TW202210977A - Abnormality detection device - Google Patents

Abstract

This abnormality detection device is provided with: a feature quantity extraction unit (22) which receives time series data of a target device and extracts a feature quantity of the time series data; a state transition estimation unit (63) which identifies the operating state of the target device from the extracted feature quantity, refers to state transition pattern information specifying state transition patterns between a plurality of operating states, and estimates a state transition of the target device from the extracted feature quantity; and an abnormality detection unit (64) which refers to the state transition pattern information and normal range information specifying the normal range for each operating state, and determines whether the time series data is abnormal, from the identified operating state, the estimated state transition, and the extracted feature quantity of the time series data.

Description

Abnormality detection device

The present invention relates to an abnormality detection device.

Techniques for detecting abnormalities in various devices such as manufacturing machines are well known. For example, in Patent Document 1, it is proposed to use a correlation between physical quantity data obtained from a detector related to a specific manufacturing machine and operation state data as information indicating whether the operation of the manufacturing machine is abnormal or not. An anomaly detector that learns the omens of anomalies and uses the learning results to detect the omens of anomalies. The assumption of whether the manufacturing machine is operating normally is performed, for example, by outputting the probability that the manufacturing machine is operating normally. [Patent Literature]

[Patent Document 1] Japanese Patent Application Laid-Open No. 2019-204155

Generally speaking, for a manufacturing machine that obtains a plurality of operation states, when the process flow of the process constituted by the plurality of operation states is abnormal, the manufacturing machine can be considered to be abnormal. However, according to the technique of Patent Document 1, it is only based on the learning result of the individual operation state to determine whether there is an abnormality in the manufacturing machine, and the flow of the process is not considered. Therefore, there is a problem that the abnormality cannot be detected by considering the flow of the process.

The present invention was developed to solve such a problem, and an object of the present invention is to provide an abnormality detection device that can perform abnormality detection in consideration of a process flow composed of a plurality of operating states.

One aspect of the abnormality detection apparatus according to the embodiment includes: a feature value extraction unit that receives time-series data of the target device and extracts a feature value of the time-series data; and a state transition assumption unit that specifies a feature value from the extracted feature value. The operation state of the target device also refers to the state transition pattern information after defining the state transition pattern between the plurality of operation states, and assumes the state transition of the target device from the extracted feature value; and the abnormality detection unit refers to the definition for The state transition pattern information and the normal range information after the normal range of each operation state are used to determine the time series based on the characteristic quantities from the specified operation state, the assumed state transition, and the extracted time series data Whether the data is abnormal. [Inventive effect]

When referring to the state transition mode information and the normal range information, the abnormality determination is performed according to the one aspect of the abnormality detection device, so that the abnormality determination can be performed in two stages: the state transition stage and the operation state stage. . Therefore, a process flow composed of a plurality of action states can be considered for abnormality detection.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In addition, in all the drawings for explaining the embodiment, the same structural parts are given the same reference numerals, and overlapping descriptions are omitted.

Embodiment 1. ＜Inference Phase＞ (Anomaly Detection System 1000) 1, the overall structure of an abnormality detection system 1000 including the abnormality detection device 100 will be described. FIG. 1 is a block diagram showing the structure of an abnormality detection system 1000 including the abnormality detection apparatus 100 and the abnormality detection apparatus 100 in the first embodiment. As shown in FIG. 1, the abnormality detection system 1000 consists of the target devices OD1, OD2, OD1, OD2, OD1, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, OD2, etc., as shown in FIG. 1, as the target of monitoring. . . , ODn, respectively by these target devices OD1, OD2,. . . , the time series data sent by ODn is received by the abnormality detection device 100 through the communication network NW, and the display accepts various settings made by the user, or an external device that accepts the output results of the abnormality detection device 100 200 components. Here, the so-called target device may be a single device, or may be a system or equipment including a group of plural devices.

The target device ODn or its vicinity is provided with a not-shown detector for acquiring data on the operation of the target device ODn or data on the operating environment of the target device ODn. The number of listeners arranged in a target device may be one or more. When configuring multiple detectors, the multiple detectors can be of the same type (such as three acceleration detectors in the axial, horizontal, and vertical directions), or they can be of different types (such as voltage detectors and current detectors) ). The acquired data is not particularly limited as long as it can be acquired as time series data. Examples of time series data include current, voltage, electricity, velocity, acceleration, angular velocity, pressure, magnetism, torque, temperature, humidity, production numbers, shipments, stock prices, and Internet traffic data. Time series data can be the detected value of the detector itself, or the statistical value of the detected value (such as average, maximum, minimum), or the calculated value of the detected value of a complex detector (such as electricity) . The time-series data obtained from the target device ODn or its vicinity is related to the identification information of the target device ODn of the model or installation location, etc., and is sent to the abnormality detection device 100 through the wired or wireless communication network NW .

The abnormality detection device 100 is based on the target device OD1, OD2,. . . , or the time-series data received by ODn, perform state transition assumptions and anomaly detection for the target device receiving the time-series data. In addition, the abnormality detection device 100 is related to the state transition hypothesis, the abnormality detection result, and the identification information of the target device, so as to be accumulated in the memory unit 4, and corresponding to the input from the external device 200, the acquired detection information is searched from the memory unit 4. Time series data of detector value (such as time series data of current value, time series data of Internet traffic data), to obtain the detector value in a certain observation time, the time of the detector value extending over a certain observation period Information such as sequence data and the installation location of the target device.

(abnormality detection device 100 ) The abnormality detection device 100 includes a reception unit 1 , a time-series data analysis unit 2 , a data recording control unit 3 , a storage unit 4 , an interface unit 5 , and a time-series data matching unit 6 .

(Receiver 1) The receiving unit 1 is received from the target device OD1, OD2,. . . , The delivery data D1 sent by ODn, from the received delivery data D1, extract the target device including the type of detector value, the time series data of the detector value, the detector item, and the use environment data of the target device Information D2. The receiving unit 1 outputs the extracted target device information D2 to the time-series data analyzing unit 2 and the data logging control unit 3 .

