JP7408911B2 - Anomaly detection device and anomaly detection method - Google Patents

Description

The present invention relates to an abnormality detection device and an abnormality detection method.

In recent years, it has become easier to collect sensor data due to the development of sensing devices (hereinafter also simply referred to as "sensors") and the decline in communication costs, and the collected sensor data can be used to improve equipment and machinery. There is a growing need to detect abnormalities. Principal Component Analysis (PCA) is widely used as one of the techniques for detecting abnormalities from multiple data. Since PCA is a statistical method of unsupervised learning, it does not require abnormal data that may be difficult to obtain in actual operation, and by calculating the Q statistic and T ² statistic that represent the deviation from the normal model. This has the advantage that the cause of the abnormality can be explained.

For example, in Patent Document 1, as a technology for detecting abnormalities in rotating machinery, normal vibration information is processed, a normal model is constructed using PCA, and when new vibration information is given, evaluation is performed using the normal model. Calculating statistics is disclosed.

Patent No. 4312477

Here, when a continuous process such as a plant is targeted for abnormality detection, appropriate abnormality detection may not be possible because the continuous process has characteristic fluctuations.

For example, as shown in FIG. 1(a), when there is a characteristic variation in which the sensor value periodically varies depending on the season or other period (this is also referred to as "periodic variation"). When data from periods such as different seasons is used as training data, the statistics (Q statistics and ^T2 statistics) may be lower than during training even if the data for the period to be detected for abnormality is normal data. It may become high and may be falsely detected as an abnormality. Specifically, as shown in Figure 1(a), if a normal model is constructed using the sensor values of period 1 as learning data, the statistics will be lower than during learning even if the sensor values of period 2 are normal data. It may become high and may be falsely detected as an abnormality.

Furthermore, as shown in FIG. 1(b), there are characteristic fluctuations (this is also referred to as "discontinuous fluctuations") such as discontinuous fluctuations in sensor values due to parts replacement during equipment inspection, etc. In some cases, if data before equipment inspection is used as learning data, even if the data after equipment inspection is normal data, the statistical value will be higher than during learning, and it may be falsely detected as abnormal. Specifically, as shown in Figure 1(b), if a normal model is constructed using the sensor values before equipment inspection as learning data, the statistics will be lower than during learning even if the sensor values after equipment inspection are normal data. The amount may become high and may be falsely detected as an abnormality.

Furthermore, as shown in FIG. 1(c), if there are characteristic fluctuations (also referred to as "long-term fluctuations") such as fluctuations in sensor values due to the influence of aging, etc., If data before deterioration over time is used as learning data, even if the data after deterioration over time is normal data, the statistical amount will be higher than during learning, and it may be falsely detected as abnormal. Specifically, as shown in Figure 1(c), when a normal model is constructed using sensor values before aging as learning data, even if the sensor values after aging are normal data, the statistics are lower than during learning. The amount may become high and may be falsely detected as an abnormality.

Furthermore, in large-scale continuous processes that use tens to hundreds of sensors, appropriate abnormality detection may not be possible because a linear relationship cannot be maintained depending on the combination of sensors. For example, in a large-scale continuous process, there is a linear relationship between the sensor value of sensor 1 and the sensor value of sensor 2, as shown in FIG. A situation may occur where there is no linear relationship between the values. For this reason, the linear relationship between sensors cannot be maintained, and when PCA is applied using all sensor values of a continuous process, the values of Q statistics and ^T2 statistics become unstable and false positives occur. This may occur. Note that, hereinafter, maintaining a linear relationship will also be referred to as "maintaining a linear relationship."

In order to deal with the above characteristic fluctuations and maintenance of linear relationships, for example, operators of plants, etc. may perform data analysis and update the normal model by taking into account the characteristic fluctuations and maintenance of linear relationships, or they can update the normal model in advance by Operators sometimes divided processes based on location. For example, as shown in FIG. 3, as process division, a continuous process has been divided by treating sensors that have a linear relationship with each other as one process. However, when an operator performs data analysis or process division in this way, costs (that is, engineering costs) may increase.

