WO2018051394A1 - Alarm prediction apparatus, alarm prediction method, and program - Google Patents

Alarm prediction apparatus, alarm prediction method, and program Download PDF

Info

Publication number
WO2018051394A1
WO2018051394A1 PCT/JP2016/076914 JP2016076914W WO2018051394A1 WO 2018051394 A1 WO2018051394 A1 WO 2018051394A1 JP 2016076914 W JP2016076914 W JP 2016076914W WO 2018051394 A1 WO2018051394 A1 WO 2018051394A1
Authority
WO
WIPO (PCT)
Prior art keywords
event information
prediction
alarm
model
event
Prior art date
Application number
PCT/JP2016/076914
Other languages
French (fr)
Japanese (ja)
Inventor
鈴木 聡
北川 慎治
村上 賢哉
正康 熊谷
松井 哲郎
Original Assignee
富士電機株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 富士電機株式会社 filed Critical 富士電機株式会社
Priority to PCT/JP2016/076914 priority Critical patent/WO2018051394A1/en
Publication of WO2018051394A1 publication Critical patent/WO2018051394A1/en

Links

Images

Classifications

    • GPHYSICS
    • G05CONTROLLING; REGULATING
    • G05BCONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B23/00Testing or monitoring of control systems or parts thereof
    • G05B23/02Electric testing or monitoring

Abstract

[Problem] To propose an evaluation of a prediction model. [Solution] This alarm prediction apparatus, which predicts the occurrence of an abnormality on the basis of time-series event information output from a device or equipment, includes: an extraction means which extracts, from a plurality of pieces of event information pre-stored in a prescribed storage region chronically, a first event information string including, in a tail end thereof, prediction object event information which indicates the occurrence of an abnormality in a prediction object; a model creating means that extracts a second event information string in which the prediction object event information is excluded from the first event information string extracted by the extraction means, and that creates a prediction model on the basis of the corresponding second event information string; and a display means which allows an evaluation value of the model created by the model creating means to be displayed on a display apparatus.

Description

Alarm prediction device, alarm prediction method, and program

The present invention relates to an alarm prediction device, an alarm prediction method, and a program.

Conventionally, a prediction model has been created to predict the occurrence of an alarm indicating a failure or abnormality based on an event output from a plant, facility, equipment, control device, etc., and the occurrence of an alarm is predicted based on this prediction model The technique to do is known (for example, refer patent document 1).

JP 2011-81697 A

Here, the prediction model is created based on parameters specified by the user. However, in the above-described conventional technology, the user cannot evaluate the performance (for example, the accuracy of prediction) of the created prediction model in advance. Therefore, the user has evaluated the said prediction model using the actual prediction result by a prediction model.

An embodiment of the present invention has been made in view of the above points, and aims to present an evaluation of a prediction model.

In order to achieve the above object, according to an embodiment of the present invention, an alarm prediction device that predicts the occurrence of an abnormality based on time-series event information output from a device or equipment, and stores the information in a predetermined storage area according to the time series. Extraction means for extracting, from the plurality of event information stored in advance, a column of first event information that includes prediction target event information indicating the occurrence of an abnormality of the prediction target at the end, and the first extracted by the extraction means A model creating unit that extracts a second event information column obtained by removing the prediction target event information from the one event information column and creates a prediction model based on the second event information column; and the model creating unit Display means for causing the display device to display the evaluation value of the model created by the above.

According to an embodiment of the present invention, an evaluation of a prediction model can be presented.