Here, the number of types of the sensor value means the number of types of sensor data acquired from the sensor mounted on the target device. There is only one type of data that can be obtained by a detector. For example, when it is only voltage, the type of detector data is 1. When there are two types of data that can be obtained by a sensor, for example, when it is voltage and current, the type of sensor data is type 2. Furthermore, even if the sensor data of the same type are obtained from physically different sensors, the number of types is counted corresponding to the number of sensors. For example, when three acceleration detectors in the axial direction, the horizontal direction, and the vertical direction are used to obtain data, the number of types of detector data is calculated as 3.

The so-called time series data of the detector value means the detector data in the time series obtained by the detector. In addition, the so-called sensor item means an item for identifying the type of sensor data acquired from the sensor, the installation location of the sensor, and the like, which are installed in the sensor of the target device. The types of sensor data include items related to the operation of the target device such as current, voltage, torque, temperature, etc., or items related to the products manufactured by the target device such as the production quantity or shipment quantity.

(Time Series Data Analysis Section 2) The time-series data analysis unit 2 performs time-series data analysis processing on the target device information D2 received from the reception unit 1 . The time-series data analysis unit 2 outputs the analysis result D3 of the target device information D2 to the data logging control unit 3 . The analysis result D3 includes item classification information and a feature value of a detector value to be described later. Details of the time series data analysis unit 2 will be described later.

(Data logging control section 3) The data logging control unit 3 stores the target device information D2 input from the receiving unit 1 and the analysis result D3 input from the time-series data analysis unit 2 to the memory unit 4, thereby constructing a database. Here, when a plurality of detector values are included in one target device information D2, the analysis results D3 (D3-1, D3-2, D3-3, . . . . ), corresponding to the complex number analysis result D3 (D3-1, D3-2, D3-3, ...) to an object device information D2. For example, when a target device information D2 includes a voltage value and a current value, the analysis result D3-1 of the voltage value and the analysis result D3-2 of the current value can also be generated, corresponding to the complex number analysis results D3-1 and D3-2 to An object device information D2. Alternatively, the processing data of the complex detector values can also be summarized into one analysis result D3, and one analysis result D3 is corresponding to one target device information D2.

(memory section 4) The memory unit 4 stores various data. In the first embodiment, the storage unit 4 stores the target device information D2 and the analysis result D3 in correspondence with them. Furthermore, in the first embodiment, the memory unit 4 memorizes the learned hypothesis model D4 used by the time-series data matching unit 6 to be described later.

The learned hypothetical model D4 includes the normal range (normal range information) and the state transition pattern (state transition) of the operation state of each item of the complex detector value corresponding to the feature quantity of each item of the complex detector value mode information). The normal range of the action state is determined for each of the plurality of action states.

The normal range of the action state is the range that has been learned using methods such as regression, Bayesian assumptions, reliability intervals by statistical methods, state space models, 3σ method, and methods by machine learning such as CNN. Alternatively, the user of the abnormality detection device 100 may define the normal range of each operation state.

The state transition pattern is a range that has been learned using, for example, causal inference, multivariate analysis, classification by machine learning such as CNN, and the like. Alternatively, when the state transition mode of the target device is known in advance by, for example, the specification of the target device, the user of the abnormality detection device 100 can also define the state transition mode. State transition patterns can also be complex numbers.

In addition, in Embodiment 1, the structure in which the target device information D2 and the analysis result D3 are stored in the memory unit 4 is shown, but other structures may be adopted. For example, instead of the memory unit 4, a singular or plural number of network storage devices (not shown) may be arranged on the communication network NW to store the target device information D2 and the analysis result D3, and the data record control unit 3 accesses the network. Construction of road storage devices. Thereby, the data logging control unit 3 stores the target device information D2 and the analysis result D3 in the external network storage device, so that a database can be constructed outside the abnormality detection device 100 . In addition, the learned hypothesis model D4 used by the time-series data matching unit 6 may not be stored in the memory unit 4, but may be stored in an external network storage device.

(Interface part 5) The interface unit 5 connects the external device 200 and each unit of the abnormality detection device 100, and enables communication and various controls. The user of the abnormality detection device 100 can use the external device 200 to set the monitoring condition D5 for the monitoring data acquisition unit 61 to search for time-series data. In addition, the user can use the external device 200 to check the matching result D6 of the time-series data matching unit 6 .

(Time Series Data Matching Section 6) The time-series data matching unit 6 performs matching of state transition assumptions and anomaly detection of time-series data of complex detector values. In the first embodiment, the time-series data matching unit 6 obtains the learned hypothesis model D4 from the memory unit 4, and at the same time obtains the target device information D2 and the analysis result D3 from the memory unit 4 according to the monitoring conditions D5 input from the interface unit 5 , to perform matching on the detector value. In addition, the time-series data matching unit 6 outputs the matching result D6 of the detector value to the interface unit 5 , and the matching result D6 is transmitted to the user through the external device 200 .

Next, the detailed structures of the time-series data analysis unit 2 and the time-series data matching unit 6 will be described with reference to FIG. 2 . FIG. 2 is a structural diagram showing the detailed structure of the abnormality detection apparatus 100 .

(Detailed description of time series data analysis section 2) In the first embodiment, the time-series data analysis unit 2 includes a sensor item detection unit 21 , a feature value extraction unit 22 , and a sensor item classification unit 23 .

(Detector item detection unit 21) The sniffer item detection unit 21 refers to the data of the sniffer item on the target device information D2 input from the receiving unit 1 and the usage environment data of the target device to detect the data of the target device appearing in the target device information D2. Detector items for each usage environment.

