deviation of the time integral data at the time of abnormality corresponding to the cause of abnormality. It is not limited to mean and standard deviation. For example, one or both of the time-series data and the power spectrum at the time of anomaly may be stored in the anomaly cause DB in correspondence with the cause of the anomaly. Further, although the estimation means 12a and the abnormality estimation means 12b have been described separately, the estimation means 12a may have the function of the abnormality estimation means 12b. Further, the abnormality estimating means 12b may have the functions of the abnormality probability calculating means 16 and the accuracy comparing means 17. FIG.

Next, the operating procedure of the abnormality detection system 1b shown in FIG. 8 will be described. FIG. 11 is a flow chart showing a procedure of an anomaly detection method executed by an anomaly detection system according to the third embodiment. Steps S301 to S306 shown in FIG. 11 are the same processing as steps S201 to S206 shown in FIG. 6 in the second embodiment, so detailed description thereof will be omitted here.

As a result of the determination of the threshold processing in step S306, when it is determined that there is an abnormality, the abnormality estimating means 12b executes the third normalization processing in step S307. The third normalization process differs from the second normalization process in the mean value and standard deviation used for normalization. In the third normalization process, the abnormality estimating means 12b uses the average value and standard deviation corresponding to each abnormality cause stored in the abnormality cause DB to obtain the time integral data as shown in Equation (13). Normalize.

In the expression (13), the superscript cased indicates the id number given to each abnormality cause. The mean value mean ^cased [k] and the standard deviation std ^cased [k] are values estimated from the time integration processing output for the sound radiated when the same observation object is in an abnormal state due to a certain abnormality cause d, It is stored in the abnormality cause DB.

In the third instantaneous likelihood calculation process of step S308, the instantaneous likelihood calculation means 13a uses the normalized output NA3m ^cased [k] and the normalized probability density function p ₂ (NA3m ^cased [k]) to calculate each An instantaneous likelihood L3m ^cased [k] for the cause of abnormality d is obtained using Equation (14). The instantaneous likelihood calculated by Equation (14) is hereinafter referred to as the instantaneous likelihood during anomaly.

In the abnormality probability calculation process of step S309, the abnormality probability calculation means 16 uses the instantaneous likelihood L3m ^cased [k] at the time of abnormality for each abnormality cause d, and uses Equation (15) to calculate the abnormality probability CFm ^cased . .

In Equation (15), w ^cased [k] is a weight for giving the degree of contribution that the instantaneous likelihood gives to the probability for each frequency. The abnormality probability calculating means 16 calculates the weight w ^cased [k] using the equation (16). In equation (16), l is an arbitrary coefficient.

In the accuracy comparison process in step S310, the accuracy comparison unit 17 selects the abnormality cause with the highest accuracy as shown in Equation (17), and outputs it as the abnormality cause estimation result resultm.

In Equation (17), _δCF is a threshold for determining whether or not the cause of abnormality contained in the cause of abnormality DB is applicable. resultm=0 indicates that none of the multiple causes of abnormality stored in the cause of abnormality DB apply.

Effects of the third embodiment will be described. In the abnormal component detection processes of Embodiments 1 and 2, it was possible to identify abnormal frequencies. However, in both the first and second embodiments, presuming the cause of abnormality was insufficient.
Therefore, in the third embodiment, the output of the time integration process based on the data at the time of abnormality due to each abnormality cause observed in the past is used to estimate the probability density distribution of the value, and based on the distribution By calculating the mean and standard deviation, the cause of the anomaly can be estimated.

In the third embodiment, in order to identify the abnormal frequency component and the cause of the abnormality, it is quantitatively calculated to what degree the sound intensity of each frequency component is likely to be normal or abnormal. ing. Therefore, when an abnormal sound is detected, it is possible to determine not only whether it is normal or abnormal, but also which frequency component or frequency band is abnormal and what is the cause of the abnormality. It is possible to specify whether

It should be noted that two or more of the first to third embodiments described above may be combined. In addition, although the normal distribution is assumed in the first embodiment, other distribution shapes, such as chi-square distribution, may be assumed depending on the application field. In such a case, the assumed distribution shape may be changed.