It is a lineblock diagram of an example of the alarm prediction system concerning a first embodiment. It is a hardware block diagram of an example of the alarm prediction apparatus which concerns on 1st embodiment. It is a functional lineblock diagram of an example of the alarm prediction system concerning a first embodiment. It is a figure for demonstrating an example which symbolizes an event signal. It is a figure for demonstrating an example of the event stored in the event information storage part. It is a flowchart of an example of preparation and evaluation processing of a prediction model concerning a first embodiment. It is a figure for demonstrating an example of prediction omission and misprediction. It is a figure which shows an example of the screen which shows the evaluation result of the prediction model which concerns on 1st embodiment. It is a flowchart of an example of the alarm prediction process which concerns on 1st embodiment. It is a flowchart of an example of preparation and evaluation processing of a prediction model concerning a second embodiment. It is a figure which shows an example of the screen which shows the evaluation result of the prediction model which concerns on 2nd embodiment. It is a flowchart of an example of preparation of a prediction model and evaluation processing concerning a third embodiment. It is FIG. (1) which shows an example of the screen which shows the evaluation result of the prediction model which concerns on 3rd embodiment. It is FIG. (2) which shows an example of the screen which shows the evaluation result of the prediction model which concerns on 3rd embodiment. It is a flowchart of an example of preparation of a prediction model and evaluation processing concerning a 4th embodiment. It is a figure of an example for demonstrating clustering. It is a figure which shows an example of the screen which shows the evaluation result of the prediction model which concerns on 4th embodiment. It is a flowchart of an example of the alarm prediction process which concerns on 4th embodiment. It is a function block diagram of an example of the alarm prediction system which concerns on 5th embodiment. It is a figure for demonstrating an example of the prediction model stored in the prediction model memory | storage part. It is a flowchart of an example of the preparation process of the prediction model which concerns on 5th embodiment. It is a flowchart of an example of the production | generation process of the status information which concerns on 5th embodiment. It is a figure for demonstrating an example of the calculation method of distance. It is a figure for demonstrating the other example of the calculation method of distance. It is a flowchart of an example of the alarm prediction process which concerns on 5th embodiment. It is a figure which shows an example of an alarm prediction screen. It is a figure which shows the other example of an alarm prediction screen.

Next, embodiments of the present invention will be described in detail with reference to the drawings.

[First embodiment]
<System configuration>
First, the system configuration of the alarm prediction system 1 according to the present embodiment will be described with reference to FIG. FIG. 1 is a configuration diagram of an example of an alarm prediction system 1 according to the first embodiment.

In the alarm prediction system 1 shown in FIG. 1, an alarm prediction device 10, one or more monitoring devices 20, and one or more device control devices 30 communicate via a network N such as a LAN (Local Area Network). Connected as possible. In addition, one or more devices 40 are connected to the device control device 30.

The operation of this system includes a “model creation” phase in which a prediction model for predicting the occurrence of an alarm indicating a failure or abnormality of the device 40 is created in advance, a received event signal, and a prediction model created in advance. There is a “prediction” phase for predicting the occurrence of an alarm based on the above. Basically, the “model creation” phase is offline processing, and the “prediction” phase is online processing.

Here, the event signal is information indicating the status information of the device 40 and the like transmitted from the device control device 30 when any event occurs in the device 40. The event signal includes an event signal indicating various operations (for example, a setting value changing operation) performed by the user via the alarm prediction device 10, an event signal indicating a response of the device 40 to the operation, and the like. . In other words, for example, an operation content in which a user inputs a set value using an input device included in the alarm prediction device 10 is also used as an event for predicting the occurrence of an alarm. In other words, for example, the input device included in the alarm prediction device 10 is also included in the device 40 that the alarm prediction device 10 predicts the occurrence of an abnormality.

In the “model creation” phase, the alarm prediction device 10 creates a prediction model from the accumulated information on past event signals, and evaluates the prediction model. Further, in the “prediction” phase, the alarm prediction device 10 predicts the occurrence of an alarm based on the event signal received from the device control device 30 and the prediction model, and causes the monitoring device 20 to display the prediction result. Note that the alarm prediction device 10 may be configured by one or more computers.

The monitoring device 20 displays the prediction result received from the alarm prediction device 10 in the “prediction” phase. Thereby, for example, an operator such as a plant can recognize that an alarm may occur based on the prediction result displayed on the monitoring device 20.

The device control device 30 is a device that controls the device 40. The device control apparatus 30 indicates state information (for example, that a predetermined part of the device 40 is in an operating state) when an event (for example, a state change of the device 40) occurs in the device 40 connected to the device control apparatus 30. Information etc.) is acquired and transmitted to the alarm prediction device 10 as an event signal.