The embodiments of the present invention have been made in view of the above points, and an object thereof is to realize abnormality detection in consideration of characteristic fluctuations and maintenance of linear relationships.

In order to achieve the above object, an abnormality detection device according to an embodiment of the present invention is an abnormality detection device that detects an abnormality that occurs in a continuous process in which characteristic fluctuations exist, and which uses a sensor for the continuous process. an input unit that inputs sensed sensor information; an extraction unit that extracts sensor information that is close to the sensor information input by the input unit from past sensor information; and a learning data that uses the sensor information extracted by the extraction unit. a model construction unit that constructs a model by principal component analysis, and evaluates whether an abnormality occurs in the continuous process using the model constructed by the model construction unit and sensor information input by the input unit. An evaluation section.

Further, the abnormality detection device according to the embodiment of the present invention includes a dividing unit that uses the past sensor information to divide the continuous process into one or more processes in which sensor information between each sensor maintains a linear relationship. The extraction unit extracts past sensor information that is close to the sensor information input by the input unit for each process divided by the division unit, and the model construction unit extracts past sensor information that is close to the sensor information input by the input unit, for each process divided by the division unit, The evaluation unit constructs the model for each process divided by the division unit, and uses the model and sensor information input by the input unit to determine the abnormality in the continuous process. It is characterized by evaluating whether or not the occurrence of

It is possible to realize anomaly detection that takes into consideration characteristic fluctuations and linear relationship maintenance.

FIG. 3 is a diagram for explaining an example of false detection due to characteristic fluctuations. FIG. 6 is a diagram for explaining an example of the relationship between sensors when a linear relationship cannot be maintained. FIG. 3 is a diagram for explaining an example of process division. 1 is a diagram illustrating an example of a functional configuration of an abnormality detection device according to an embodiment. FIG. 3 is a diagram for explaining an example of data distribution before and after characteristic variation in the same process. 1 is a diagram illustrating an example of a hardware configuration of an abnormality detection device according to an embodiment. 7 is a flowchart illustrating an example of process division processing according to the present embodiment. It is a flowchart which shows an example of abnormality detection processing concerning this embodiment.

Hereinafter, an embodiment of the present invention (hereinafter referred to as "this embodiment") will be described in detail. In this embodiment, an anomaly detection device 10 that is capable of detecting anomaly in consideration of characteristic fluctuations and maintenance of a linear relationship will be described. The abnormality detection device 10 according to the present embodiment performs process division, taking into account characteristic fluctuations and linear relationship maintenance of the continuous process, and uses a normal model (hereinafter referred to as " By constructing a ``PCA model'' (also referred to as ``PCA model''), anomaly detection is realized taking into consideration the characteristic fluctuations and maintenance of linear relationships.

<Functional configuration of the abnormality detection device 10>
First, the functional configuration of the abnormality detection device 10 according to this embodiment will be described with reference to FIG. 4. FIG. 4 is a diagram showing an example of the functional configuration of the abnormality detection device 10 according to the present embodiment.

As shown in FIG. 4, the abnormality detection device 10 according to the present embodiment includes an input section 101, a process division section 102, a neighborhood data extraction section 103, a model construction section 104, and an evaluation section 105 as functional sections. , and an output section 106. Further, the abnormality detection device 10 according to the present embodiment includes a storage unit 107.

The input unit 101 inputs (collects) sensor information including sensor values of a plurality of sensing devices 20 at predetermined time intervals (for example, every sensing cycle of the sensing devices 20). In this embodiment, for simplicity, it is assumed that the sensor information includes the sensor values of each of the plurality of sensing devices 20, but the input unit 101 collects the sensor values from each of the sensing devices 20, and then , sensor information including these collected sensor values may be created. The input unit 101 then stores the collected sensor information in the storage unit 107. Thereby, the sensor information is stored in the storage unit 107 as time series data.