Although unweighted moving average processing has been described in the time integration processing of the first to third embodiments, generally used time integration processing such as weighted moving average processing or exponential integration may be used. Although FFT is used for frequency analysis in the first to third embodiments, other frequency analysis processing such as wavelet transform or octave analysis processing may be applied.

Further, in Embodiment 3, the abnormality probability calculation process is shown as a total product of frequencies, but the frequencies may be integrated by other calculation methods such as harmonic averaging. In the third embodiment, it was explained that only the one with the highest accuracy in the accuracy comparison process is selected as the output of the abnormality cause estimation process.

In addition, in Embodiments 1 and 2, the case of determining whether acoustic data is normal or abnormal has been described. , any of the techniques of the first to third embodiments can be applied.

In Embodiments 1 to 3, the case of the anomaly detection system has been described, but the anomaly detection device connected to the input means 20 uses the time-series data input from the sensor to execute the above-described anomaly detection method. may The abnormality detection device in this case may be an information processing device such as a computer.

Reference Signs List 1, 1a, 1b anomaly detection system 2 DB generation device 10, 10a to 10c signal processing unit 11 frequency analysis means 12, 12a estimating means 12b anomaly estimating means 13, 13a instantaneous likelihood calculating means 14 combined likelihood calculating means 15 judging means 16 Abnormal accuracy calculation means 17 Accuracy comparison means 18 Time integration processing means 19 Data recording means 20 Input means 21 Microphone 22 Recording device 25 Storage unit 31 Memory 32 CPU

Claims (7)