The equipment 40 is, for example, a facility or a plant such as a gas turbine or a steam turbine controlled by the equipment control device 30.

In addition, in the alarm prediction system 1 according to the present embodiment, a plant, equipment, or the like is assumed as an example of the device 40, but is not limited thereto. That is, the alarm prediction system 1 according to the present embodiment can also be applied to a case where an alarm such as a failure of a network device is predicted using, for example, a router as the device 40 controlled by the device control apparatus 30. Similarly, the present invention can be applied to a case where various electronic devices are used as the device 40 to predict an alarm such as a failure of various electronic devices.

<Hardware configuration>
Next, the hardware configuration of the alarm prediction device 10 according to the present embodiment will be described with reference to FIG. FIG. 2 is a hardware configuration diagram of an example of the alarm prediction device 10 according to the first embodiment.

The alarm prediction device 10 according to the present embodiment includes an input device 11, a display device 12, an external I / F 13, a RAM (Random Access Memory) 14, and a ROM (Read Only Memory) 15. The alarm prediction device 10 includes a CPU (Central (Processing Unit) 16, a communication I / F 17, and a storage device 18. These hardware are connected to each other by a bus B.

The input device 11 is, for example, a keyboard, a mouse, a touch panel, etc., and is used by the user to input each operation signal. The display device 12 is, for example, an LCD (Liquid Crystal Display) or the like, and displays a processing result. The input device 11 and / or the display device 12 may be connected to the bus B and used when necessary.

External I / F 13 is an interface with an external device. The external device includes a recording medium 13a. The alarm prediction device 10 can read and / or write the recording medium 13a via the external I / F 13. Examples of the recording medium 13a include a flexible disk, a CD, a DVD, an SD memory card, and a USB memory. The recording medium 13a may store a program that realizes the present embodiment.

The RAM 14 is a volatile semiconductor memory that temporarily stores programs and data. The ROM 15 is a non-volatile semiconductor memory that can retain programs and data even when the power is turned off.

The ROM 15 stores programs and data such as OS (Operating System) settings and network settings, and BIOS (Basic Input / Output System) that is executed when the alarm prediction device 10 is started.

The CPU 16 is a calculation device that implements control of the entire alarm prediction device 10 and other functions by reading programs and data from the ROM 15 and the storage device 18 onto the RAM 14 and executing processing based on the programs and data. .

The communication I / F 17 is an interface for connecting the alarm prediction device 10 to the network N. The alarm prediction device 10 can perform data communication via the communication I / F 107.

The storage device 18 is a non-volatile memory storing programs and data, and is, for example, an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The programs and data stored in the storage device 18 include a program that realizes the present embodiment, an OS that is basic software for controlling the entire alarm prediction device 10, and application software that provides various functions on the OS. The storage device 18 manages stored programs and data by a predetermined file system and / or DB.

The alarm prediction apparatus 10 according to the present embodiment can realize various processes as described later by having the above hardware configuration.

<Functional configuration>
Next, the functional configuration of the alarm prediction system 1 according to the first embodiment will be described with reference to FIG. FIG. 3 is a functional configuration diagram of an example of the alarm prediction system 1 according to the first embodiment.

The alarm prediction device 10 includes a symbolizing unit 101, a prediction target alarm setting unit 102, an event sequence extraction unit 103, a prediction model creation unit 104, a prediction model evaluation unit 105, a display control unit 106, and an alarm prediction unit. 107. Each of these units is realized by processing that the CPU 16 executes one or more programs installed or downloaded in the alarm prediction device 10.

Also, the alarm prediction device 10 uses an event information storage unit 110 and a prediction model storage unit 120. Each of these storage units can be realized using the storage device 18 or a storage device connected to the alarm prediction device 10 via a network.

The symbolizing unit 101 converts the event signal received from the device control device 30 into predetermined characters or symbols (hereinafter, such conversion is also referred to as “symbolization”). Note that, for example, an operation content or the like in which the user inputs a set value using the input device 11 included in the alarm prediction device 10 is also used as an event for predicting the occurrence of an alarm. The event signal including “” is also converted into a predetermined character or symbol.