Further, the input unit 101 inputs equipment information of the continuous process and stores the input equipment information in the storage unit 107 . Here, equipment information includes, for example, the process type, normal range, abnormal range of continuous process, event information (e.g., operation date, operation cycle, equipment inspection date, equipment inspection cycle, etc.), and the physical location of the equipment. This information includes the following information.

Note that the input unit 101 does not need to input and save the equipment information again unless the equipment information is changed. When at least one piece of information included in the equipment information is changed, the input unit 101 inputs the changed equipment information and stores (overwrites) the input equipment information in the storage unit 107.

Hereinafter, each of the plurality of sensing devices 20 will also be referred to as "sensor 1,""sensor2,""sensor3," etc. More generally, it is also expressed as "sensor i", where i is an integer of 1 or more. Note that if the total number of sensors is I, the sensor value of sensor i is x _i , and the index of each sensor information is n (that is, time index), then the nth sensor information is (x ₁ (n),... , x _I (n)).

The process division unit 102 uses the sensor information stored in the storage unit 107 to divide the plurality of sensing devices 20 into processes. That is, the process dividing unit 102 divides the continuous process so that there is a linear relationship between the sensor values of the sensing devices 20 belonging to the same process. The division results of the continuous process are stored in the storage unit 107.

The neighborhood data extraction unit 103 extracts a data group that is close to the evaluation point data for each process divided by the process division unit 102 . Evaluation point data refers to sensor information at the point in time when evaluating whether or not an abnormality has occurred in a continuous process.

Here, for example, if sensor 1 and sensor 2 have a certain process, and the distribution of the relationship between the sensor value of sensor 1 and the sensor value of sensor 2 before and after a characteristic change is as shown in FIG. Suppose there was. In addition, the distribution before the characteristic change is defined as “data group 1” and the data group after the characteristic change is “data group 2”, and the sensor value of sensor 1 and sensor value of sensor 2 included in the evaluation time data are “queried”. shall be. At this time, extracting a data group near the evaluation time point data means extracting the data group 2 described above. By extracting a data group that is close to the evaluation point data, it is possible to obtain a data group with the same characteristic fluctuations as the evaluation point data.

Hereinafter, among the sensor values included in the evaluation point data, the sensor value of the sensing device 20 belonging to the corresponding process will be referred to as a "query." In other words, the query is a vector (or scalar) obtained by extracting only the sensor values of the sensing device 20 belonging to the corresponding process from among the sensor values included in the evaluation time data.

The model construction unit 104 creates a PCA model for each process divided by the process division unit 102, using the data group extracted by the neighborhood data extraction unit 103 as learning data (more precisely, a learning data group). Then, the model construction unit 104 calculates a predetermined statistic (at least one of the Q statistic and the T ² statistic) using the created PCA model and each data included in the data group. Hereinafter, the Q statistic and T ² statistic calculated at this time will also be referred to as "Q statistic at the time of model construction" and "T ² statistic at the time of model construction", respectively. Note that a predetermined statistic (at least one of the Q statistic at the time of model construction and the T ² statistic at the time of model construction) is calculated for each data constituting the data group.

The model construction unit 104 also stores a predetermined statistic (at least one of the Q statistic at the time of model construction and the ^T2 statistic at the time of model construction) in the storage unit 107.

The evaluation unit 105 calculates a predetermined statistic (at least one of the Q statistic and the T ² statistic) using the PCA model created by the model construction unit 104 and the evaluation time data. Hereinafter, the Q statistic and T ² statistic calculated at this time will also be referred to as "Q statistic at the time of evaluation" and "T ² statistic at the time of evaluation," respectively.

Then, the evaluation unit 105 uses the Q statistic and/or the T ² statistic at the time of evaluation, and the Q statistic and/or T ² statistic at the time of model construction stored in the storage unit 107. Based on the amount, it is evaluated whether an abnormality has occurred in the continuous process at the time of evaluation. Furthermore, when it is determined that an abnormality has occurred, the evaluation unit 105 may further analyze the cause of the abnormality.