means for inputting time-series data from a sensor that receives waveforms emitted by an observed object ;
frequency analysis means for frequency-analyzing the time-series data;
Estimation means for estimating a power spectrum of the time-series data based on the frequency analysis result;
Instantaneous likelihood calculation means for calculating an instantaneous likelihood , which is an index of normality at a certain time based on the power spectrum;
joint likelihood calculation means for calculating a joint likelihood based on the plurality of instantaneous likelihoods at different times ;
determination means for determining whether the observation object is normal or abnormal based on the joint likelihood;
an anomaly cause database that stores power spectra of time-series data corresponding to anomaly causes recorded in the past;
abnormality estimation means for estimating the cause of abnormality based on the abnormality cause database when the determination means determines that the object to be observed is abnormal;
has
When the anomaly estimating means estimates the anomaly cause, the instantaneous likelihood calculation means uses the power spectrum of the time-series data corresponding to each anomaly cause stored in the anomaly cause database to calculate the Calculate the instantaneous likelihood at anomaly, which is an index of data-likeness,
The abnormality estimating means calculates the probability of each abnormality cause using the instantaneous likelihood at the time of abnormality calculated by the instantaneous likelihood calculating means, and compares the calculated probability of each abnormality cause with a predetermined threshold. Estimate the cause of the abnormality by determining whether it applies to the cause of the abnormality by
Anomaly detection system. The estimating means obtains a probability density function of the magnitude of the power spectrum in a normal state from time-series data in a normal state recorded in the past,
2. The anomaly detection system according to claim 1, wherein said instantaneous likelihood calculating means calculates said instantaneous likelihood using said probability density function obtained by said estimating means. further comprising data recording means for recording the time-series data at the time of the abnormality in the abnormality cause database;
The estimation means estimates a power spectrum of time-series data corresponding to each cause of abnormality,
3. The anomaly detection system according to claim 1, wherein said data recording means saves said power spectrum information for each of said anomaly causes to generate said anomaly cause database. The abnormality estimating means obtains a probability density function of the magnitude of the power spectrum corresponding to each abnormality cause from the time-series data corresponding to the abnormality causes recorded in the past,
4. The anomaly detection system according to claim 1 , wherein said instantaneous likelihood calculating means calculates said instantaneous likelihood during an anomaly using said probability density function obtained by said anomaly estimating means. frequency analysis means for frequency-analyzing time-series data input from a sensor that receives a waveform emitted by an observation object ;
Estimation means for estimating a power spectrum of the time-series data based on the frequency analysis result;
Instantaneous likelihood calculation means for calculating an instantaneous likelihood , which is an index of normality at a certain time based on the power spectrum;
joint likelihood calculation means for calculating a joint likelihood based on the plurality of instantaneous likelihoods at different times ;
determination means for determining whether the observation object is normal or abnormal based on the joint likelihood;
an anomaly cause database that stores power spectra of time-series data corresponding to anomaly causes recorded in the past;
abnormality estimation means for estimating the cause of abnormality based on the abnormality cause database when the determination means determines that the object to be observed is abnormal;
has
When the anomaly estimating means estimates the anomaly cause, the instantaneous likelihood calculation means uses the power spectrum of the time-series data corresponding to each anomaly cause stored in the anomaly cause database to calculate the Calculate the instantaneous likelihood at anomaly, which is an index of data-likeness,
The abnormality estimating means calculates the probability of each abnormality cause using the instantaneous likelihood at the time of abnormality calculated by the instantaneous likelihood calculating means, and compares the calculated probability of each abnormality cause with a predetermined threshold. Estimate the cause of the abnormality by determining whether it applies to the cause of the abnormality by
Anomaly detection device. An abnormality detection method for determining normality or abnormality using time-series data from a sensor that receives a waveform emitted by an observation object ,
Frequency analysis of the time series data,
estimating the power spectrum of the time-series data based on the results of the frequency analysis;
Calculate an instantaneous likelihood , which is an index of normality at a certain time based on the power spectrum,
calculating a joint likelihood based on a plurality of said instantaneous likelihoods at different times ;
determining whether the observed object is normal or abnormal based on the combined likelihood ;
Store the power spectrum of the time-series data in the anomaly cause database corresponding to the anomaly cause of the anomaly recorded in the past,
when the observed object is determined to be abnormal, estimating the cause of the abnormality based on the abnormality cause database;
When estimating the cause of anomaly, the power spectrum of the time-series data corresponding to each cause of anomaly stored in the cause of anomaly database is used to calculate the instantaneous likelihood at the time of anomaly, which is an index of the likelihood of data due to each cause of anomaly. death,
calculating the probability of each abnormality cause using the calculated instantaneous likelihood at the time of abnormality;
Estimate the cause of abnormality by determining whether or not it applies to the cause of abnormality by comparing the calculated accuracy of each cause of abnormality with a predetermined threshold value.
Anomaly detection method. A computer that determines whether it is normal or abnormal using time-series data from a sensor that receives the waveform emitted by the observation object ,
means for frequency analysis of the time-series data;
means for estimating a power spectrum of the time-series data based on the results of the frequency analysis;
means for calculating an instantaneous likelihood , which is an index of normality at a certain time based on the power spectrum;
means for calculating a joint likelihood based on a plurality of said instantaneous likelihoods at different times ;
means for determining whether the observation object is normal or abnormal based on the combined likelihood ;
Means for storing the power spectrum of the time-series data in the anomaly cause database corresponding to the anomaly cause of an anomaly recorded in the past;
means for estimating an abnormality cause based on the abnormality cause database when the observation object is determined to be abnormal;
When estimating the cause of anomaly, the power spectrum of the time-series data corresponding to each cause of anomaly stored in the cause of anomaly database is used to calculate the instantaneous likelihood at the time of anomaly, which is an index of the likelihood of data due to each cause of anomaly. means to
means for calculating the probability of each cause of abnormality using the calculated instantaneous likelihood at the time of abnormality;
A program for executing a means for estimating an abnormality cause by comparing the calculated probability of each abnormality cause with a predetermined threshold to determine whether or not the cause is applicable.

Images