KR20230085776A - Anomaly detection method and apparatus based on artifical intelligence using facility control characteristic log data and energy consumption pattern model - Google Patents

Abstract

The present invention relates to an anomaly detection method and apparatus. The present anomaly detection device includes facility equipment, a data collection unit that collects data from a manufacturing site where a controller for controlling the facility equipment is installed, log data collected from the controller among data collected at the manufacturing site, and a predetermined production line at the manufacturing site. A data processing unit that generates an anomaly detection model through machine learning learning using energy consumption pattern data generated from current consumption data collected from energy meters installed at each facility or energy meter, and data collected at manufacturing sites are measured in real time and a data analyzer that detects whether an abnormality has occurred at the manufacturing site based on the analyzed data and an analysis prediction value generated from the anomaly detection model, and outputs an abnormal occurrence signal when the abnormality is detected. According to the present invention, it is possible to quickly identify and take action on the cause of an anomaly by detecting an anomaly in a manufacturing site based on machine learning.

Description

Anomaly detection method and apparatus based on artificial intelligence using facility control characteristic log data and energy consumption pattern model

The present invention relates to an anomaly detection method and apparatus, and more particularly, to detect anomalies at a manufacturing site based on artificial intelligence using log data and energy consumption pattern data of a controller that controls facilities and equipment installed at a manufacturing site. It relates to an anomaly detection method and apparatus.

In general, various industrial facilities are installed at manufacturing sites, and industrial controllers such as PLC (Programmable Logic Controller) are used to control these industrial facilities. In addition, environmental data of manufacturing sites are collected from industrial facilities or sensors to manage manufacturing sites. Various data related to the manufacturing site, such as data related to equipment, data related to processes, etc., are also collected and used.

However, as the amount of data measured from various facilities and devices at the manufacturing site increases, workers or managers analyze the data in real time to recognize the current situation, and based on the recognized result, identify the cause of facility shutdown, It is not easy to improve productivity through improvement activities and optimize production or facility operation.

In addition, there are numerous industrial fields and related fields in which it is impossible to take appropriate measures by identifying the cause of a defect occurring during a process unless a specific expert is present, such as the painting and coating industry.

Therefore, it is necessary to consider a method to support optimal production operation based on providing an anomaly detection service linked to a model learned based on machine learning so that it can be applied to various manufacturing environments or industrial fields.

Accordingly, an object of the present invention is to provide an anomaly detection method and apparatus capable of detecting the occurrence of anomalies at a manufacturing site using a model learned based on machine learning.

An anomaly detection device according to the present invention for achieving the above object is a data collection unit that collects data from a manufacturing site in which equipment and a controller for controlling the equipment are installed, and data collected at the manufacturing site are obtained from the controller. Data processing generated in the anomaly detection model through machine learning learning using the collected log data and the energy consumption pattern data generated from the current consumption data collected from the energy meters installed in each production line or facility unit at the manufacturing site. Based on the measured and analyzed data collected from the manufacturing site in real time and the predicted analysis value generated from the anomaly detection model, whether or not an abnormality has occurred at the manufacturing site is detected, and if the abnormality is detected, the abnormality is detected. It includes a data analyzer that generates a notification signal.

The predicted analysis value may be generated based on a state transition model and time-series analysis of the energy consumption pattern data.

In addition, a data visualization unit may further include a graph displaying data selected from data collected at the manufacturing site.

On the other hand, an anomaly detection method according to the present invention for achieving the above object includes collecting data from a manufacturing site in which equipment and a controller for controlling the equipment are installed, and among the data collected at the manufacturing site, from the controller Creating an anomaly detection model through machine learning learning using the collected log data and the energy consumption pattern data generated from the current consumption data collected from the energy meters installed in each of the predetermined production lines or facilities at the manufacturing site, Detecting whether or not an abnormality has occurred at the manufacturing site based on data obtained by measuring and analyzing data collected at the manufacturing site in real time and an analysis prediction value generated from the anomaly detection model, and if the occurrence of the abnormality is detected, and generating an anomaly detection notification signal.

And, in order to achieve the above object, the present invention may provide a processor-readable recording medium on which a program for executing the abnormality detection method in a processor is recorded.

According to the present invention, by detecting abnormalities in a manufacturing site based on machine learning, it is possible to quickly identify and take action on the cause of the abnormality, and it is possible to secure immediate response to problems occurring throughout the site. In addition, it is possible to identify the cause of equipment stoppage or abnormal operation, to improve productivity through improvement activities, and to introduce an advanced production system and improve quality through efficient process management.