(feature extraction unit 22) The feature value extraction unit 22 extracts, from the time-series data of the target device information, the feature value of the detector value for grasping the current operation state and the state transition from the current operation state to the next operation state. Here, although the characteristic quantity of the detector value includes the long-term or short-time tendency of the waveform included in the detector value, the length of the waveform, the frequency, the update frequency of the detector value, and a certain waveform (time-series data) is an index such as the degree of similarity between waveforms of plural parts, but the present invention is not limited to this. The feature value of the detector value may be calculated continuously by determining a certain time width when the target device information is acquired by addition, or may be calculated by specifying an arbitrary time point or interval. Here, the term "trend" refers to an index indicating the characteristics of data such as maximum value or minimum value, mean value, dispersion or standard deviation, correlation, slope, or error or residual. The feature quantity can also be extracted from the frequency domain.

(Detector Item Classification Section 23) The snooper item classification unit 23 classifies the feature amount of the extracted sniffer value according to the sniffer item. In the first embodiment, the sensor item classification unit 23 is based on the sensor item of each use environment of the target device detected by the sensor item detection unit 21 and the detection extracted by the feature value extraction unit 22 The feature amount of the sniffer value is used to classify the feature amount of the sniffer value according to the sniffer item.

(Detailed description of time series data matching section 6) Next, the detailed structure of the time-series data matching unit 6 will be described. The time-series data matching unit 6 matches the time-series data of the plural detector values, and determines whether the observed values of the time-series data of the detector values of each operation state are normal. The time-series data matching unit 6 uses the learned hypothetical model D4 to analyze anomalies when the target device information D2 and the analysis result D3 of the memory unit 4 are updated, and outputs a result of finding an anomaly when an anomaly is detected. In addition, when the monitoring condition D5 is set from the external device 200 through the interface unit 5, the analysis result is output according to the monitoring condition D5. Here, the monitoring condition D5 includes, for example, the area information to be monitored, the time information to be searched, the detector item to be searched, and the feature value of the detector value to be searched. . In Embodiment 1, the time-series data matching unit 6 includes a monitoring data acquisition unit 61 , a processing unit 62 , a state transition assumption unit 63 , and an abnormality detection unit 64 . Hereinafter, each structural part will be described.

(Monitoring data acquisition unit 61 ) The monitoring data acquisition unit 61 acquires target device information D2 of one or a plurality of matched target devices, an analysis result D3 corresponding to the target device information D2, and a learned hypothesis model D4. In the first embodiment, the monitoring data acquisition unit 61 searches from the memory unit 4 for a sensor item that matches the monitoring condition D5 set by the external device 200 and a sensor value bound to the sensor item. The time-series data and feature quantities are used to obtain the corresponding target device information D2 and the analysis result D3.

(State Transition Assumption Unit 63) The state transition assumption unit 63 corresponds to the target device information D2 and the analysis result D3 obtained by the monitoring data obtaining unit 61, and the learned hypothesis model D4 obtained by the memory unit 4, and the operation state of the target device in a specific operation, Also assume state transitions. State transitions are represented by, for example, state transition probabilities as the probability of transitioning from an action state to another action state. In the first embodiment, the state transition assumption unit 63 is based on the time-series data of the sensor value included in the target device information D2, the sensor item, the use environment data of the target device, and the detection data included in the analysis result D3. The characteristic value of the sensor value specifies the current action state (the first action state). In addition, the state transition assumption unit 63 refers to the state transition pattern included in the learned hypothesis model D4, and uses the feature value of the detector value to calculate from the current operation state (the first operation state) to the next operation state ( The state transition probability of the second action state). From the current action state to the next action state (the second action state), if there is one case, there are also plural cases. The mode of state transition can also be defined by the user of the abnormality detection device 100 . The mode of state transition is stored, for example, as a state transition table of plural action states and a transition relationship with the plural action states. The state transition assumption unit 63 uses the target device information D2 and the analysis result D3 acquired from the monitoring data acquisition unit 61 , the learned hypothetical model D4 acquired from the memory unit 4 , and the processing results performed by the state transition assumption unit 63 ( specific results or hypothetical results) are delivered to the processing unit 62 . Furthermore, the target device information D2 and the analysis result D3 may be delivered from the monitoring data acquisition unit 61 to the processing unit 62 .

(Processing Section 62) The processing unit 62 obtains the input target device information D2, the feature quantity included in the detector value corresponding to the analysis result D3 corresponding to the target device information D2, and the state transition assumption unit 63, such as the probability of state transition. process result. In addition, the processing unit 62 also acquires the learned hypothetical model D4. The processing unit 62 corresponds to the acquired data or information and the learned hypothetical model D4, and for the time-series data of the detector value of the target device appearing in the operation of the target device information D2, the operation state of a certain probability or more is calculated. Time-series data is regarded as each action state, and normalization, division into action state units, and calculation of the mode of state transition are performed. The processing unit 62 performs these processes as shown in FIGS. 4A to 4D .

The normalization process may be performed on the entire time-series data of a series of detector values as shown in FIG. 4A , or may be performed in each operating state as shown in FIG. 4C . When there are differences in the size of the time series data, normalization is sometimes preferable, but it is possible to omit normalization. Examples of data normalization include, for example, min-max normalization represented by equation (1), z normalization represented by equation (2), and level normalization represented by equation (3). . The min-max normalization system converts the range of some columns into 0-1. The z normalization system treats the range of some columns as a transformation of mean 0 and standard deviation 1. Level normalization is a transformation that treats the average of a part of the column as 0.

However, the time series data resulting from normalizing the time series data T is denoted as T ^N . Also, i=1,...,n, and the functions min, max, mean, and std are the minimum value, maximum value, average value, and standard deviation of T _i,w , respectively.

As shown in FIG. 4B , the processing unit 62 splits the time-series data of the sensor value into each action according to the time-series data of the sensor value when normalization is not performed on the time-series data of the sensor value. Status A to D. As shown in FIG. 4C , after normalizing the time series data of the detector values, the processing unit 62 splits the normalized detector values according to the time series data of the normalized detector values. The time-series data of , go to each action state A to D. The divided action states can be linked to less than three or more than five. As shown in FIG. 4D , the processing unit 62 performs calculation of the mode of state transition based on the divided operation states A to D. FIG.