The output unit 106 outputs the evaluation result and the analysis result of the cause of the abnormality by the evaluation unit 105 to a predetermined output destination. An abnormality is detected by outputting an evaluation result indicating that an abnormality has occurred. Here, the predetermined output destination can be any output destination. The predetermined output destination may be, for example, a display, a storage device, or the like, or a predetermined device connected via a network.

The storage unit 107 stores sensor information, equipment information, process division results, Q statistics at the time of evaluation, ^T2 statistics at the time of evaluation, and the like. In addition to these, arbitrary processing results, calculation results, etc. may be stored.

<Hardware configuration of abnormality detection device 10>
Next, the hardware configuration of the abnormality detection device 10 according to this embodiment will be described with reference to FIG. 6. FIG. 6 is a diagram showing an example of the hardware configuration of the abnormality detection device 10 according to the present embodiment.

As shown in FIG. 6, the abnormality detection device 10 according to the present embodiment includes an input device 201, a display device 202, an external I/F 203, a communication I/F 204, and a ROM (Read Only Memory) as hardware. 205 , a RAM (Random Access Memory) 206 , a CPU (Central Processing Unit) 207 , and an auxiliary storage device 208 . These pieces of hardware are connected to each other by a bus 209 so that they can communicate with each other.

The input device 201 is, for example, various buttons, a touch panel, a keyboard, a mouse, etc., and is used to input various operations to the abnormality detection device 10. The display device 202 is, for example, a display, and displays various processing results by the abnormality detection device 10. Note that the abnormality detection device 10 does not need to have at least one of the input device 201 and the display device 202.

External I/F 203 is an interface with an external device. The external device includes a recording medium 203a and the like. The abnormality detection device 10 can read and write data on the recording medium 203a via the external I/F 203. Examples of the recording medium 203a include an SD memory card, a USB memory, a CD (Compact Disk), and a DVD (Digital Versatile Disk). Note that one or more programs realize each functional unit (for example, input unit 101, process division unit 102, neighborhood data extraction unit 103, model construction unit 104, evaluation unit 105, output unit 106, etc.) of the abnormality detection device 10. may be stored in the recording medium 203a.

The communication I/F 204 is an interface through which the abnormality detection device 10 performs data communication with other devices and devices (for example, the sensing device 20, etc.). Note that one or more programs that implement each functional unit included in the abnormality detection device 10 may be acquired (downloaded) from a predetermined server or the like via the communication I/F 204.

The ROM 205 is a nonvolatile semiconductor memory that can retain data even when the power is turned off. The RAM 206 is a volatile semiconductor memory that temporarily holds programs and data. The CPU 207 is an arithmetic device that reads programs and data from, for example, the auxiliary storage device 208 and the ROM 205 onto the RAM 206 and executes various processes. Each functional unit included in the abnormality detection device 10 is realized by, for example, processing executed by the CPU 207 by one or more programs stored in the auxiliary storage device 208 or the like.

The auxiliary storage device 208 is, for example, an HDD (Hard Disk Drive) or an SSD (Solid State Drive), and is a nonvolatile memory that stores programs and data. The programs and data stored in the auxiliary storage device 208 include, for example, one or more programs that implement each functional unit of the abnormality detection device 10, an OS (Operating System) that is basic software, and various programs that run on the OS. There are application programs, etc. Note that the storage unit 107 of the abnormality detection device 10 can be realized using, for example, an auxiliary storage device 208.

The abnormality detection device 10 according to this embodiment has the hardware configuration shown in FIG. 6, so that it can implement various processes described below. Although FIG. 6 shows an example of the hardware configuration in which the anomaly detection device 10 is implemented by one computer, the present invention is not limited to this, and even if the anomaly detection device 10 is implemented by multiple computers. good.

<Process division processing>
Hereinafter, a process division process for dividing a sensing device 20 that senses a continuous process into a plurality of processes (that is, dividing a continuous process by treating sensing devices 20 that have a linear relationship with each other as the same process) will be described. This will be explained with reference to FIG. FIG. 7 is a flowchart illustrating an example of process division processing according to this embodiment. Note that the process division process shown in FIG. 7 is executed periodically, for example, at every predetermined time.