1 is a view referenced for description of the configuration of an anomaly detection apparatus according to an embodiment of the present invention;
2 is a diagram referenced for description of an operation of an anomaly detection apparatus according to an embodiment of the present invention;
3 is a flowchart provided to explain the process of generating an anomaly detection model used in the present invention;
4 to 7 are views referenced for description of the anomaly detection model used in the present invention, and
8 is a flowchart provided to explain an anomaly detection method according to an embodiment of the present invention.

In this specification, when a component is referred to as being “connected” or “connected” to another component, it may be directly connected or connected to the other component, but there may be other components in the middle. It should be understood that it may be Other expressions describing the relationship between components, such as "between" or "adjacent to", and expressions such as "transmitting" a signal from one component to another, should be interpreted similarly.

Hereinafter, the present invention will be described in more detail with reference to the drawings.

1 is a diagram referenced for description of the configuration of an anomaly detection apparatus according to an embodiment of the present invention.

Referring to FIG. 1 , the anomaly detection device 100 includes a data collection unit 110, a data processing unit 130, a data analysis unit 150, a data visualization unit 170, and a data storage unit 190. can include

When these components are implemented in actual applications, two or more components may be combined into one component, or one component may be subdivided into two or more components as needed.

The data collection unit 110 may collect log data from the first to nth controllers 10a to 10n that control equipment installed in a manufacturing site. Log data is data that records events that occur in real life, and analyzing log data allows you to check the actual situation in detail.

The data collection unit 110 may collect current consumption data and the like from the first to nth energy meters 20a to 20n installed in a predetermined production line or facility unit at a manufacturing site. The data collection unit 110 also includes data obtained by measuring RMS values and power factors of the voltage and current of the three-phase (RST) through the first to nth energy meters 20a to 20n or sensors or measuring devices connected thereto. In addition, data related to power quality, frequency, active power, reactive power, and harmonics can be collected.

The data collection unit 110 also collects various data related to the manufacturing site, such as environmental data such as temperature, humidity, and dust of the manufacturing site, device-related data, and process-related data, from sensors previously installed at the manufacturing site through wired and wireless communication. can do.

The data collection unit 110 is an intelligent sensor that combines nanotechnology or MEMS technology with general sensor technology that detects physical and chemical information of a measurement object, and performs signal processing such as data processing, automatic correction, self-diagnosis, decision-making, and communication. It can also have a smart sensor that can have a built-in function.

The data processing unit 130 collects log data collected from the first to nth controllers 10a to 10n and the first to nth energy meters 20a to 20n among the data collected by the data collection unit 110 Through machine learning learning using energy consumption pattern data generated from current consumption data, etc., an anomaly detection model that can be used to detect abnormalities in a manufacturing site can be created.

Machine learning or machine learning is a field of artificial intelligence, and can be said to be a series of processes in which a computer is trained with pre-prepared learning data to find an appropriate answer for a new input based on the trained knowledge. At this time, when the training data for training the computer is given both a question (training input) and a correct answer (training output), it is said to be labeled.

The data processing unit 130 may also generate data obtained by measuring and analyzing data collected at a manufacturing site in real time and standardized data sets.

The data analysis unit 150 compares the real-time measurement and analysis of data collected at the manufacturing site with the predicted analysis value generated from the anomaly detection model, detects whether there is an abnormality in the manufacturing site process or device operation, and When this is detected, an abnormal occurrence signal may be generated.

The data visualization unit 170 may visualize and display data selected from data collected by the data collection unit 110 or data processed by the data processing unit 130 in a graph or chart.

In addition, the data storage unit 190 may convert and store a data set generated by standardizing data selected from data collected at a manufacturing site into a database.

The anomaly detection device 100 configured as described above may detect occurrence of anomaly at a manufacturing site based on measurement and analysis data of data collected at a manufacturing site and an anomaly detection model learned through machine learning.

2 is a diagram referenced for describing an operation of an anomaly detection apparatus according to an embodiment of the present invention.

Referring to FIG. 2 , the anomaly detection device 100 is communicatively connected to the management server 200 for integrated management of the manufacturing site through wired/wireless communication through a communication network, and transmits an abnormal occurrence signal to the management server 200. can

In addition, the anomaly detection device 100 may be connected to the manager terminal 250 and select a target to collect data from the manager terminal 250 or inquire information related to data collection and processing.

