TWI824681B - Device management system, device failure cause estimation method, and memory medium for non-temporarily storing programs - Google Patents

Abstract

The present invention provides a technology that can accurately estimate the cause of a failure of a device used in combination with a computer. The device management system of the present invention is a device management system, and is characterized in that it includes: a log data acquisition mechanism to acquire logs, which are software action records related to the control of the device; and a cluster information extraction mechanism to obtain logs from the device. Cluster information and inter-cluster transition information are extracted from the set of acquired logs. The cluster information is information indicating the content of each step of the operation of the device, and the inter-cluster transition information is the relationship between one step and another. information related to the transition between the steps; an abnormality degree calculation unit that calculates the abnormality degree of each of the extracted transition information between clusters; and an obstacle cause estimation unit that is based on the abnormality degree calculation unit calculated by the abnormality degree calculation unit The degree of abnormality is used to estimate the cause of the device failure.

Description

Device management system, device failure cause estimation method, and memory medium for non-temporarily storing programs

The present invention relates to a device management system, a device failure cause estimation method and a program.

Regarding the maintenance work of industrial equipment (or equipment), when an obstacle occurs such as a stoppage of the operation of the equipment or a decrease in performance, the cause is analyzed. In addition, the analysis of the cause of such a failure usually involves the operator (operator) cross-referencing the action records (logs) of the software and the operating status of the mechanical parts of the device (various sensor measurement values, motor speed, etc.) On the one hand, various information such as the operating status of the control device (computer) (Central Processing Unit (CPU) usage, memory usage, network transmission and reception volume, substrate temperature, etc.) are analyzed.

However, such a method of analyzing various information by comparing it imposes a heavy burden on the operator, and the analysis results are greatly affected by personal experience and knowledge.

In response to this problem, various methods related to the efficiency of maintenance work including automation have been proposed in recent years. For example, efforts are being made to accumulate data on the status of devices to contribute to the automation of failure countermeasures. Especially in a device that repeatedly performs a certain simple operation, it is effective to detect abnormal values or change points (so-called deviation values) by learning the signal data obtained from the sensor, and to propose the cause of the failure using this information. speculation or failure prediction (for example, non-patent document 1, etc.).

However, for devices such as inspection devices and processing machines that are combined with a control device (computer) to perform complex operations, it is difficult to obtain sufficient results using conventional techniques using simple data. In view of the above, research has been conducted in recent years to utilize a large amount of data acquired from a large number of sensors using methods such as deep learning (for example, Non-Patent Document 2, etc.).

Furthermore, it is also proposed to use text data such as software logs and maintenance records of the control device instead of sensor data, and to use these as objects to learn and estimate the optimal timing of maintenance (for example, Non-Patent Document 3, etc.). [Prior art documents] [Non-patent literature]

[Non-patent document 1] Ferreiro, S., Konde, E., Fernandez, S. and Prado, A. A.), 2016, Industry 4.0: predictive intelligent maintenance for production equipment, European Conference of the Prognostics and Health Management Society, no (pp .1-8), researchgate.net. [Non-patent document 2] Ademujimi, T.T., Brundage, M.P., and Prabhu, V.V., 2017, Application of current machine learning technology in manufacturing diagnosis A Review of Current Machine Learning Techniques Used in Manufacturing Diagnosis, Advances in Production Management Systems, The Path to Intelligent, Collaborative and Sustainable Manufacturing ( pp.407-415), Springer International Publishing. [Non-patent document 3] Patil, R.B., Patil, M.A., Ravi, V., and Naik, S. , 2017, Predictive modeling for corrective maintenance of imaging devices from machine logs, Conference Proceedings:... IEEE Annual International Conference on Engineering in Medicine and Biology ( Conference proceedings: ...Annual International Conference of the IEEE Engineering in Medicine and Biology Society), IEEE Engineering in Medicine and Biology Society, Conference, 2017, 1676-1679, ieeexplore. ieee.org.

[Problem to be solved by the invention] However, in order to estimate the cause of failure of a relatively complex device combined with a computer, the conventional method of using only sensor data has the following problem: it cannot deal with malfunctions that occur in conjunction with the operation of the software. Furthermore, even if a method is used to analyze textual data such as software logs or maintenance records, there is a problem that although known obstacles or deterioration states can be recorded and learned for analysis, unknown or unexpected conditions cannot be analyzed. obstacles make it difficult to learn, unable to cope with such obstacles, etc.

The present invention was made in view of the above-mentioned actual situation, and an object thereof is to provide a technology that can accurately estimate the cause of a failure of a device used in combination with a computer. [Means to solve the problem]

In order to achieve the above object, the present invention adopts the following structure. Right now, A device management system is a device management system, which is characterized by including: A log data acquisition mechanism acquires logs, which are software action records related to the control of the device; A cluster information extraction mechanism extracts cluster information and inter-cluster transition information from the set of acquired logs. The cluster information is information representing the content of each step of the operation of the device, and the inter-cluster transition information is and information about the transition between one said step and another; An abnormality degree calculation mechanism calculates the abnormality degree of the transition information between each of the extracted clusters; and The failure cause estimation unit estimates the failure cause of the device based on the abnormality degree calculated by the abnormality degree calculation unit.

According to this structure, for a device where a malfunction has occurred, the degree of abnormality can be calculated for each small behavior related to the operation of the device, and the cause of the malfunction can be estimated based on the degree of abnormality. Therefore, even for unknown (or unexpected) ) cause of the disorder, it can also be inferred to be the cause of the disorder.