Here, the encoding of the event signal by the encoding unit 101 will be described with reference to FIG. FIG. 4 is a diagram for explaining an example of symbolizing an event signal.

As shown in FIG. 4, the event signal includes the time when the event occurred in the device 40 and the content of the event that occurred. For this reason, the symbolizing unit 101 converts the contents of the generated event into a predetermined symbol or the like. In the example shown in FIG. 4, the event content “air blow valve A, open” is converted to the symbol “A”, and the event content “pump B, operation” is converted to the symbol “B”. As described above, the symbolizing unit 101 converts the content of the event included in the event signal into a symbol that uniquely indicates the content of the event.

As described above, the event signal is a set of the time when the event occurs and the content of the event. Therefore, for example, in the event signal in the first row shown in FIG. 4, if the time when it occurred (2004/06/06 000: 14: 17) is t, , T). The same applies to other event signals.

However, hereinafter, for the sake of simplicity, a pair of a symbol indicating the content of an event and an occurrence time is simply represented by only the symbol (that is, the pair “(A, t)” is simply represented by “A”). Further, hereinafter, the event signal symbolized as described above is also simply referred to as “event”.

The prediction target alarm setting unit 102 sets an alarm designated by the user as a prediction target alarm. Here, the prediction target alarm is an alarm whose occurrence is to be predicted in the “prediction” phase.

Note that alarms are also included in event signals. That is, for example, when a certain device 40 fails, the device control device 30 that controls the device 40 transmits an event signal indicating the failure of the device 40 to the alarm prediction device 10. In other words, an event signal indicating occurrence of a failure or abnormality of the device 40 is referred to as an “alarm”.

The event sequence extraction unit 103 extracts an event sequence (a sequence of one or more events) including the prediction target alarm set by the prediction target alarm setting unit 102 from the event information storage unit 110.

The prediction model creation unit 104 creates a prediction model based on the event sequence extracted by the event sequence extraction unit 103.

The prediction model evaluation unit 105 evaluates the prediction model created by the prediction model creation unit 104. That is, the prediction model evaluation unit 105 calculates the prediction failure rate and the misprediction rate of the prediction model created by the prediction model creation unit 104.

Here, the predicted omission rate is a probability that the prediction model cannot predict the occurrence of the prediction target alarm. On the other hand, the misprediction rate is the probability that a prediction target alarm will be erroneously predicted when it occurs.

The display control unit 106 causes the display device 12 to display information such as the prediction omission rate and the misprediction rate of the prediction model evaluated by the prediction model evaluation unit 105. Thereby, the user can know whether the created prediction model has a desired prediction accuracy.

The alarm prediction unit 107 predicts the occurrence of an alarm in the “prediction” phase based on the prediction model created in the “model creation” phase. The alarm prediction unit 107 notifies the monitoring device 20 of the prediction result. Thereby, for example, a plant operator or the like can know whether or not a prediction target alarm is generated based on the prediction result.

The event information storage unit 110 stores the event signal (that is, “event”) encoded by the encoding unit 101 as time series data.

Here, the events stored in the event information storage unit 110 will be described with reference to FIG. FIG. 5 is a diagram for explaining an example of an event stored in the event information storage unit 110.

As shown in FIG. 5, for example, events for N days are stored in the event information storage unit 110 as time series data. That is, in the first row of FIG. 5, for example, events that occurred yesterday are stored in the order in which they occurred from left to right (in chronological order). Similarly, in the second row of FIG. 5, for example, events that occurred the day before yesterday are stored in order of occurrence from left to right. As described above, the event information storage unit 110 stores (accumulates) symbolized event signals (events) as time-series data.

The prediction model storage unit 120 stores the prediction model created by the prediction model creation unit 104. In the “prediction” phase, the alarm prediction unit 107 predicts the occurrence of an alarm based on the prediction model stored in the prediction model storage unit 120.

<Details of processing>
Next, details of processing of the alarm prediction system 1 according to the present embodiment will be described.

≪Prediction model creation and evaluation process≫
First, the process of creating a prediction model and presenting the evaluation result of the prediction model to the user in the “model creation” phase will be described with reference to FIG. FIG. 6 is a flowchart of an example of a prediction model creation and evaluation process according to the first embodiment.