The management server 200 can identify the cause of equipment stoppage by using the abnormality signal received from the abnormality detection device 100, improve productivity by deploying process improvement activities, and remotely monitor the manufacturing site. Functions and prognostics can also be provided.

In addition, the management server 200 may provide information related to manufacturing status by analyzing the data set transmitted from the anomaly detection device 100, and may analyze inefficient energy equipment and improve existing energy equipment. This enables optimization of production operations.

The management server 200 may be connected to a cloud system through a communication network, through which it may be connected to an Enterprise Resource Planning (ERP), Manufacturing Execution System (MES), Supervisory Control And Data Acquisition (SCADA) system, and the like, and multiple units. It is also possible to connect multiple servers, each deployed in a factory or supplier. In addition, with this configuration, unit factories or subcontractors may be managed integrally by the parent company.

3 is a flowchart provided to explain a process of generating an anomaly detection model used in the present invention.

Referring to FIG. 3 , the data collection unit 110 receives log data from the first to n-th controllers 10a to 10n that control equipment installed at the manufacturing site, and a predetermined production line or equipment unit at the manufacturing site, respectively. Current consumption data is collected from the first to nth energy meters 20a to 20n installed (S300).

The data processing unit 130 generates energy consumption pattern data from the current consumption data, and performs a data pre-processing process on the data collected by the data collection unit 110 (S310). Data preprocessing is the process of converting existing data into data suitable for machine learning algorithms.

Data preprocessing includes Regression Tree Series Denoising, which removes noise through random forest prediction using process data as correct answer labels, cuts data based on cycle and time, learns by labeling certain parts, and removes noise elimination, that is, Time Series Prediction Deep Learning that learns future data through past data and removes out-of-trend data, LPF that judges and removes data with a very narrow time interval as noise, and Methods such as Outline Del, which removes noise, and Autoencoder Denoising, which trains the algorithm using process data as correct answer labels, compares extracted results with actual data, and removes data with large differences, can be used.

A data normalization process may be performed after data preprocessing. The data normalization process is to ensure that all data points are reflected on the same scale (importance), and the learning efficiency of machine learning can be increased by the data normalization process. As a data normalization method, a min-max normalization method, a Z-score normalization method, or the like may be used.

Next, the data processing unit 130 uses the preprocessed data as learning data and performs learning using a machine learning technique (S320).

In machine learning, when a state transition model and learning for time series prediction are performed, the machine learning process may be performed directly in the data processing unit 130, or a separate server system under the control of the data processing unit 130 It can also be configured to perform in

Next, the data processing unit 130 generates an anomaly detection model according to the learning result (S330). Using the anomaly detection model generated in this way, it is possible to detect whether or not there is an anomaly in a manufacturing site process or device operation.

4 to 7 are diagrams referenced for description of the anomaly detection model used in the present invention.

4 shows an example of a state transition model.

Referring to FIG. 4 , in the state transition model, it can be shown that different operations are performed according to states reflecting current and previous situations and transitions thereof.

The controller 10 controlling equipment of a specific manufacturing process is configured to transition to a constant state according to the process. Therefore, it can be confirmed that it is not a steady state when a transition outside the pre-learned model occurs.

The anomaly detection model can identify a normal state transition through machine learning learning using log data collected from the controller 10, and if a different transition occurs after machine learning learning, it can determine that it is not a normal state.

5 is a diagram referenced for description of an energy consumption pattern model.

Referring to FIG. 5 , energy consumption of equipment at a manufacturing site in which a certain manufacturing process is performed has a periodic characteristic.

Accordingly, when frequency decomposition is performed on the current consumption data, energy consumption pattern data having characteristics of time-series data can be generated, and the energy consumption pattern data exhibits a certain pattern and trend.

Time series data refers to data recorded sequentially over time, and the problem of predicting the future by analyzing observed time series data is the time series prediction problem.

In other words, the anomaly detection model learns the energy consumption pattern of the manufacturing site and can predict the energy consumption pattern that will occur in the future. If the energy consumption pattern generated from the actual measured data is different from this, it can be known that an anomaly has occurred. .

6 shows data collected in the case of actual normal operation, and FIG. 7 shows an example of data predicted through time-series prediction in the anomaly detection model. In the case of normal operation, the actual measured data and the predicted data are almost coincidence can be seen. If there is a difference between the actually measured data and the predicted data, it can be known that an error has occurred.

8 is a flowchart provided to explain an anomaly detection method according to an embodiment of the present invention.