(abnormality detection unit 64) The abnormality detection unit 64 uses the input target device information D2 , the operation state of the detector value of the target device in operation processed by the processing unit 62 , and the state transition and state assumed by the state transition assumption unit 63 . The conversion probability is used to determine the abnormality of the detector value of the target device in action. In the first embodiment, the abnormality detection unit 64 includes a state transition deviation degree calculation unit 641 , an operation state deviation degree calculation unit 642 , and a determination unit 643 .

(State transition deviation degree calculation unit 641 ) The state transition deviation degree calculation unit 641 corresponds to the target device information D2 acquired by the monitoring data acquisition unit 61 , the state transition and state transition probability assumed by the state transition assumption unit 63 , the analysis result D3 , and the learned assumption model D4 . Calculates the deviation of the state transition of the sensor value of the target device in action from normal. In the first embodiment, the state transition deviation degree calculation unit 641 uses the time-series data of the sensor value included in the target device information D2, the sensor item, and the use environment data of the target device to use the state transition assumption unit 63 Hypothetical state transitions and state transition probabilities, feature quantities of the detector values included in the analysis result D3, and features of each detector item included in the state transition patterns and complex detector values of the learned hypothesis model D4 quantity to calculate the degree of deviation from normal in state transitions. The index of the degree of deviation is used to compare the transition probability between the action state assumed by the state transition assumption unit 63 (from the action state to be specified) to the current action state with the state transition pattern included in the learned hypothesis model D4 The conversion probability is an indicator that increases as the conversion probability of a state conversion different from normal becomes higher. The expression "probability of transition from the assumed state of action to the present" includes the meaning that the action state immediately before is determined, but the current action state is undetermined. When expressed generally, the first action state is determined, but the second action state that temporally follows the first action state is not determined. Therefore, the expression "the transition probability of the assumed action state to the present" can also be expressed as "the transition probability from the specified present action state to the assumed next action state". Furthermore, the state transition mode may be set by the user of the abnormality detection apparatus 100 instead of the learned hypothesis model D4.

(Operation state deviation degree calculation unit 642 ) The operation state deviation degree calculation unit 642 corresponds to the target device information D2 acquired by the monitoring data acquisition unit 61 , the waveform data and the operation state of the detector value of the target device in operation processed by the processing unit 62 , and the analysis result D3 , Using the state transition assumed by the state transition assumption unit 63 and the learned hypothetical model D4, the degree of deviation from the normal operation state of the detector value of the target device in operation is calculated. In the first embodiment, the operating state deviation degree calculation unit 642 uses the time-series data of the sensor value included in the target device information D2, the sensor item, and the use environment data of the target device, and the data included in the analysis result D3. The feature quantity of the detector value, the normal range of each action state included in the learned hypothesis model D4 corresponding to the state transition assumed by the state transition assumption unit 63, the state transition pattern, and each item of the complex detector value The feature quantity of , to calculate the deviation of the action state from normal. The index of the degree of deviation is used: 1) Comparing the waveform data itself obtained successively from the detection object with the learned hypothesis model corresponding to the state transition assumed by the state transition assumption unit 63 according to the waveform data obtained successively. The normal range of each action state included in D4; or 2) Comparing the waveform data of the detector value of the object device in action processed by the processing unit 62 according to the waveform data successively obtained from the detection object, and the waveform data corresponding to the basis The waveform data obtained successively from the detection object, and the normal range of the waveform included in the learned hypothetical model D4 of the operating state processed by the processing unit 62 is an index that increases as the degree of deviation from the normal range increases. . Furthermore, the normal range of each operation state may be set by the user of the abnormality detection apparatus 100 instead of the learned hypothetical model D4.

(determination unit 643) The determination unit 643 uses the results calculated by the state transition deviation degree calculation unit 641 and the operation state deviation degree calculation unit 642 to determine whether or not the target device is abnormal. In Embodiment 1, the determination unit 643 uses the results calculated by the state transition deviation degree calculation unit 641 and the operation state deviation degree calculation unit 642 to determine whether or not the target device is abnormal. The determination method is to perform logical operations such as AND conditions, OR conditions, etc. on the results calculated by the state transition deviation degree calculation unit 641 and the operation state deviation degree calculation unit 642, respectively, and calculate as two values of normality or abnormality, or calculate the difference between the two values. The normal distance, etc., is calculated as a value regarded as the degree of abnormality.

FIGS. 5A to 5C , FIGS. 6A to 6C , and FIGS. 7A to 7C are diagrams showing specific examples of the determination made by the determination unit 643 . In the learned hypothetical model D4, the state transitions that may occur for the target device are maintained in the state transition diagram of FIG. 5A. In the state transition diagram of FIG. 5A , for the target device, possible state transition modes include the mode 1 of FIG. 5B and the mode 2 of FIG. 5C . The mode 1 is a mode in which the operation state is changed from the operation state A→the operation state B→the operation state C→the operation state D→the operation state A. The mode 2 is a mode in which the operation state is changed from the operation state A→the operation state C→the operation state D→the operation state A.

6A to 6C are diagrams for explaining the abnormality detection example 1 which is an example of the abnormality in the state transition. It is taken as time series data represented by the solid line in Fig. 6A. As a result of the analysis of the time series data, it is found that there is a state transition from the action state A to the action state C, and now the action state C is followed to obtain the time series data. Furthermore, in the abnormality detection of the embodiment of the present invention, it is only necessary to know the operation state immediately before, so it is enough to find the operation state C, and it is not necessary to find the state transition from the operation state A to the operation state C. In both mode 1 and mode 2, after the action state C, the action state that can be obtained is the action state D. The operation state D is indicated by a dotted line in FIG. 6A . However, the time-series data in the middle of the acquisition now shows a rise in the waveform of the tracking operation state A. The action state A itself is one of the possible action states of the target device, so being the action state A itself is not abnormal. However, the action state A is not an action state that can be obtained after the action state C in the learned state transition mode, so the fact that the action state A continues after the action state C can be judged as abnormal. More specifically, the current time-series data that continues after the operation state C can be determined to be abnormal at the time point when the waveform from the operation state D has a predetermined deviation. The abnormality can be determined by using the state probability of each action state as shown in FIG. 6B , or by using the abnormality degree of the current time-series data as shown in FIG. 6C . In the abnormality detection example 1, the mode action of the possible state transition of the target device does not correspond to the probability of the transition between modes 1 and 2 (for example, the transition probability to the operating state A), but becomes It is greater than the transition probability to the action state D, so the transition is judged to be abnormal.