In step S601, the user designates an alarm to be predicted from the input device 11 or the like. Then, the prediction target alarm setting unit 102 sets the alarm designated by the user as the prediction target alarm. Here, it is assumed that the user has designated an event (alarm) represented by the symbol “F” as a prediction target alarm.

In step S 602, the event sequence extraction unit 103 extracts from the event information storage unit 110 one event sequence that includes the prediction target alarm “F” set by the prediction target alarm setting unit 102 at the end.

Here, the event sequence extraction unit 103 uses, for example, a sequential pattern mining (sequence pattern mining) method disclosed in Japanese Patent Application Laid-Open No. 2004-157830, to generate one event including the prediction target alarm “F” at the end. The columns may be extracted from the event information storage unit 110. Hereinafter, the extracted event string is referred to as “ABCDEF”.

In step S603, the prediction model creation unit 104 extracts an event sequence preceding the prediction target alarm from the extracted event sequence, and creates a prediction model.

More specifically, the event sequence “ABCDE” preceding the prediction target alarm “F” is extracted from the event sequence “ABCDEF” extracted in step S602 above. The “ABCDE” extracted here is also referred to as a “prediction source event string”. Then, after the event sequence “ABCDE” occurs, a prediction model “ABCDE → F” that predicts the occurrence of the event (alarm) “F” is created. In the prediction model “ABCDE → F”, when events occur in the order of “A”, “B”, “C”, “D”, “E”, the event (alarm) “F” occurs next. It is a prediction model which predicts. The prediction model created in this way is stored in the prediction model storage unit 120.

In step S604, the prediction model evaluation unit 105 evaluates the generated prediction model. That is, the prediction model evaluation unit 105 calculates the prediction failure rate and the misprediction rate of the created prediction model. More specifically, the prediction omission rate and the misprediction rate are calculated as follows.
(1) In the event information storage unit 110, the prediction model evaluation unit 105 calculates the number of times (second number) that an event sequence other than the prediction source event sequence occurs before the prediction target alarm. For example, as shown in FIG. 7, the number of occurrences of an event sequence (“EUDDG” in the example of FIG. 7) other than the prediction source event sequence “ABCDE” occurs before the prediction target alarm “F”. This is done using a column search technique.
(2) In the event information storage unit 110, the prediction model evaluation unit 105 calculates the number of times (third number) that an event other than the prediction target alarm occurs after the prediction source event sequence. For example, as shown in FIG. 7, the number of occurrences of events other than the prediction target alarm “F” (“A” in the example of FIG. 7) after the prediction source event sequence “ABCDE” occurs. This method is used.
(3) Appearance frequency (first number) of “ABCDEF” calculated in step S602 above, number of times (second number) calculated in (1) above, and calculation in (2) above Based on the number of times (the third number), the predicted omission rate and the misprediction rate are calculated by the following equations.
Predicted leakage rate = (second number / (first number + second number)) × 100
False prediction rate = (third number / (first number + third number)) × 100
In step S605, the display control unit 106 causes the display device 12 to display the prediction model evaluation result calculated in step S604. More specifically, the display control unit 106 causes the display device 12 to display a screen G100 showing an evaluation result as shown in FIG.

The screen G100 showing the evaluation result shown in FIG. 8 shows the predicted omission rate when the first number described above is “90”, the second number is “3”, and the third number is “7”. And the evaluation result of calculating the misprediction rate is shown. Thereby, the user can know the prediction failure rate and the misprediction rate of the created prediction model, and can confirm whether or not the desired prediction accuracy is satisfied.

Here, when the user thinks that the desired prediction accuracy is satisfied, the user presses the “OK” button on the screen G100 shown in FIG. 8, for example. Thus, the created prediction model is adopted, and the occurrence of an alarm is predicted based on the prediction model in the “prediction” phase. On the other hand, when the user thinks that the desired prediction accuracy is not satisfied, the user presses a “cancel” button on the screen G100 in FIG. 8, for example. Thereby, the created prediction model is deleted from the prediction model storage unit 19 (that is, the created prediction model is not adopted).