Hereinafter, it is assumed that N pieces of sensor information are stored in the storage unit 107, and the index of each piece of sensor information is n (1≦n≦N).

First, the process dividing unit 102 acquires N pieces of sensor information stored in the storage unit 107 (step S101).

Next, the process division unit 102 calculates the correlation coefficient between each sensor using the following equation (1) (step S102).

次に、プロセス分割部１０２は、相関係数ｒ_ｉｊが所定の閾値以上である場合にセンサｉとセンサｊとを同一プロセスとして、連続系プロセスを１以上のプロセスに分割する（ステップＳ１０３）。すなわち、プロセス分割部１０２は、相関係数ｒ_ｉｊが所定の閾値以上である場合にセンサｉとセンサｊとが同一プロセスとなるように、各センサｉを分類する。これにより、連続系プロセスが複数のプロセスに分割される。ここで、プロセス分割部１０２によるプロセス分割結果（すなわち、分割後のどのプロセスにどのセンサｉが属するかを示す情報）は、記憶部１０７に記憶される。

Next, if the correlation coefficient r _ij is greater than or equal to a predetermined threshold value, the process dividing unit 102 divides the continuous process into one or more processes, regarding sensor i and sensor j as the same process (step S103). That is, the process division unit 102 classifies each sensor i such that sensor i and sensor j belong to the same process when the correlation coefficient r _ij is greater than or equal to a predetermined threshold. This divides the continuous process into multiple processes. Here, the process division result by the process division unit 102 (that is, information indicating which sensor i belongs to which process after division) is stored in the storage unit 107.

As described above, the abnormality detection device 10 according to the present embodiment can divide a continuous process into one or more processes. At this time, by performing process division by treating sensors with correlation coefficients equal to or higher than a predetermined threshold (that is, sensors with high correlation between sensor values) as the same process, it is possible to perform process division in consideration of maintaining linear relationships. become able to. As a result, in each process after process division, the sensors belonging to the process have a linear relationship.

Note that, as the above-mentioned predetermined threshold value, an arbitrary value may be set by, for example, an operator of the plant or the like. In addition, in the above, process division was performed using only the correlation coefficient between sensors, but for example, the process type included in the equipment information stored in the storage unit 107 or the physical The process may be divided by further considering the physical position and the like.

<Anomaly detection processing>
Hereinafter, on the premise that the process division process described above has been executed, an abnormality detection process for detecting an abnormality when an abnormality occurs in a continuous process will be described with reference to FIG. FIG. 8 is a flowchart illustrating an example of the abnormality detection process according to the present embodiment. In the following, it is assumed that the continuous process has been divided into one or more processes by the process division processing described above.

First, the input unit 101 inputs evaluation time data (step S201). Subsequent steps S202 to S206 are repeatedly executed each time the input unit 101 inputs evaluation time data. That is, for example, when the input unit 101 inputs evaluation time data at predetermined time intervals, subsequent steps S202 to S206 are repeatedly executed at the predetermined time intervals. Note that the input unit 101 stores the input evaluation time point data in the storage unit 107 as sensor information.

Next, the neighborhood data extraction unit 103 extracts a data group that is close to the evaluation point data from the sensor information stored in the storage unit 107 for each process divided by the process division unit 102 (step S202). . Here, two methods, "extraction using a distance function" and "extraction using clustering", will be described below as examples of methods for extracting data groups that are in the vicinity of evaluation point data. Note that in extraction using a distance function, each time evaluation time data is input, a data group that is close to the query of the evaluation time data is sequentially extracted for each process. On the other hand, in extraction using clustering, when evaluation point data is input, a data group that is close to the query of the evaluation point data is selected from among the data groups that have been clustered in advance for each process. . In this step described below, as an example, one certain process is fixed, and a sensor belonging to this process is expressed as "sensor k" (1≦k≦K). Therefore, the nth sensor value of sensor k is expressed as "x _k (n)". Furthermore, among the sensor values included in the sensor information stored in the storage unit 107, the sensor value (set) of each sensor k (1≦k≦K) is simply referred to as “data” (this means that The same applies to subsequent steps S205 and S206.) That is, the n-th data is expressed as (x ₁ (n), . . . , x _K (n)).