7A to 7C are diagrams for explaining an abnormality detection example 2 as an example of an abnormality in a certain operating state. It is taken as time series data represented by the solid line in Fig. 7A. As a result of the analysis of the time series data, it is found that the action state immediately before the current time series data is the action state A, the current waveform of the action state B represented by the dotted line, and the waveform of the action state C represented by the dotted line. The data was obtained in between. In the learned hypothetical model D4, the range determined to be normal for each action state is defined. Therefore, if the time-series data belongs to the waveform for the action state B, it is determined to be in the normal range, or for the action state C. When the waveform is judged to be within the normal range, the action state B or the action state C can be judged to be normal. Furthermore, the current time-series data in FIG. 7A can be determined to be abnormal at a time point where it can be confirmed that it does not fall within any of these ranges. The abnormality can be determined by using the state probability of each action state as shown in FIG. 7B , or the abnormality degree of the current time-series data as shown in FIG. 7C . In the abnormality detection example 2, although the state transition 1 is determined as one of the mode 1 and the mode 2 as the mode of the possible state transition of the target device, the time series data of the detector value Since the waveform also deviates from the normal range of the operating state of either mode 1 or mode 2, it is determined to be abnormal in the operating state.

In this way, the abnormality detection unit 64 refers to the hypothetical model D4 that has been learned for the state transition pattern and the normal range of each operation state, the operation state processed by the processed unit 62 , and the operation specified by the state transition assumption unit 63 . The state, the state transition assumed by the state transition assumption unit 63, and the feature quantity of the extracted time-series data are used to determine whether or not the time-series data is abnormal. The state transition probability assumed by the state transition assumption unit 63 may also be used. The abnormality detection unit 64 refers to the state transition mode (state transition mode information) and the normal range (normal range information) for each operation state to perform abnormality determination. Therefore, the abnormality determination can be made based on the state transition stage and each operation state. Two of the phases are carried out. Therefore, according to the abnormality detection apparatus 100 of the first embodiment, a process flow composed of a plurality of operation states can be considered for abnormality detection.

Furthermore, by integrating the judgment results in these two stages, it is possible to detect an abnormality of the target device even when the next operation state has not been determined since the current operation state transition. That is, you can refer to the learned state transition pattern to assume the next action state from the current action state, and at the same time refer to the learned normal range to assume the normal range of the assumed next action state, Therefore, at a time point after the time series data deviates from the normal range of the assumed next action state, it can be determined that the time series data is abnormal.

In addition, the degree of abnormality can be quantitatively or visually indicated by calculating the probability of the operation state and state transition, so that the decision of the user of the abnormality detection device 100 can be appropriately supported.

These advantages can also be obtained even when the user-defined abnormality detection device 100 uses the normal range for the state transition pattern and each action state in place of the learned hypothetical model D4.

Next, the hardware structure of the abnormality detection apparatus 100 will be described with reference to FIGS. 3A and 3B . As an example, as shown in FIG. 3A , the abnormality detection device 100 is implemented by, for example, a receiving interface 101 , an input/output interface 102 , and a processing loop 103 . The receiving interface 101 implements the receiving part 1 , the I/O interface 102 implements the interface part 5 , and the processing circuit 103 implements the time series data analysis part 2 , the data recording control part 3 , the memory part 4 , and the time series data matching part 6 . When the abnormality detection apparatus 100 is realized by such a hardware configuration, steps S1 to S9 of the flowchart of FIG. 8 and steps S21 to S23 of the flowchart of FIG. 10 to be described later are executed by the processing circuit 103 . The processing circuit 103 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmab1e Gate Array), or a combination of these. The functions of the time-series data analysis unit 2, the data recording control unit 3, the memory unit 4, and the time-series data matching unit 6 may be implemented by separate processing loops, or these functions may be combined into one processing circuit.

As another example, as shown in FIG. 3B , the abnormality detection device 100 is implemented by, for example, a receiving interface 101 , an I/O interface 102 , a processor 104 , and a memory 105 . The receiving interface 101 realizes the receiving unit 1 , and the input/output interface 102 realizes the interface unit 5 . Furthermore, the time-series data analysis unit 2, the data recording control unit 3, and the time-series data matching unit 6 are realized by the program stored in the memory 105 being read and executed by the processor 104. The memory unit 4 is realized by the memory 105 . When the abnormality detection apparatus 100 is realized by such a hardware configuration, steps S1 to S9 of the flowchart of FIG. 8 and steps S21 to S23 of the flowchart of FIG. 10 to be described later are executed by the processor 104 . Programs are implemented by software, firmware, or a combination of software and firmware. In the example of the memory 105, for example, it includes RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM (Erasable Programmable Read Only Memory), EEPROM (E1ectrica11y-EPR0M) and other non-volatile or Volatile semiconductor memory, magnetic disks, floppy disks, CDs, CDs, MDs, DVDs.

The functions of the time-series data analysis unit 2, the data recording control unit 3, the memory unit 4, and the time-series data matching unit 6 may be implemented as part of the processing loop, or may be implemented in cooperation with software or firmware. Part of the processor implementation. For example, the data recording control unit 3 is realized as a processing circuit, the time-series data analysis unit 2 and the time-series data matching unit 6 are realized by the processor 104 reading out the program stored in the memory 105 and executed, and the memory unit 4 is realized. Implemented with memory 105 . In this way, the functions of the time-series data analysis unit 2, the data recording control unit 3, the memory unit 4, and the time-series data matching unit 6 are performed by a processing circuit, a processor cooperating with software or firmware, or a combination of these. realized in combination.