Furthermore, the abnormality degree calculation unit may also calculate the abnormality degree of each of the extracted inter-cluster transition information based on the inter-cluster transition information when the device is normal. With such a structure, it is possible to calculate the degree of abnormality when a malfunction occurs based only on the data during normal operation of the device without using the learning data when the device is in trouble. Therefore, it is possible to analyze a variety of devices from simple-structured devices to complex devices. Object applies.

Furthermore, the inter-cluster transition information may also include information related to the occurrence frequency of transitions between multiple steps of the device, and the device management system further includes: an inter-cluster transition information evaluation mechanism, The extracted transition information between clusters is weighted based on the frequency of occurrence, and the abnormality degree calculation unit calculates the abnormality degree using the weighted information. By including a mechanism for weighting based on the occurrence frequency of transitions between steps in this manner, the degree of abnormality can be calculated efficiently and accurately.

Moreover, it may further include: a hardware information acquisition mechanism that acquires hardware information related to the status of the hardware of the device, and the inter-cluster transition information evaluation mechanism is based on the hardware information acquired by the hardware information acquisition mechanism. volume information, further weighting the extracted transition information between each of the clusters.

Here, the so-called hardware information refers to various sensor data and information related to the operation and status of the hardware of the device obtained from the sensor data. In this way, by further weighting using hardware information, the abnormality degree can be calculated with higher accuracy.

Furthermore, the failure cause estimation unit may also infer that the device exists in the step specified by the inter-cluster transition information in which the abnormality degree calculated by the abnormality degree calculation unit satisfies a predetermined condition. causes of obstacles. Specifically, the predetermined condition may be, for example, a situation in which a predetermined threshold value is exceeded. In this case, the threshold value can be preset by the user, or can be set automatically by learning based on the operating performance of the device. By setting in this way, the cause of device failure can be estimated efficiently.

Furthermore, the device management system may further include a display unit capable of displaying the abnormality degree calculated by the abnormality degree calculation unit and/or the failure cause estimated by the failure cause estimating unit. information. According to this structure, the user can easily confirm the presumed cause of the failure.

Moreover, the device management system may further include: a directed graph generating mechanism that uses the cluster information as nodes and the inter-cluster transition information as edges to generate a graph representing the cluster information and the inter-cluster transition information. A directed graph of a relationship, and the display mechanism can display the directed graph.

According to this structure, the user can confirm the operation of the software related to the control of the device in the form of a directed graph, and the information can be flexibly used for the management and maintenance of the device.

Furthermore, the inter-cluster transition information may be weighted by increasing the importance of the evaluation by a predetermined method, and the directed graph generating unit generates the weighted, Directed graph. Furthermore, the weighting method here is not particularly limited. For example, as described above, it can be weighting based on the occurrence frequency of transitions between clusters, corresponding hardware information (sensor data), etc. According to this structure, users can confirm that the weighted directed graph is reflected, so they can obtain more detailed information from the directed graph.

Furthermore, the directed graph generating unit may also generate a directed graph that visually expresses the weighting by displaying the weighted value representing the transition information between clusters near the edge. .

Furthermore, the directed graph generating means may also display by setting a difference in sharpness of the edges representing transition information between each of the clusters, thereby generating a directed graph that visually expresses the weighting. . Here, setting a difference in definition may be, for example, thickening the thickness of the edge line in accordance with the weight, or increasing the brightness or lightness of the edge line in accordance with the weight.

Moreover, the cluster information may also include words that are text information extracted from the log, and the directed graph generating unit may arrange the words included in each of the cluster information in descending order of the number of occurrences. Predetermined numbers are sequentially extracted, and the directed graph using the extracted words as information representing the content of the cluster information is generated. With this structure, the user can easily grasp the contents of each node of the directed graph based on words.

Moreover, the device management system may further include: extracting a log display image generating unit to extract, from the collection of logs, a log corresponding to the inter-cluster transition information that satisfies a predetermined condition as a representation of the inter-cluster transition information that satisfies the predetermined condition. Information on the content of the transition information between clusters according to the condition, and generating an extraction log display image representing the content of the extracted log, and the display mechanism can display the extraction log display image.

Furthermore, the so-called "satisfying the predetermined conditions" mentioned here can be set to a situation where the anomaly degree exceeds a predetermined value, a situation where the user selects an edge of the directed graph corresponding to the transition information between clusters, etc. With this structure, the user can quickly confirm the log corresponding to the inter-cluster transition information.

Furthermore, the extraction log display image may be pop-up displayed near the edge indicating the inter-cluster transition information corresponding to the extraction log shown in the display image. With such a display, it is possible to easily grasp the relationship between the extracted log display image displayed in a pop-up manner and the edge indicating the corresponding transition information between clusters. Furthermore, the display location of the extracted log display image is not particularly limited, and a specific display area may be provided regardless of the pop-up display.

Furthermore, the present invention can also be applied as a method for estimating the cause of failure of the device. The method for estimating the cause of failure of the device is a method of estimating the cause of the failure of the device and includes: The log data acquisition step is to acquire logs, which are software action history information related to the control of the device; A cluster information extraction step is to extract cluster information and inter-cluster transition information from the acquired set of logs, where the cluster information is information representing the contents of each step of processing performed by the device, and the inter-cluster transition information The information is information related to transitions between a plurality of said steps of said device; An abnormality degree calculation step is to calculate the abnormality degree of the transition information between each of the extracted clusters; and The failure cause estimation step estimates the failure cause of the device based on the abnormality degree calculated in the abnormality degree calculation step.

Moreover, the present invention can also be understood as a program for causing a computer to execute the method, and a computer-readable recording medium in which such a program is non-temporarily recorded.