(1) Extraction using a distance function (1-1) First, a case where Euclidean distance is used as the distance will be explained. In this case, in the process, the neighborhood data extraction unit 103 calculates the Euclidean distance between the query of the evaluation point data and the data included in each sensor information stored in the storage unit 107 using the following formula (2). .

次に、近傍データ抽出部１０３は、上記の式（２）により算出した距離ｄ_{Ｅｕｃｌｉｄ}（ｎ）の昇順に各データをソートする。そして、近傍データ抽出部１０３は、昇順にソート後のデータの中から、予め設定された個数のデータを距離が小さい順に取得する。これにより、当該プロセスにおいて、評価時点データのクエリの近傍となるデータ群が抽出される。

Next, the neighborhood data extraction unit 103 sorts each piece of data in ascending order of the distance d _Euclid (n) calculated using the above equation (2). Then, the neighborhood data extraction unit 103 acquires a preset number of data from the data sorted in ascending order in descending order of distance. As a result, in this process, a data group that is close to the query of the evaluation point-of-time data is extracted.

Note that if you simply acquire data in order of decreasing Euclidean distance, a linear relationship may not be maintained and the accuracy of abnormality detection may decrease. From each data that constitutes the extracted data group, only data on the same operation day (or same operation time, etc.) is extracted, and this extracted data is The data may be extracted again as a data group. As a result, even if the data is close to the query, it can be excluded if the operating days are different, so a data group having a linear relationship can be obtained.

(1-2)
Next, a case where Mahalanobis distance is used as the distance will be explained. Note that in the Mahalanobis distance, in order to calculate the distance between a query and a certain data set, as an example, the sensor values of each sensor included in the process are grouped by the same operation date. When the data included in each sensor information stored in the storage unit 107 is grouped by the same operating day, a set of data from the same group (that is, the same operating day) is expressed as a "same operating day data group". , assign a number to each, and let the index be j.

In this process, the neighborhood data extraction unit 103 calculates the Mahalanobis of the evaluation point data query and each same operation day data group using the following equation (3).

次に、近傍データ抽出部１０３は、上記の式（３）により算出した距離ｄ_{Ｍａｈａｌａｎｏｂｉｓ}（ｊ）の昇順に各同一操業日データ群をソートする。そして、近傍データ抽出部１０３は、昇順にソート後の同一操業日データ群の中から、予め設定された個数の同一操業日データ群を距離が小さい順に取得（又は、最も距離が小さい同一操業日データ群を取得）する。これにより、当該プロセスにおいて、評価時点データのクエリの近傍となるデータ群（つまり、同一操業日データ群）が抽出される。

Next, the neighborhood data extraction unit 103 sorts each same operation day data group in ascending order of the distance d _Mahalanobis (j) calculated by the above equation (3). Then, the neighborhood data extraction unit 103 acquires a preset number of same-operation-day data groups from the same-operation-day data groups sorted in ascending order in order of decreasing distance (or the same-operation-day data group with the smallest distance). (obtain data group). As a result, in this process, a data group (that is, a data group on the same operating day) that is close to the query of the evaluation point-of-time data is extracted.

Note that grouping each piece of data by the same operating date is just an example, and other criteria (for example, the physical measurement cycle of the equipment that the sensor senses, the type of material processed by the equipment, etc.) You can also group them.

(2) Extraction using clustering In extraction using clustering, in the process, the neighborhood data extraction unit 103 selects the data that is close to the query of the evaluation point data among the data groups (clusters) that have been clustered in advance. Clusters are selected based on arbitrary criteria (for example, the closeness of the distance between the query and the cluster). As a result, in this process, a data group that is close to the query of the evaluation point-of-time data is extracted.