Referring to FIG. 8 , the data collection unit 110 collects log data from the controller 10 that controls manufacturing site facilities and collects power consumption data from the energy meter 20 (S400).

The data processing unit 130 generates analysis prediction values based on the anomaly detection model (S410).

The data analysis unit 150 compares the analysis prediction value with the actually collected data (S420), and when the difference is greater than a preset standard, it is determined whether or not an error has occurred (S430).

When it is determined that an abnormality has occurred as a result of the determination in step S430, the data analysis unit 150 integrally transmits an alarm signal informing that an abnormality has been detected to the management server 200 or a predetermined manager's terminal at the manufacturing site ( S440).

Through this process, it is possible to detect abnormality in the process or abnormal operation of the device according to the artificial intelligence-based anomaly detection model.

On the other hand, the anomaly detection method and apparatus according to the present invention can not be applied limitedly to the configuration of the embodiments described above, but all or part of each embodiment can be modified in various ways. It may be selectively combined and configured.

In addition, the present invention can be implemented as a computer program on a programmable computer. Such computers may include processors, storage devices, input devices, and output devices. In order to implement the contents described in the present invention, the program code may be input with a mouse or keyboard input device. These programs can be implemented in a high-level language or an object-oriented language. It can also be implemented as a computer system implemented in assembly or machine code.

Further, the subject matter of the present invention is not limited to hardware or software use, but is applicable to any other computing or processing environment. It may be implemented by hardware, software, or a combination of hardware and software described in the present invention. The invention may be implemented using circuitry. That is, it can be implemented with one or more programmable logic circuits, that is, application specific integrated circuits (ASICs) or logic circuits (AND, OR NAND gates) or processing devices (eg, microprocessors, controllers).

In addition, although the preferred embodiments of the present invention have been shown and described above, the present invention is not limited to the specific embodiments described above, and the technical field to which the present invention belongs without departing from the gist of the present invention claimed in the claims. Of course, various modifications are possible by those skilled in the art, and these modifications should not be individually understood from the technical spirit or perspective of the present invention.

110: data collection unit 130: data processing unit
150: data visualization unit 170: data visualization unit
190: data storage unit

Claims (10)

a data collection unit that collects data from equipment and a manufacturing site in which a controller for controlling the equipment is installed;
Machine learning using log data collected from the controller among data collected at the manufacturing site and energy consumption pattern data generated from current consumption data collected from energy meters installed in predetermined production lines or equipment units at the manufacturing site. a data processing unit that generates an anomaly detection model through learning; and
Based on data obtained by measuring and analyzing data collected at the manufacturing site in real time and analysis prediction values generated from the anomaly detection model, whether or not an abnormality has occurred at the manufacturing site is detected, and when an abnormality is detected, an abnormal occurrence signal is output. An anomaly detection device comprising a data analysis unit to According to claim 1,
The anomaly detection device further comprising a data visualization unit that displays selected data from among data collected at the manufacturing site in a graph. According to claim 1,
The abnormality detection device according to claim 1 , wherein the analysis prediction value is generated based on a state transition model and time-series analysis of the energy consumption pattern data. According to claim 1,
The data management unit further provides a function of monitoring environmental conditions of the manufacturing site in real time. According to claim 1,
The anomaly detection device further comprises a database unit that converts and stores a data set generated by standardizing data selected from among data collected at the manufacturing site. Collecting data from a manufacturing site in which equipment and a controller for controlling the equipment are installed;
Machine learning using log data collected from the controller among data collected at the manufacturing site and energy consumption pattern data generated from current consumption data collected from energy meters installed in predetermined production lines or equipment units at the manufacturing site. generating an anomaly detection model through learning;
detecting whether an abnormality has occurred at the manufacturing site based on data obtained by measuring and analyzing data collected at the manufacturing site in real time and an analysis prediction value generated from the anomaly detection model; and
and outputting an abnormal occurrence signal when the occurrence of the abnormality is detected. According to claim 6,
and transmitting the abnormal detection notification signal to a management server managing the manufacturing site and a preset terminal through wired/wireless communication. According to claim 6,
The anomaly detection method further comprising the step of displaying selected data among the data collected at the manufacturing site in a graph. According to claim 6,
The anomaly detection method further comprising the step of monitoring the environmental conditions of the manufacturing site in real time. A processor-readable recording medium on which a program for executing the abnormality detection method according to any one of claims 6 to 9 in a processor is recorded.

Images