2. Action Next, the operation of the abnormality detection device 100 and the abnormality detection system 1000 will be described with reference to FIG. 8 . FIG. 8 is a flowchart showing an abnormality detection process of the abnormality detection apparatus 100 in the first embodiment.

(step S1) In step S1 , the monitoring condition D5 is set by the user of the abnormality detection device 100 through the external device 200 . The abnormality detection device 100 acquires the monitoring conditions D5 set through the interface unit 5 from the external device 200 , and delivers the acquired monitoring conditions D5 to the time-series data matching unit 6 . The monitoring data acquisition unit 61 of the time-series data matching unit 6 determines the target device for abnormality detection based on the received monitoring condition D5. According to this determination, the abnormality detection device 100 obtains time-series data from the target device ODn for abnormality detection, and the feature value extraction unit 22 extracts the feature value of the detector value from the time-series data of the target device ODn to obtain The analysis result D3 is output to the record control unit, and the data record control unit 3 outputs the analysis result D3 to the memory unit.

(step S2) In step S2, the monitoring data acquisition unit 61 uses the analysis result D3 in the memory unit 4 calculated by the feature value extraction unit 22 and the learned hypothesis model D4 in the memory unit 4 to acquire the feature according to the monitoring condition D5 quantity.

(step S3) In step S3, the state transition assumption unit 63 calculates the transition probability for the analysis result D3 based on the monitoring condition D5 based on the feature quantity acquired by the monitoring data acquisition unit 61 in step S2.

(step S4) In step S4, the state transition assumption unit 63 calculates the degree of similarity of the waveforms with respect to the analysis result D3 based on the monitoring condition D5 based on the feature quantity acquired by the monitoring data acquisition unit 61 in step S2.

(step S5) In step S5, the abnormality detection unit 64 calculates the degree of abnormality of the conversion with respect to the analysis result D3 based on the monitoring condition D5 based on the conversion probability calculated in step S3.

(step S6) In step S6, the abnormality detection unit 64 calculates the degree of abnormality of the waveform with respect to the analysis result D3 based on the monitoring condition D5 based on the degree of similarity of the waveform calculated in step S4.

(step S7) In step S7, the abnormality detection unit 64 integrates the abnormality degree of the conversion and the abnormality degree of the waveform calculated in steps S5 and S6.

(step S8) In step S8, the abnormality detection unit 64 determines the presence or absence of abnormality with respect to the analysis result D3 based on the degree of abnormality integrated in step S7.

(step S9) In step S9 , the abnormality detection unit 64 outputs the determination result determined in step S8 , and the determination result is displayed on the external device 200 through the interface unit 5 .

＜Learning stage＞ FIG. 9 is a configuration diagram of a learning apparatus 300 for learning a hypothesis model used by the abnormality detection apparatus 100 . The learning apparatus 300 includes a learning data acquisition unit 301 and a model generation unit 302 .

(Data acquisition unit 301 for learning) The data acquisition unit 301 for learning acquires time-series data of the sensor value assigned to each sensor item related to the voltage, current, etc. of the target device, and learning data D11 of the feature value of each sensor item. Time series data can be the detected value of the detector itself, or the statistical value of the detected value (such as average, maximum, minimum), or the calculated value of the detected value of a complex detector (such as electricity) .

(Model generation unit 302 ) The model generation unit 302 learns, based on the learning data D11 acquired by the learning data acquisition unit 301 , a state transition pattern representing the method or sequence of transitions between the plurality of operation states acquired by the target device, and the time series in each operation state. Normal range of data.

In order to perform this learning, the model generation unit 302 analyzes the time-series data, and divides the time-series data (hereinafter, sometimes referred to as "waveforms") into complex waveforms (hereinafter, sometimes referred to as "waveforms") corresponding to complex operation states part of the waveform".). Here, the operation state means the state of the operation acquired by the target device when roughly classifying the operation of the target device. For example, if it is the action state of the actuator, it is the state of rising, continuous peak value, and falling of the current driving the actuator. In the analysis of time series data, for example, it is performed by obtaining event data representing abrupt changes in the waveform of the data. In detection of mutation points, for example, the Ramer-Douglas-Peucker (RDP) algorithm can be used. Further, methods such as autocorrelation or dynamic time warping (DTW), multivariate analysis such as principal component analysis or discriminant analysis, or hypothetical methods such as support vector machines (SVM) may be used.

In the learning of state transition patterns, event data representing mutation points of action states can also be obtained, and causal inference, multivariate analysis, and classification methods by machine learning such as CNN can also be used. In addition, the appearance sequence of the action states can also be visualized to prompt the user of the abnormality detection apparatus 100, and the user defines the state transition mode.

For example, to learn the mode of state transition, the model generation unit 302 first assigns motion state IDs (eg, A, B, C, D, etc.) for identifying motion states to the split waveforms. In the product manufacturing data, since the same or similar products are continuously manufactured, it is assumed that the shapes of the partial waveforms in the same operation are similar. Here, the assignment of action state IDs can be captured as a clustering problem. It is also thought that the order of the operations of the manufacturing machine is not fixed, but is based on a complex state transition pattern. Therefore, it is also possible to cluster in each operation state, that is, in the shape of each part of the waveform. Specifically, the k-means method, which is one of the methods of teacherless learning, can be used. By using this method, partial waveforms can be clustered in each similar shape, and the action state ID can be numbered in each similar shape.

In this way, with the action state IDs being numbered, the state transition pattern between plural action states and the probability of state transition from one action state to another action state can also be learned automatically.

Not only the action state ID, but also state transitions are learned, so that even if a part of the waveform indicating the action state of a certain part of the waveform is normal, it is possible to detect that the transition of the action state is abnormal, that is, take the action. The state itself is abnormal.