Here, in order to perform extraction using clustering, for example, the sensor information stored in the storage unit 107 is used to periodically perform the extraction at predetermined time intervals, and the results are stored in the storage unit 107 or the like. It needs to be saved. As the clustering method, any method (eg, EM (Expectation-Maximization) algorithm, k-means method based on Mahalanobis distance, etc.) can be used. Note that the number of clusters may be arbitrarily set by an operator of a plant or the like, or may be automatically determined using an information standard amount such as AIC (Akaike's Information Criterion).

Following step S202, the model construction unit 104 uses the data group extracted by the neighborhood data extraction unit 103 as learning data (more precisely, a learning data group) for each process divided by the process division unit 102 to perform PCA. Create a model. Then, the model construction unit 104 calculates a predetermined statistic (at least one of the Q statistic and the ^T2 statistic) using the created PCA model and each data included in the data group (step S203 ). Hereinafter, it is assumed that both the Q statistic and the ^T2 statistic are calculated as predetermined statistics.

The Q statistic and the T ² statistic can be calculated using the following equations (4) and (5).

このとき、モデル構築部１０４は、当該ＰＣＡモデルと、当該データ群に含まれる各データとを用いて、当該データ毎に、上記の式（４）及び式（５）によりモデル構築時のＱ統計量及びモデル構築時のＴ^２統計量を算出する。これにより、例えば、当該データ群に含まれるデータ数がＬ個である場合、Ｌ個のモデル構築時のＱ統計量と、Ｌ個のモデル構築時のＴ^２統計量とが算出される。

At this time, the model construction unit 104 uses the PCA model and each data included in the data group to calculate the Q statistics at the time of model construction using the above equations (4) and (5) for each data. Calculate the amount and the ^T2 statistic during model construction. As a result, for example, when the number of data included in the data group is L, the Q statistic when constructing L models and the T ² statistic when constructing L models are calculated.

Note that the contribution Q k of (sensor value of) sensor _k in the Q statistic is expressed by the following equation (6).

すなわち、Ｑ統計量とは、各センサｋの寄与度Ｑ_ｋの和で表される。

That is, the Q statistic is expressed as the sum of the contribution Q _k of each sensor k.

Note that the Q statistic at the time of model construction and the ^T2 statistic at the time of model construction are stored in the storage unit 107.

Next, the evaluation unit 105 calculates, for each process, the Q statistic at the time of evaluation and the T ² statistic at the time of evaluation, using the PCA model of the process and the query of the evaluation time data. Since the query for evaluation point data in the process is also expressed as (x ₁ , ..., x _K ), the Q statistic at the time of evaluation and the T ² statistic at the time of evaluation are calculated using the above formula (4) and formula Calculated using (5).

Then, the evaluation unit 105 uses the Q statistic at the time of evaluation, the T ² statistic at the time of evaluation, the Q statistic at the time of model construction, and the T ² statistic at the time of model construction, and determines the evaluation time point according to a predetermined standard. In step S204, it is evaluated whether an abnormality has occurred in the continuous process.

Here, the predetermined standard can be arbitrarily set by the operator of the plant or the like. For example, if the Q statistic at the time of evaluation exceeds the maximum value of the Q statistic at the time of model construction, it is evaluated that an abnormality has occurred, or the Q statistic at the time of evaluation is the same as the Q statistic at the time of model construction. For example, if the value does not fall within the 3σ range, it is determined that an abnormality has occurred. Similarly, if the ^T2 statistic at the time of evaluation exceeds the maximum value of the ^T2 statistic at the time of model construction, it is evaluated that an abnormality has occurred, or if the T2 statistic at the time of evaluation exceeds the maximum value of the ^T2 statistic at the time of model construction, An example of this is to evaluate that an abnormality has occurred when the ^T2 statistic is not within the 3σ range.

Furthermore, when it is determined that an abnormality has occurred, the evaluation unit 105 may further analyze the cause of the abnormality. An example of the abnormality analysis is to decompose the Q statistic at the time of evaluation into contributions _Qk , and then evaluate sensor k with a high contribution _Qk as the cause of the abnormality. Similarly, after decomposing the ^T2 statistic at the time of evaluation into contribution degrees, sensor k having a high contribution degree may be evaluated as the cause of the abnormality.