Furthermore, the structures and processes described above can be combined with each other to form the present invention as long as there is no technical contradiction. [Effects of the invention]

According to the present invention, it is possible to provide a technology that can accurately estimate the cause of a failure of a device used in combination with an information processing device.

Hereinafter, embodiments of the present invention will be described based on the drawings. However, the dimensions, materials, shapes, relative arrangements, etc. of the structural elements described in the following examples do not mean that the scope of the present invention is limited to these unless otherwise specified.

＜Application examples＞ (Structure of applicable examples) For example, the present invention can be applied to a management system for an appearance inspection device that inspects an inspection object by processing an image obtained by photographing the inspection object using a camera mechanism. FIG. 1 is a schematic diagram showing an outline of the device management system 1 of this application example.

The device management system 1 includes an information processing terminal 100 and an appearance inspection device 120 . The information processing terminal 100 may be integrated with the appearance inspection device 120 , or may be a separate device communicably connected to the appearance inspection device 120 , and may include, for example, a general-purpose computer. Furthermore, the information processing terminal 100 may include a single computer or multiple computers that cooperate with each other. The appearance inspection device 120 is, for example, a device that automatically inspects an inspection object such as a component mounting substrate by photographing the inspection object and performing image processing.

The information processing terminal 100 includes a log data acquisition unit 101, a cluster information extraction unit 102, an inter-cluster transition information evaluation unit 103, a directed graph generation unit 104, a reference data generation unit 105, anomaly degree calculation unit 106, and a failure cause estimation unit 107. Each functional unit of the display unit 108 and the memory unit 109. In addition, although not shown in the figure, it may also include various input mechanisms such as a mouse or a keyboard, communication mechanisms, etc.

The appearance inspection device 120 has a structure including the following parts: a conveyor 124 that transports the inspection object O to an imaging position; a camera 121 that photographs the inspection object O; and an X stage 122 and a Y stage 123 that move the camera 121 in the horizontal direction. Move. Furthermore, although not shown in the figure, the appearance inspection device 120 includes an image processing unit that processes a captured image, an inspection processing unit that performs inspection based on the image, an output processing unit that outputs inspection results, and the like.

(Method for estimating the cause of obstacles) The device management system 1 of this application example prepares in advance reference data obtained by learning (modeling) using a plurality of data during normal operation of the visual inspection device 120 , and when a failure occurs in the visual inspection device 120 , based on the Baseline data are used to infer the cause of the disorder.

Specifically, first, the log data acquisition unit 101 acquires a software log (hereinafter also simply referred to as a log) related to control during normal operation of the appearance inspection device 120 . The log is configured in the form of text information as shown in FIG. 2 , and by processing the text information with the cluster information extraction unit 102 , cluster information indicating the contents of each step of the operation of the appearance inspection device 120 is extracted. Furthermore, inter-cluster transition information is extracted, and the inter-cluster transition information is information related to the transition between one step and another step in the operation of the visual inspection device 120 .

Furthermore, the directed graph generating unit 104 creates a directed graph representing the relationship between the extracted cluster information and the transition information between clusters. The above process is repeated as many times as necessary to create the reference data, and a plurality of directed graphs are obtained. Furthermore, the reference data generation unit 105 replaces the plurality of acquired directed graphs with matrix representation, calculates the average and dispersion of each element of the matrix, and stores it as the reference data.

In addition, when a failure occurs in the visual inspection device 120, a log related to the control when the failure occurs is acquired, a directed graph is created through the same process as when creating the reference data, and the log is converted into a matrix representation. Next, the abnormality degree calculation unit 106 compares each element of the acquired matrix data when the obstacle occurs with each element of the matrix of the reference data, and calculates an abnormality degree indicating the magnitude of the deviation from the reference data for each element. Next, the failure cause estimating unit 107 considers that a step (or a transition between steps) corresponding to an element whose abnormality degree is equal to or higher than a predetermined threshold value is highly likely to be a cause of a failure, and estimates the step as a cause of the failure.

As described above, the device management system 1 of this application example can create the reference data based only on the data during normal operation, and can estimate the cause of the failure by comparing the data when the failure occurs with the reference data. This makes it possible to predict the cause of unknown obstacles with high accuracy.

<Embodiment 1> Next, the embodiment of the present invention will be described in more detail based on FIGS. 1 to 9 . First, the functional units included in the information processing terminal 100 of the device management system 1 of this embodiment will be described.

(Function of information processing terminal) The log data acquisition unit 101 acquires logs that are software operation records related to the control of the appearance inspection device 120 . The cluster information extraction unit 102 extracts cluster information and inter-cluster transition information, which are information indicating the contents of each step of the operation of the appearance inspection device 120, from the acquired set of logs. The inter-cluster transition information is and Information about the transition between one step and another.

Furthermore, the inter-cluster transition information includes information on the occurrence frequency of transitions between the steps of the appearance inspection device 120 , and the inter-cluster transition information evaluation unit 103 at least uses the information on the occurrence frequency to perform the extraction. The weighting of transition information between each cluster.

Furthermore, the directed graph generating unit 104 uses the extracted cluster information as nodes and the inter-cluster transition information as edges to generate a directed graph representing the relationship between each cluster information and the inter-cluster transition information. The reference data generation unit 105 generates reference data, and this reference data becomes a reference for estimating the cause of the failure. Specifically, a plurality of directed graphs obtained by sampling a plurality of log data during normal operation of the visual inspection device 120 are replaced with a matrix representation, and the average and dispersion are calculated for each element of the matrix, and this is used as the reference data. Saved in the memory unit 109.