In the learning of the normal range of each action state, regression, or reliable intervals by Bayesian assumptions or statistical methods, state space models, 3σ methods, or methods by machine learning such as CNN can also be used. As an example, for the partial waveform of each action state obtained by splitting, the data distribution at each time is obtained, and the part where the probability of learning occurrence is more than α% (for example, α=1%) is in the normal range. As a result of the learning, it is also possible to learn that for all action states, the normal range becomes the part where the probability of occurrence is α=1% or more, and it is also possible to learn that for a certain action state, the normal range becomes the part where the probability of occurrence is α=1% or more, among which , for another action state, the normal range is the part where the probability of occurrence is α=2% or more. The distribution of data differs in each operating state. Therefore, even if the statistic is defined in the same normal range for each operating state, the physical quantity is also set within each operating state, and the range is set separately. In this way, the normal range is learned for each operation state, whereby a normal range can be set in which the characteristics of the operation corresponding to each operation state can be set, and abnormality can be detected with high accuracy.

For example, for a certain action state 1, the normal range is R1, and for another action state 2, the normal range is R2, and it is assumed that R1 is narrower than R2.

If the normal range is uniformly defined as R1 for both operation states, the operation state 1 can be properly determined to be abnormal, but the operation state 2 cannot be properly determined to be abnormal. This is because the normal range is set to be narrower than the original R2 for the operating state 2 (for the operating state 2, the normal range is too small). Therefore, the operation state 2 may be judged to be abnormal regardless of whether it is operating normally or not.

Conversely, when the normal range is uniformly defined as R2 for the same operation state, although the operation state 2 can be properly determined to be abnormal, the operation state 1 cannot be properly determined to be abnormal. This is because for the operation state 1, the range that is determined to be normal is set wider than the original R1 (for the operation state 1, the normal range is too large). Therefore, the operation state 1 may be judged to be normal regardless of whether it is operating abnormally or not.

In this way, when it is desired to uniformly set the normal range for the plural action states, a trade-off occurs between the normal range for one action state and the normal range for another action state, and for all the plural action states, the normal range is set. Scope is more difficult.

As shown in the first embodiment of the present invention, by learning the normal range individually for each of the plural operation states, such a trade-off can be solved, and the normal range can be appropriately set for all the plural operation states.

Furthermore, the learning device 300 is used to learn the learning model used by the abnormality detection device 100. However, for example, it may be connected to the abnormality detection device 100 through a network, and the abnormality detection device 100 may be separate from the abnormality detection device 100. device. Alternatively, the learning device 300 may be built in the abnormality detection device 100 .

The model generation unit 302 generates the learned hypothetical model D12 as the learning result of the state transition pattern (state transition pattern information) and the normal range (normal range information) of each action state by performing the above-mentioned learning, and outputs it to the abnormality The memory unit 4 of the detection device 100 .

(memory section 4) The memory unit 4 stores the learned hypothesis model D12 output from the model generation unit 302 .

Next, the learning process of the learning apparatus 300 is demonstrated using FIG. 10. FIG. FIG. 10 is a flowchart showing the learning process of the learning apparatus 300 .

(step S21) In step S21, the data acquisition unit 301 for learning acquires time-series data to which the sensor value of each sensor item related to the target device is assigned, and data D11 for learning of the feature value of each sensor item.

(step S22) In step S22, the model generation unit 302 analyzes the time-series data of the sensor values of each sensor item of the target device based on the learning data D11 acquired by the learning data acquisition unit 301, and splits the time-series data Reciprocally count the action states, learn the state transition pattern between the split action states, and the normal range of the time series data in each action state to generate a hypothetical model.

(step S23) In step S23, the memory unit 4 memorizes the learned hypothesis model D12 generated by the model generation unit 302.

<Variation> In the state transition assumption and abnormality detection, the time-series data matched by the time-series data matching unit 6 may be data acquired in real time or data acquired in the past. In addition, abnormality detection may be performed for all the time-series data of the acquired detector values.

＜Additional Notes＞ Hereinafter, the side surface of a part of the embodiment will be sorted out. (Note 1) An abnormality detection device (100) includes: a feature value extraction unit (22) that receives time-series data of a target device and extracts a feature value of the time-series data; a state transition assumption unit (63) that extracts features from the extracted features Quantity, specifying the operating state of the target device, while referring to the state transition pattern information that defines the state transition pattern between the plurality of operating states, and assuming the state transition of the target device from the extracted feature quantity; and the abnormality detection section ( 64), with reference to the normal range information after defining the normal range for the state transition pattern information and each action state, from the specified action state, the assumed state transition, and the extracted time-series data feature quantities , to determine whether the time series data is abnormal. (Supplement 2) The abnormality detection device of appendix 2, the abnormality detection device of appendix 1, wherein the state transition assumption unit calculates the state transition probability to make the assumption of the state transition. (Note 3) The abnormality detecting device of appendix 3 is the abnormality detecting device described in appendix 2, wherein the abnormality detecting part refers to the state transition mode information, and obtains the action state converted from the specified action state, when the assumed state When the state transition probability of the state transition is higher than the probability of transition to the acquired action state, it is determined that the assumed state transition is abnormal. (Note 4) The abnormality detection device of appendix 4 is the abnormality detection device described in any one of appendixes 1 to 3, wherein the abnormality detection unit refers to the normal range information to obtain the normal range in the specified operating state , when the waveform corresponding to the specified action state of the time-series data deviates from the normal range, the time-series data is regarded as waveform data and determined to be abnormal. (Note 5) The abnormality detection device of appendix 5 is the abnormality detection device of any one of appendixes 1 to 4, wherein the abnormality detection unit includes: a state transition deviation degree calculation unit (641), which calculates the deviation from the assumed The state transition deviation degree of the normal state transition of the state transition; an operation state deviation degree calculation unit (642), which calculates the operation state deviation degree from the normal range of the waveform of the time series data in the specified operation state; and a determination unit , according to the state transition deviation degree and the operating state deviation degree, to determine whether the target device is abnormal. (Supplement 6) The abnormality detection device of appendix 6 is the abnormality detection device of any one of appendixes 1 to 5, wherein the state transition pattern information and the normal range information are regarded as learned assumptions made by machine learning Information from the model. (Note 7) The abnormality detection device of appendix 7 is the abnormality detection device of appendix 6, further comprising a learning device (300) for learning the hypothetical model, the learning device including feature quantities from time-series data, and calculating each state transition A model generation unit (302) for the normal range of modes and operation states.