Next, the output unit 106 outputs the evaluation result and the analysis result of the cause of the abnormality by the evaluation unit 105 to a predetermined output destination (step S205).

As described above, the abnormality detection device 10 according to the present embodiment dynamically constructs a PCA model every time evaluation point data is input, and can evaluate whether an abnormality has occurred in a continuous plant. Furthermore, at this time, the abnormality detection device 10 according to the present embodiment can create a PCA model and evaluate whether an abnormality has occurred for each process divided by the process division unit 102. Therefore, according to the abnormality detection device 10 according to the present embodiment, it is possible to realize highly accurate abnormality detection that takes into account characteristic fluctuations and linear relationship maintenance, while suppressing engineering costs associated with process division, for example. .

The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

10 Anomaly detection device 20 Sensing device 101 Input section 102 Process division section 103 Neighborhood data extraction section 104 Model construction section 105 Evaluation section 106 Output section 107 Storage section

Claims (6)

An anomaly detection device that detects anomalies occurring in a continuous process in which characteristic fluctuations exist,
an input unit that inputs sensor information generated by the sensing each time the continuous process is sensed by a sensor;
A dividing unit that uses past sensor information to divide the continuous process into one or more processes in which sensor information between each sensor maintains a linear relationship;
Each time sensor information is input by the input unit, the sensor information is determined for each process from among the past sensor information divided as the process based on the distance to the sensor information input by the input unit. an extraction unit that extracts past sensor information that satisfies a predetermined standard;
a model construction unit that constructs a model by principal component analysis using the past sensor information extracted by the extraction unit as learning data for each process, each time past sensor information is extracted by the extraction unit;
Evaluation of evaluating whether an abnormality occurs in the continuous process using the model and sensor information input by the input unit for each process, each time a model is constructed by the model construction unit. Department and
has
The abnormality detection device is characterized in that the criterion is that the sensor information input by the input unit and the type of material processed by the equipment to be sensed are the same. The dividing part is
2. The continuous process is divided into one or more processes in which sensor information between each sensor maintains a linear relationship using a correlation coefficient of sensing values between the sensors. Anomaly detection device. The extraction section is
The abnormality detection device according to claim 1 or 2, wherein the past sensor information that is close to the sensor information input by the input unit is extracted using a distance function. The evaluation department is
The method is characterized in that the presence or absence of an abnormality in the continuous process is evaluated by using the model to calculate a Q statistic and/or a T ² statistic of the sensor information input by the input unit. The abnormality detection device according to any one of claims 1 to 3 . The evaluation department is
When it is evaluated that an abnormality has occurred in the continuous process, as a cause analysis of the abnormality, the degree of contribution of each sensor sensing the continuous process to the Q statistic and/or T ² statistic is calculated; The abnormality detection device according to claim 4 , characterized in that: Anomaly detection equipment that detects anomalies that occur in continuous processes with characteristic fluctuations.
an input procedure of inputting sensor information generated by the sensing each time the continuous process is sensed by a sensor;
A dividing procedure of dividing the continuous process into one or more processes in which sensor information between each sensor maintains a linear relationship using past sensor information;
Each time sensor information is input by the input procedure, the sensor information is determined for each process from among the past sensor information divided as the process based on the distance to the sensor information input by the input procedure. an extraction procedure for extracting past sensor information that satisfies predetermined criteria;
a model construction procedure of constructing a model by principal component analysis using the past sensor information extracted by the extraction procedure as learning data for each process, each time past sensor information is extracted by the extraction procedure;
Every time a model is constructed by the model construction procedure, for each process, the model and the sensor information input by the input procedure are used to evaluate whether or not an abnormality occurs in the continuous process. steps and
Run
The abnormality detection method is characterized in that the criterion is that the sensor information input in the input procedure and the type of material processed by the equipment to be sensed are the same.

Images