The abnormality degree calculation unit 106 replaces the directed graph generated based on the log data when the obstacle occurs with a matrix representation, and compares each element of the matrix with the reference data, thereby calculating for each element the relationship between the representation and the reference data. The degree of abnormality in the size of the deviation. Each element of the matrix corresponds to the transition information between each cluster extracted from the log, so the anomaly degree of each element of the matrix becomes the anomaly degree of the corresponding transition information between clusters.

The failure cause estimating unit 107 considers that the step shown in the software log corresponding to the inter-cluster transition information in which the calculated abnormality degree is equal to or higher than a predetermined threshold value is highly likely to be the cause of the failure, and infers the step as the cause of the failure.

The display unit 108 is an image display device such as a liquid crystal display, and displays various information including the directed graph, the estimated cause of the failure, the abnormality degree of the transition information between clusters, and the like. The memory unit 109 may include, for example, a main memory unit such as a read-only memory (Read Only Memory, ROM), a random access memory (Random Access Memory, RAM), and an erasable programmable read-only memory (Erasable Programmable Read Only memory). Memory, EPROM), hard disk drive (Hard Disc Drive, HDD), removable media (removable media) and other auxiliary memory parts.

In the auxiliary memory unit, in addition to the operating system (OS) and various programs, various information such as the reference data, operation performance or maintenance records of the management target device can be stored. Furthermore, by downloading the program stored in the auxiliary memory unit to the work area of the main memory unit and executing it, each structural unit, etc. is controlled by the execution of the program, thereby realizing the functional unit that achieves the predetermined purpose as described above. Furthermore, some or all of the functions can also be implemented by hardware circuits such as Application Specific Integrated Circuit (ASIC) or Field Programmable Gate Array (FPGA).

(Process for estimating the cause of obstacles) Next, the flow of the trouble cause estimation process of the visual inspection device 120 of the device management system 1 of this embodiment will be described. FIG. 3 is a flowchart showing an example of failure cause estimation processing of the device management system 1 . As shown in FIG. 3 , the device management system 1 first generates reference data based on the data acquired from the visual inspection device 120 during normal operation ( S101 ).

Here, the reference data generation process of step S101 will be described in detail with reference to FIG. 4 . FIG. 4 is a flowchart showing the flow of a sub-route of the reference data generation process in this embodiment. As shown in FIG. 4 , first, the log data acquisition unit 101 acquires log data during normal operation (S201). Next, the cluster information extraction unit 102 performs processing of separating log information based on predetermined rules (S202). FIG. 5 shows an explanatory diagram related to such log information separation processing. As shown in FIG. 5 , each line of the log data includes a time data part indicating the time and a message string. The cluster information extraction unit 102 decomposes the log into time data and a message string in units of one line. Here, the message string is further processed by deleting numbers and symbols and decomposing it into word units.

Next, the cluster information extraction unit 102 vectorizes the word sets of each line of the log using the TF-IDF method, for example. TF-IDF is a well-known method, so detailed explanation is omitted. It is a method of calculating the importance of words based on two indicators: word frequency (Term Frequency, TF) and inverse document frequency (Inverse Document Frequency, IDF). .

The cluster information extraction unit 102 further clusters the vector sets of all rows into, for example, 200 clusters as shown in FIG. 6 using, for example, the K-mean method (S203). FIG. 6 is an explanatory diagram illustrating clustered log lines. In addition, the K-mean method is a well-known clustering method, so a detailed explanation is omitted.

Next, as shown in FIG. 7 , the cluster information extraction unit 102 generates a log cluster sequence in which the cluster numbers are consecutively numbered based on the time at which each log line is output. By arranging the cluster numbers in time sequence in this way, information related to the transition between clusters can be obtained. That is, the cluster information indicating the contents of each step of the operation of the visual inspection device 120 obtained from the text messages (words) of the log in this way, and the cluster as information about the transition of one cluster (step) to another cluster can be extracted. transition information. That is, in this embodiment, the processing of steps S202 and S203 corresponds to the cluster information extraction step.

Next, the directed graph generation unit 104 creates a directed graph using each cluster information as a node and inter-cluster transition information as an edge (S204). At this time, the cluster number of the corresponding cluster can also be displayed on each node.

Next, the inter-cluster transition information evaluation unit 103 weights each edge of the directed graph based on the transition frequency between nodes of the directed graph (that is, between corresponding clusters) (S205). 8A and 8B show explanatory diagrams explaining the weighting performed in S205. FIG. 8A is a diagram in which cluster numbers of clusters corresponding to each log line are arranged in time sequence from left to right based on the time at which the log line is output. FIG. 8B is a diagram showing a directed graph reflecting weighting. Numerical values are recorded near the edges of the directed graph in FIG. 8B , and these numbers represent the frequency of occurrence of the edges (that is, transitions between clusters). Referring to FIG. 8A , the transition from cluster number 2 to cluster number 2 occurs twice, the transition from cluster number 2 to cluster number 0 occurs twice, the transition from cluster number 0 to cluster number 6 occurs three times, and the transition from cluster number 2 to cluster number 6 occurs three times. The transition from 6 to cluster number 0 occurs once, and the transition from cluster number 6 to cluster number 2 occurs once. In addition, in the directed graph of FIG. 8B , the number of transitions is displayed near the edge, and the thickness of the edge is displayed thicker in accordance with the frequency of transition occurrence.

By performing the processing from step S201 to step S205 in this way, a series of processing of log data during normal operation is completed. FIG. 9 shows an example of a directed graph generated at the end of a series of processing of log data during normal operation.