In general, it can be said that a lower prediction loss rate and a wrong prediction rate are better prediction models, but the prediction failure rate and the misprediction rate often have a trade-off relationship with each other. For example, in the case where the event sequence is long, the number of the event sequences to be extracted is reduced, and the number of alarms following the event sequence is limited. However, on the contrary, the number of alarms that follow is reduced, so that there are many prediction failures, and the prediction failure rate and the misprediction rate often have a trade-off relationship with each other.

Further, in this embodiment, as a means for evaluating the prediction model, the prediction omission rate and the misprediction rate are used as indexes, but other known indexes can also be used. For example, there are indexes such as correct answer rate, incorrect answer rate, precision rate / accuracy, sensitivity / true positive rate / detection rate, specificity / true negative rate, false positive rate, false negative rate.

The combination of any one of precision rate / accuracy and any one of sensitivity / true positive rate / detection rate has a trade-off relationship.

・ Accuracy rate / accuracy = 1-false prediction rate = (first number / (first number + third number)) × 100
Sensitivity / true positive rate / detection rate = 1-predicted omission rate = (first number / (first number + second number)) × 100
≪Alarm prediction process≫
Next, processing in the “prediction” phase for predicting the occurrence of an alarm based on the prediction model created in the “model creation” phase will be described with reference to FIG. FIG. 9 is a flowchart of an example of an alarm prediction process according to the first embodiment. In the following description, it is assumed that the prediction model is “ABCDE → F”.

In step S901, the alarm prediction device 10 receives an event signal from the device control device 30.

In step S902, the symbolizing unit 101 converts the event signal received from the device control apparatus 30 into a predetermined symbol. The symbolizing unit 101 stores the symbolized event signal (event) in the event information storage unit 110.

In step S <b> 903, the alarm prediction unit 107 matches the latest five event sequences stored in the event information storage unit 110 with the prediction source event sequence “ABCDE” of the prediction model stored in the prediction model storage unit 120. It is determined whether or not to do.

More generally, prediction source event column "X 1 X 2 ··· X m" of the predictive model, the event string stored according to the event information storage unit 110 in time series is "Y 1 Y 2 ··· Y n (N> m), the alarm prediction unit 107 determines whether or not the latest event sequence “Y 1 Y 2 ... Y m ” matches “X 1 X 2 ... X m ”. judge. If they do not match, the process returns to step S901, whereas if they match, the process proceeds to step S904.

In step S904, the alarm prediction unit 107 notifies the monitoring device 20 of the prediction result. That is, the alarm prediction unit 107 notifies the monitoring device 20 of a prediction result indicating that a prediction target alarm may occur. Thereby, for example, an operator such as a plant can know that there is a possibility that an alarm to be predicted is generated. Therefore, for example, the operator can take action according to an alarm that may occur.

[Second Embodiment]
Next, the alarm prediction system 1 according to the second embodiment will be described. In the second embodiment, in the “model creation” phase, a plurality of prediction models are created, and the evaluation of each prediction model is presented to the user. Therefore, the user can select a desired prediction model from the plurality of created prediction models. In the second embodiment, the same reference numerals as those in the first embodiment are used to describe the portions having substantially the same functions as those in the first embodiment and the processes for executing the same processes. Omitted.

<Details of processing>
Hereinafter, details of the processing of the alarm prediction system 1 according to the present embodiment will be described.

≪Prediction model creation and evaluation process≫
A process of creating a prediction model and presenting the evaluation result of the prediction model to the user in the “model creation” phase will be described with reference to FIG. FIG. 10 is a flowchart of an example of a prediction model creation and evaluation process according to the second embodiment.

In step S1001, the event sequence extraction unit 103 extracts a plurality of event sequences including the prediction target alarm “F” set by the prediction target alarm setting unit 102 from the event information storage unit 110. Here, the event sequence extraction unit 103 may use a sequence pattern mining method as in the first embodiment.