Furthermore, a combination or modification of the embodiment may be performed, and any structural portion may be omitted. [Possibilities of Industrial Use]

The abnormality detection device of the present invention can detect abnormality of time-series data, so, for example, it can be used as a preventive maintenance device in a production system of a factory, a system or device used in social infrastructure such as railways or stations, etc. It is used for monitoring equipment of economic indicators such as equipment for preventive maintenance and stock price.

1: Receiving Department 2: Time Series Data Analysis Department 3: Data Recording Control Department 4: Memory Department 5: Interface Department 6: Time Series Data Matching Section 21: Detector Item Checkout Department 22: Feature extraction part 23: Detector Item Classification Department 61: Monitoring data acquisition department 62: Processing Department 63: State Transition Assumption Department 64: Anomaly Detection Department 100: Abnormal detection device 101: Receive interface 102: I/O interface 103: Processing Loops 104: Processor 105: Memory 200: External device 300: Learning Devices 301: Data Acquisition Department for Learning 302: Model Generation Department 641: State transition deviation degree calculator 642: Operation state deviation degree calculator 643: Judgment Department 1000: Anomaly Detection System

[FIG. 1] is a block diagram showing the structure of the abnormality detection apparatus and the abnormality detection apparatus system of Embodiment 1. [FIG. [FIG. 2] is a block diagram showing the detailed structure of the abnormality detection apparatus of Embodiment 1. [FIG. 3A is a block diagram showing an example of the hardware configuration of the abnormality detection device according to the first embodiment. [FIG. 3B] is a block diagram showing another example of the hardware configuration of the abnormality detection device of Embodiment 1. [FIG. [FIG. 4A] is a diagram showing normalization of the entire time series data. [FIG. 4B] is a diagram showing an example of division of time-series data into each action state. [FIG. 4C] is a diagram showing normalization of time-series data in each operating state. [FIG. 4D] is a diagram showing an example of calculation of the mode of state transition. [FIG. 5A] is a diagram showing possible state transitions. [FIG. 5B] is a diagram showing Mode 1 included in possible state transitions. [FIG. 5C] is a diagram showing Mode 2 included in possible state transitions. [Fig. 6A] is a timetable of a certain time series data. [FIG. 6B] is a diagram showing the state probability of the action state of the time series data of FIG. 6A. [FIG. 6C] is a diagram showing the determination of the degree of abnormality of the time series data of FIG. 6A. [Fig. 7A] is a timetable of a certain time series data. [FIG. 7B] is a diagram showing the state probability of the action state of the time-series data of FIG. 7A. [ Fig. 7C ] is a diagram showing the determination of the degree of abnormality of the time-series data of Fig. 7A . [FIG. 8] is a flowchart of the abnormality detection process of the abnormality detection apparatus in Embodiment 1. [FIG. [Fig. 9] is a configuration diagram of a learning device for learning a hypothesis model used by the abnormality detection device of the first embodiment. [FIG. 10] is a flowchart showing the learning process of the learning apparatus.

1: Receiving Department

2: Time Series Data Analysis Department

3: Data Recording Control Department

4: Memory Department

5: Interface Department

6: Time Series Data Matching Section

21: Detector Item Checkout Department

22: Feature extraction part

23: Detector Item Classification Department

61: Monitoring data acquisition department

62: Processing Department

63: State Transition Assumption Department

64: Anomaly Detection Department

100: Abnormal detection device

641: State transition deviation degree calculator

642: Operation state deviation degree calculator

643: Judgment Department

D2: Target device information

D3: Analysis results

Claims (7)

An abnormality detection device, comprising: a feature extraction unit for receiving time-series data of the target device to extract the feature of the time-series data; The state transition assumption unit specifies the operation state of the object device from the extracted feature quantity, and at the same time refers to the state transition pattern information after defining the state transition pattern between the plurality of operation states, and assumes the object from the extracted characteristic quantity state transitions of the device; and The abnormality detection unit refers to the normal range information after defining the normal range for the state transition pattern information and each action state, so as to obtain the time series data from the specified action state, the assumed state transition, and the extracted time series data to determine whether the time series data is abnormal. The abnormality detection device of claim 1, wherein the state transition assumption unit performs the state transition assumption by calculating the state transition probability. The abnormality detection device of claim 2, wherein the abnormality detection section is referring to the state transition mode information to obtain the action state transitioned from the specified action state, When the state transition probability of the assumed state transition is higher than the probability of transitioning to the acquired action state, it is determined that the assumed state transition is abnormal. The abnormality detection device of claim 3, wherein the abnormality detection section is Refer to the normal range information to obtain the normal range in the specified action state, When the waveform of the time-series data corresponding to the specified action state deviates from the normal range, the time-series data is regarded as waveform data to be judged as abnormal. The abnormality detection device of claim 1, wherein the abnormality detection section comprises: a state transition deviation degree calculation unit, which calculates the state transition deviation degree of the normal state transition from the assumed state transition; an operation state deviation degree calculation unit, which calculates an operation state deviation degree from the normal range of the waveform of the time series data in the specified operation state; and The determination unit determines whether or not the target device is abnormal based on the state transition deviation degree and the operating state deviation degree. The abnormality detection device according to any one of claims 1 to 5, wherein the state transition pattern information and the normal range information are regarded as information obtained from a learned hypothetical model made by machine learning. The abnormality detection device of claim 6, further comprising a learning device for learning the hypothetical model, The learning apparatus includes a model generation unit that calculates the normal range of each state transition pattern and operation state from the feature quantity of the time series data.

Images