Next, the reference data generation unit 105 performs a process of determining whether a predetermined number (for example, 100 pieces) of the weighted directed graphs as described above have been acquired for generating the reference data (S206). Here, when the predetermined amount of directed graph data is not obtained, the process returns to step S201 to obtain new log data during normal operation and repeat the subsequent processing.

On the other hand, if it is determined in step S206 that the predetermined number of directed graph data has been acquired, the process proceeds to step S207, and the reference data generating unit 105 converts all the acquired directed graphs into matrix representations. Specifically, as shown in the following equation (1), processing is performed to convert into an edge weight matrix W in which the weight of an edge transitioning from one node to another node in the directed graph is Each element. When the number of clusters is set to 200 as in the above example, the edge weight matrix W becomes a 200×200 matrix. [Number 1]

Here, the element W ₀₀ of the matrix represents the weight of the edge (that is, the transition information between clusters) from node 0 (hereinafter also referred to as node 0) indicating cluster number 0 to node 0, and W _n0 represents the self-node The weight of the edge transitioning from n to node 0. That is, W _ij represents the weight of the edge transitioning from node i to node j.

After completing the process of replacing all directed graphs with the matrix representation, the reference data generation unit 105 performs a process of calculating the average and dispersion of each element of the matrix (S208). For example, when 100 pieces of data during normal operation are used, an average weight matrix representing the average of the 100 pieces and a dispersion weight matrix indicating the dispersion of the 100 pieces are calculated as a result of integrating the 100 pieces of matrix data. as baseline data (S209). In the following, each element of the average weight matrix is described as μ _ij representing the average of 100 items W _ij , and each element of the dispersion weight matrix is described as σ _ij representing the dispersion of 100 items W _ij .

In this way, when the process of step S209 ends, the series of sub-paths of the reference data generation process (S101) ends. Returning the description to the flowchart showing the failure cause estimation process in FIG. 3 , when the process of step S101 is completed, the reference data generation unit 105 stores the generated reference data in the storage unit 109 ( S102 ).

Next, when a failure occurs in the appearance inspection device 120, the log data acquisition unit 101 acquires the log data when the failure occurs (S103). Then, the following series of processes are executed, namely: extracting cluster information from the log data when the obstacle occurs, generating a weighted directed graph based on it, and obtaining data obtained by matrix transformation of the directed graph (S104 ). The specific processing content performed in step S104 is the same as the processing performed in steps S202 to S205 and step S207. Therefore, description here is omitted.

Next, the abnormality degree calculation unit 106 compares the matrix data when the obstacle occurs acquired in step S104 with the reference data, thereby calculating the abnormality degree a _ij for each matrix element when the obstacle occurs (S105). Specifically, the degree of abnormality is calculated based on the following equation (2). [Number 2]

Next, the failure cause estimating unit 107 estimates a matrix element with an abnormality degree that satisfies a predetermined condition (for example, exceeds a threshold value, etc.) as a cause of the failure ( S106 ). Then, for example, when it is inferred that the matrix element W _ij is the cause of the obstacle, since the matrix element W _ij has the cluster information of the node i and the cluster information of the node j, the cluster information (or the corresponding log line) is used as Information indicating the estimated cause of the failure is displayed on the display unit 108 (S107).

As above, the series of procedures for guessing and handling the cause of the failure is completed. Furthermore, the processes of steps S101 and S102 do not need to be executed every time the cause of the failure is estimated. The reference data may be created once and saved, and then the process of estimating the cause of the failure may be started from the process of step S103. Of course, the processing of step S101 and step S102 can also be performed appropriately, and the reference data can be updated as necessary.

According to the above-described device management system 1, reference data is created based only on data during normal operation, and by comparing data when a failure occurs with the reference data, the abnormality degree of elements representing each step can be calculated and the failure can be estimated. causes. This makes it possible to predict the cause of unknown obstacles with high accuracy. Furthermore, by weighting using the occurrence frequency of transitions between clusters, the degree of abnormality can be appropriately calculated for matters of high importance.

(Modification 1) Furthermore, in the above-mentioned Embodiment 1, the cluster information which is the information indicating the estimated cause of the failure is displayed on the display unit 108. However, various types of information may be displayed on the display unit 108. 10A and 10B are diagrams showing a directed graph as an example of information displayed on the display unit 108. FIG. 10A shows a general directed graph in which each node displays a corresponding cluster number. FIG. 10B is a diagram showing a modified display example of a directed graph. The directed graph generation unit 104 may also extract words included in the cluster information corresponding to each node in descending order of occurrence, and generate a graph using the extracted words as content representing the cluster corresponding to each node. A directed graph of information (see FIG. 10B ) is displayed on the display unit 108 . This allows the user to easily grasp the contents of each node of the directed graph based on words.

(Modification 2) FIG. 11 is a schematic diagram showing the schematic structure of the device management system 2 according to yet another modification of the first embodiment. In addition, in the following, the same structures and processes as those described in the above embodiments are denoted by the same reference numerals, and repeated descriptions are omitted. As shown in FIG. 11 , the device management system 2 of this modified example includes an extraction log display image generating unit 201 in the information processing terminal 200. This aspect is different from the device management system 1 of the first embodiment, but is the same in other aspects.

The extracted log display image generating unit 201 extracts logs corresponding to edges that satisfy predetermined conditions from the set of logs as information indicating the contents of edges (inter-cluster transition information) that satisfy the predetermined conditions, and generates information indicating the contents of the edges that satisfy the predetermined conditions. An extracted log display image showing the contents of the extracted log is displayed on the display unit 108 . FIG. 12 shows an example of a display screen in which the extraction log display image related to the edge content is pop-up displayed near the edge of the directed graph.