More specifically, the event sequence extraction unit 103 inputs a minimum appearance frequency a, a minimum event sequence length min, and a maximum event sequence length max specified in advance by a user or the like, and performs sequence pattern mining to generate a plurality of event sequences. To extract. Hereinafter, the plurality of event sequences extracted in this way are referred to as “EF”, “LF”, “DEF”, “KLF”, “CDEF”, “JKLF”,.

In step S1002, the prediction model creation unit 104 extracts an event sequence preceding the prediction target alarm for each of the extracted event sequences, and creates a prediction model.

More specifically, from the plurality of event sequences “EF”, “LF”, “DEF”, “KLF”, “CDEF”, “JKLF”,... Extracted in step S1001, the prediction target alarm “ A plurality of event sequences “E”, “L”, “DE”, “KL”, “CDE”, “JKL”,... Preceding “F” are extracted. Then, prediction models “E → F”, “L → F”, “DE → F”, “KL → F”, “CDE → F”, “JKL → F”,・ ・ Create The plurality of prediction models created in this way are stored in the prediction model storage unit 120, respectively.

In step S1003, the prediction model evaluation unit 105 evaluates each of the created prediction models. That is, the prediction model evaluation unit 105 calculates a prediction omission rate and an erroneous prediction rate for each of the plurality of generated prediction models. The calculation method of the prediction omission rate and the misprediction rate is the same as in the first embodiment.

In step S1004, the display control unit 106 causes the display device 12 to display each evaluation result of the plurality of prediction models calculated in step S1003. More specifically, the display control unit 106 causes the display device 12 to display a screen G200 showing an evaluation result as shown in FIG.

In the screen G200 shown in FIG. 11, the first number (correct answer) of the prediction model “E → F” is “299”, the second number (prediction failure) is “1”, and the third number (misprediction) is. It shows a case where “300”, the predicted omission rate is “0.3%”, and the misprediction rate is “50.0%”. Similarly, the first number (correct answer) of the prediction model “L → F” is “1”, the second number (prediction omission) is “1”, and the third number (misprediction) is “299”. In this example, the leakage rate is “39.9%” and the misprediction rate is “99.7%”. The same applies to the other prediction models “DE → F”, “KL → F”, “CDE → F”, “JKL → F”,.

This allows the user to know the predicted omission rate and the misprediction rate of the created prediction models. Therefore, for example, when the user selects a desired prediction model with a radio button on the screen G200 shown in FIG. 11 and presses the “OK” button, the selected prediction model is adopted, and the prediction is performed in the “prediction” phase. The occurrence of an alarm is predicted based on the model.

Note that the prediction model not selected at this time is deleted from the prediction model storage unit 120. Further, for example, in the screen G200 shown in FIG. 11, a check box may be provided instead of the radio button so that a plurality of prediction models can be selected.

On the other hand, when the user thinks that the desired prediction accuracy is not satisfied, the user presses a “cancel” button on the screen G200 shown in FIG. 11, for example. As a result, the plurality of created prediction models are deleted from the prediction model storage unit 120 (that is, the created prediction models are not adopted).

[Third embodiment]
Next, the alarm prediction system 1 according to the third embodiment will be described. In the third embodiment, in the “model creation” phase, a prediction model is created for a plurality of event sequences preceding a prediction target alarm included in the prediction source event sequence, and evaluation of each prediction model is presented to the user. . In the third embodiment, the same reference numerals as in the first embodiment are used to describe the portions having substantially the same functions as those in the first embodiment and the processes for executing the same processes. Omitted.

<Details of processing>
Hereinafter, details of the processing of the alarm prediction system 1 according to the present embodiment will be described.

≪Prediction model creation and evaluation process≫
A process of creating a prediction model and presenting the evaluation result of the prediction model to the user in the “model creation” phase will be described with reference to FIG. FIG. 12 is a flowchart of an example of a prediction model creation and evaluation process according to the third embodiment.

In step S1201, the prediction model creation unit 104 extracts an event sequence preceding the prediction target alarm in the extracted event sequence, and creates a plurality of prediction models.