Furthermore, the so-called "satisfying the predetermined conditions" mentioned here can be set to the situation where the anomaly degree exceeds the predetermined value and the user selects the transition information between clusters of the directed graph through mouse operation or the like. Edge cases, etc. Furthermore, the extracted log display image is not limited to the edges of the directed graph, and can be displayed in any manner. It can also be set as a user interface with a dedicated display area on the screen. With the structure of this modification, the user can quickly check the log corresponding to the transition information between clusters.

<Embodiment 2> Next, another embodiment of the present invention will be described based on FIGS. 13 to 17 . FIG. 13 is a schematic diagram showing the schematic structure of the device management system 3 of this embodiment. As shown in FIG. 13 , the device management system 3 of this embodiment is different from the device management system 1 in that the information processing terminal 300 includes a sensor data acquisition unit 301 . Furthermore, as will be described later, the inter-cluster transition information evaluation unit 303 of this embodiment is different from the inter-cluster transition information evaluation unit 103 of the first embodiment in that it performs partially different processing. Other points are the same as the device management system 1 of the first embodiment.

The sensor data acquisition unit 301 acquires sensor data that detects the status of the hardware of the appearance inspection device 120 (for example, the conveyor 124, the camera 121, the X stage 122, the Y stage 123, the output device, etc.). The sensor data is time-series numerical data that records the status of the hardware, and is obtained from various sensors, motors, position control systems and other devices included in the appearance inspection device 120 . Whether the sensor data is recorded in text form or binary form depends on the specifications of the device, and it can be in any form as long as the correspondence between time and value can be obtained. Furthermore, in this embodiment, various sensors, the sensor data acquisition unit 301, etc. are equivalent to the hardware information acquisition mechanism.

Regarding the automatic inspection process performed by the appearance inspection device 120, the process for one inspection object roughly includes six processes. Specifically, the process is divided into loading of the inspection object O, photographing of the inspection object O, image processing, good or bad judgment, inspection result output, and unloading of the inspection object O. In addition, the actions of the hardware in each process are different, and the length or number of repetitions of each process is also different. Therefore, the sensor data that records the status of the hardware also changes significantly depending on the object. That is, it can be said that it is not easy to estimate the cause of a device failure by learning the operation of the hardware (sensor data indicating the operation).

Next, the flow of the trouble cause estimation process of the visual inspection device 120 of the device management system 3 of this embodiment will be described. FIG. 14 is a flowchart showing an example of the failure cause estimation process of the device management system 3 . As shown in FIG. 14 , the overall flow is substantially the same as that in the case of Embodiment 1.

The device management system 3 of this embodiment first generates reference data based on the data acquired from the visual inspection device 120 during normal operation (S301). Here, the sub-path of step S301 will be described based on FIG. 15 . FIG. 15 is a flowchart showing the flow of a sub-route of the reference data generation process in this embodiment.

As shown in FIG. 15 , the sub-path when generating the reference data in this embodiment is also substantially the same as in Embodiment 1, and the same processing as in Embodiment 1 is performed from step S201 to step S205. That is, log data during normal operation is acquired (S201), the log information is separated (S202), the separated log information is clustered (S203), and a directed graph is generated using the clustered data (S204). ), perform edge weighting based on the occurrence frequency of transition between clusters (S205).

In this embodiment, as a subsequent step, the sensor data acquisition unit 301 acquires sensor data during normal operation of the appearance inspection device 120 (S401). Furthermore, the inter-cluster transition information evaluation unit 303 further weights the edges of the directed graph based on the sensor data acquired in step S401 (S402).

Specifically, the inter-cluster transition information evaluation unit 303 uses a change point detection (Change-Finder) algorithm to convert the sensor data (time series numerical data) acquired from the hardware into data that represents the magnitude of the change at each time in a time series. (change score). FIG. 16 shows an explanatory diagram illustrating the relationship between sensor data and change scores. In addition, the Change-Finder algorithm is a well-known method, so a detailed description is omitted.

In this case, as shown in FIG. 16 , the numerical range of the sensor data that is the basis of the change score differs depending on the target hardware, etc., so the change score also reflects this difference and the numerical range is not uniform. Therefore, all change scores are normalized between 0 and 1.

Next, the inter-cluster transition information evaluation unit 303 maps the change score to the log cluster sequence (see FIG. 7 ) generated by the cluster information extraction unit 102 and associates which cluster has a larger change score during transition. An example of mapping log cluster sequences with change scores is shown in Figure 17 .

Then, the inter-cluster transition information evaluation unit 303 weights each edge of the directed graph based on the hardware information by reflecting the magnitude of the change score of each edge (transition between clusters) of the directed graph.

In this way, when the processing of step S402 is completed, the process proceeds to step S206. The subsequent processing of the sub-path of the reference data generation processing (S301) is the same as that described in Embodiment 1, so the description here is omitted.

Returning the description to the flowchart showing the failure cause estimation process in FIG. 14 , when the process of step S301 is completed, the reference data generation unit 105 stores the generated reference data in the storage unit 109 ( S102 ). Next, when a failure occurs in the appearance inspection device 120 , the log data acquisition unit 101 obtains the log data when the failure occurs ( S103 ), and the sensor data acquisition unit 301 obtains sensor data indicating the hardware state when the failure occurs ( S302 ).

Then, the following series of processes are executed in the information processing terminal 300, that is, cluster information is extracted from the log data when the obstacle occurs, a weighted directed graph is generated based on it, and then the directed graph is Based on the weighting of the sensor data, the data obtained by matrix transformation of the directed graph is obtained (S303). Furthermore, the specific processing content performed in step S303 is the same as the processing performed in steps S202 to S205, step S402 and step S207 of the sub-path of step S301. Therefore, repeated explanations are omitted.

In addition, the content of the processing from step S105 onwards in this embodiment is also the same as that in Embodiment 1, so the description here is omitted.

According to the device management system 3 of this embodiment, the sensor data indicating the hardware status of the appearance inspection device 120 can be used to further weight the edges of the directed graph (that is, the transition information between clusters). A directed graph weighted only by the occurrence frequency of transitions between clusters has the possibility of classifying important (low frequency) corresponding to switching of processes of the visual inspection device 120 or changes in hardware status. Inter-cluster transition information is undervalued. On the other hand, in the device management system 3 of this embodiment, important change points of the sensor data are detected, and edges are further weighted based on them. Therefore, important inter-cluster transition information can be suppressed from being under-evaluated, thereby obtaining More accurate predictions of the cause of the disorder.

＜Others＞ Each of the above-described embodiments is merely an illustrative description of the present invention, and the present invention is not limited to the specific embodiments. The present invention can be subjected to various modifications and combinations within the scope of its technical thought. For example, in the above-mentioned embodiment, the management system targeted at appearance inspection devices has been described, but the devices to be managed by the device management system are not limited to this. As mentioned above, the cause of the failure can be estimated using only the actual operation line of the device, instead of using abnormal data when the failure occurs. Instead, the reference data obtained by learning using only the data during normal operation is used. Therefore, the present invention can be applied to various devices.

Furthermore, as the data during normal operation, the object processed by the device (object of inspection or processing) is not limited to one. It is possible to collect data when processing multiple objects and mix them to generate reference data. . In this case, there is no need for data such as when and how the object changed, and the reference data can be generated only from software logs and sensor data.

Furthermore, in the above-described embodiment, it is assumed that the system includes the device to be managed, but only the information processing terminal in the above-described embodiment may be understood as the management system of the present invention. That is, the present invention can also be understood as a device management terminal including an information processing terminal configured separately from the device to be managed.

＜Note 1＞ A device management system is a device management system (1, 2, 3), which is characterized by including: The log data acquisition mechanism (101) acquires logs, which are software action records related to the control of the device; A cluster information extraction mechanism (102) extracts cluster information and inter-cluster transition information from the set of acquired logs. The cluster information is information representing the content of each step of the operation of the device. The inter-cluster transition information the information is information relating to the transition between one said step and another said step; An abnormality degree calculation mechanism (106) calculates the abnormality degree of the extracted transition information between each cluster; and Failure cause estimating means (107) estimates a cause of failure of the device based on the abnormality degree calculated by the abnormality degree calculation means.

＜Note 2＞ A method for estimating the cause of device failure, inferring the cause of device failure, and includes: Log data acquisition steps (S201, S103), acquire logs, which are software action history information related to the control of the device; The cluster information extraction step (S202, S203) extracts cluster information and inter-cluster transition information from the acquired set of logs, where the cluster information is information representing the contents of each step of processing performed by the device, The inter-cluster transition information is information related to transitions between multiple steps of the device; The abnormality degree calculation step (S105) is to calculate the abnormality degree of the extracted transition information between each cluster; and The failure cause estimation step (S106) estimates the failure cause of the device based on the abnormality degree calculated by the abnormality degree calculation unit.

1, 2, 3: Device management system 100, 200, 300: Information processing terminal 101: Log data acquisition department 102: Cluster information extraction department 103: Inter-cluster transition information evaluation department 104: Directed graph generation part 105:Benchmark data generation department 106: Abnormality Calculation Department 107: Obstacle cause estimation department 108:Display part 109:Memory department 120: Appearance inspection device 121:Camera 122:X platform 123:Y platform 124:Conveyor 201: Extract log display image generation part 301: Sensor data acquisition department O: Inspection object S101～S107, S201～S209, S301～S303, S401, S402: steps

FIG. 1 is a schematic diagram showing an outline of a device management system according to Embodiment 1. FIG. 2 is an explanatory diagram showing an example of a software log. FIG. 3 is a flowchart showing the flow of processing performed by the device management system according to the first embodiment. 4 is a flowchart showing a sub-route of processing in the device management system according to Embodiment 1. FIG. 5 is an explanatory diagram illustrating software log separation processing. FIG. 6 is an explanatory diagram explaining a clustered logline. FIG. 7 is an explanatory diagram illustrating a log cluster sequence generated by the device management system according to the first embodiment. FIG. 8A is a first diagram illustrating a directed graph generated by the device management system of Embodiment 1. FIG. FIG. 8B is a second diagram illustrating a directed graph generated by the device management system of Embodiment 1. FIG. FIG. 9 is a diagram showing an example of a directed graph generated by the device management system of Embodiment 1. FIG. FIG. 10A is a diagram showing an example of a directed graph displayed on the screen in the modification of Embodiment 1. FIG. FIG. 10B is a diagram showing another example of a directed graph displayed on the screen in the modification of Embodiment 1. FIG. FIG. 11 is a schematic diagram showing an outline of a device management system according to another modification of Embodiment 1. FIG. FIG. 12 is a diagram illustrating an example of a screen displayed by the device management system according to another modification of Embodiment 1. FIG. FIG. 13 is a schematic diagram showing an outline of the device management system according to Embodiment 2. FIG. 14 is a flowchart showing the flow of processing performed by the device management system according to the second embodiment. FIG. 15 is a flowchart showing a sub-route of processing in the device management system according to the second embodiment. FIG. 16 is an explanatory diagram showing the relationship between sensor data and change scores. FIG. 17 is an explanatory diagram showing an example of a log cluster sequence in which change scores are mapped, generated by the device management system according to Embodiment 2.

1:Device management system

100:Information processing terminal

101: Log data acquisition department

102: Cluster information extraction department

103: Inter-cluster transition information evaluation department

104: Directed graph generation part

105:Benchmark data generation department

106: Abnormality Calculation Department

107: Obstacle cause estimation department

108:Display part

109:Memory Department

120: Appearance inspection device

121:Camera

122:X platform

123:Y platform

124:Conveyor

O: Inspection object

Claims (14)

A device management system is a device management system, which is characterized by including: a log data acquisition mechanism to acquire logs, the logs are software action records related to the control of the device; and a cluster information extraction mechanism to obtain from Cluster information and inter-cluster transition information are extracted from the collection of logs. The cluster information is information indicating the content of each step of the operation of the device. The inter-cluster transition information is the relationship between one step and another. information related to the transition between the above steps; an abnormality degree calculation unit that calculates the abnormality degree of each of the extracted transition information between clusters; and an obstacle cause estimation unit based on the abnormality degree calculated by the abnormality degree calculation unit To speculate on the cause of the failure of the device, the inter-cluster transition information includes information related to the occurrence frequency of transitions between multiple steps of the device, and the device management system further includes: inter-cluster transition The information evaluation unit weights each of the extracted transition information between clusters based on the occurrence frequency, and the anomaly degree calculation unit calculates the anomaly degree using the weighted information. The device management system according to claim 1, wherein the abnormality degree calculation unit calculates the abnormality degree of each of the extracted inter-cluster transition information based on the inter-cluster transition information when the device is normal. The device management system of Claim 1 or Claim 2 further includes: a hardware information acquisition mechanism that acquires hardware information related to the status of the hardware of the device, and the inter-cluster transition information evaluation mechanism is based on the The hardware information obtained by the hardware information obtaining mechanism further weights the extracted transition information between each of the clusters. The device management system according to claim 1 or claim 2, wherein the failure cause estimating means estimates that the inter-cluster transition information satisfies a predetermined condition when the anomaly degree calculated by the anomaly degree calculating means satisfies a predetermined condition. In the specified step, there is a cause of failure of the device. The device management system according to claim 1 or claim 2, further comprising: a display unit capable of displaying the abnormality degree calculated by the abnormality degree calculation unit and/or the abnormality degree calculated by the failure cause estimation unit. Information on the presumed cause of the disorder in question. The device management system of claim 5 further includes: a directed graph generating mechanism that uses the cluster information as nodes and the inter-cluster transition information as edges to generate a representation of each of the cluster information and the inter-cluster information. A directed graph of relationships between transitional information, and the display mechanism can display the directed graph. The device management system of claim 6, wherein the inter-cluster The transition information is weighted by a predetermined method to increase the importance of the evaluation, and the directed graph generating unit generates the weighted directed graph that can visually recognize the transition information between each of the clusters. The device management system of claim 7, wherein the directed graph generating unit generates a visually identifiable manner by displaying the weighted value representing the transition information between clusters near the edge. Represent the weighted directed graph. The device management system according to claim 7, wherein the directed graph generating unit displays a difference in sharpness setting of the edge representing the transition information between each of the clusters, thereby generating a visually recognizable representation. The weighted directed graph. The device management system of claim 6, wherein the cluster information includes words that are text information extracted from the log, and the directed graph generating mechanism converts the words included in each of the cluster information into The extracted words are extracted in descending order of the number of occurrences, and the directed graph is generated using the extracted words as information representing the content of the cluster information. The device management system as claimed in claim 6, further comprising: extracting a log display image generating mechanism to extract, from the collection of logs, logs corresponding to the inter-cluster transition information that satisfies the predetermined conditions, as a representation of the inter-cluster transition information that satisfies the predetermined conditions. The information on the content of the inter-cluster transition information of the predetermined condition is obtained, and an extraction log display image representing the content of the extracted log is generated, and the display mechanism can display the extraction log display image. The device management system of claim 11, wherein the extraction log display image pop-up is displayed on the edge of the edge representing the inter-cluster transition information corresponding to the extraction log shown in the extraction log display image. nearby. A method for estimating the cause of device failure, which infers the cause of device failure, and includes: a log data acquisition step to acquire a log, which is software action history information related to the control of the device; and a cluster information extraction step to automatically Cluster information and inter-cluster transition information are extracted from the acquired set of logs. The cluster information is information representing the content of each step of processing performed by the device. The inter-cluster transition information is information related to the device. information related to transitions between a plurality of the steps; an abnormality degree calculation step to calculate the abnormality degree of each of the extracted transition information between clusters; and an obstacle cause estimation step, based on the abnormality degree calculation step calculated in the abnormality degree calculation step The abnormality degree is used to estimate the cause of the failure of the device, wherein the inter-cluster transition information includes information related to the occurrence frequency of transitions between multiple steps of the device, and the method for estimating the cause of the failure of the device is more The method includes: an inter-cluster transition information evaluation step of weighting each of the extracted inter-cluster transition information based on the occurrence frequency; and the abnormality degree calculation step using the weighted information to calculate the abnormality degree. A memory medium that non-temporarily stores a program for causing a computer to execute each step of the method described in claim 13.