More specifically, the event sequence “ABCDE” (prediction source event sequence) preceding the prediction target alarm “F” is extracted from the event sequence “ABCDEF” extracted in step S602 above. Further, an event sequence preceding the prediction target alarm included in the prediction source event sequence (this is expressed as a “partial prediction source event sequence”) is extracted. That is, partial prediction source event sequences “E”, “DE”, “CDE”, and “BCDE” are extracted. Then, prediction models “E → F”, “DE → F”, “CDE → F”, “BCDE → F”, and “ABCDE → F” are created from the partial prediction source event sequence and the prediction source event sequence, respectively. The prediction model created in this way is stored in the prediction model storage unit 120.

In step S1201, a prediction model may be created from an event sequence including a prediction source event sequence. For example, the event sequence “ZABCDE” including the prediction source event sequence “ABCDE” may be extracted from the event information storage unit 110, and the prediction model “ZABCDE → F” may be created from the event sequence “ZABCDE”.

In step S1202, the prediction model evaluation unit 105 evaluates each of the created prediction models. That is, the prediction model evaluation unit 105 calculates a prediction omission rate and an erroneous prediction rate for each of the plurality of generated prediction models. The calculation method of the prediction omission rate and the misprediction rate is the same as in the first embodiment.

In step S1203, the display control unit 106 causes the display device 12 to display each evaluation result of the plurality of prediction models calculated in step S1202. More specifically, the display control unit 106 causes the display device 12 to display a screen G300 showing an evaluation result as shown in FIG.

In the screen G300 shown in FIG. 13, the first number (correct answer) of the prediction model “E → F” is “299”, the second number (prediction failure) is “1”, and the third number (misprediction) is. It shows a case where “300”, the predicted omission rate is “0.3%”, and the misprediction rate is “50.0%”. Similarly, the first number (correct answer) of the prediction model “DE → F” is “295”, the second number (prediction failure) is “5”, and the third number (misprediction) is “150”. In this example, the leakage rate is “1.7%” and the misprediction rate is “33.7%”. The same applies to the other prediction models “CDE → F”, “BCDE → F”, and “ABCDE → F”.

This allows the user to know the predicted omission rate and the misprediction rate of the created prediction models. Therefore, for example, the user selects a desired prediction model with a radio button on the screen G300 shown in FIG. 13, and presses the “OK” button. Thus, the created prediction model is adopted, and the occurrence of an alarm is predicted based on the prediction model in the “prediction” phase.

Note that the prediction model not selected at this time is deleted from the prediction model storage unit 120. For example, in the screen G300 shown in FIG. 13, a check box may be provided instead of the radio button so that a plurality of prediction models can be selected.

On the other hand, when the user thinks that the desired prediction accuracy is not satisfied, the user presses a “cancel” button on the screen G300 shown in FIG. 13, for example. As a result, the plurality of created prediction models are deleted from the prediction model storage unit 120 (that is, the created prediction models are not adopted).

Furthermore, when a “Graph Display” button is pressed on the screen G300 shown in FIG. 13, a screen G310 on which a graph as shown in FIG. 14 is displayed may be displayed. A screen G310 illustrated in FIG. 14 displays a graph in which the prediction failure rate and the misprediction rate of each prediction model are represented. As described above, since the prediction failure rate and the misprediction rate are often in a trade-off relationship, the user can adopt an appropriate prediction model by displaying the screen G310 shown in FIG. become.

For example, when a graph of the predicted omission rate and the misprediction rate is displayed as in the graph displayed on the screen G310 shown in FIG. 14, the prediction omission rate increases and the misprediction rate decreases as the character string becomes longer. In consideration of the priority for each, it is possible to determine a character string length that will be an appropriate prediction omission rate and an erroneous prediction rate. Accordingly, it can be understood that when the user places importance on the prediction failure rate among the prediction failure rate and the misprediction rate, the prediction model “BCDE → F” may be adopted. On the other hand, for example, when the user places importance on the misprediction rate out of the predicted omission rate and the misprediction rate, it is understood that the prediction model “ABCDE → F” may be adopted.

[Fourth embodiment]
Next, an alarm prediction system 1 according to the fourth embodiment will be described. In the fourth embodiment, in the “model creation” phase, the same event sequence as the prediction source event sequence is clustered based on the time between events, and a prediction model is created for each cluster. Thereby, while the generated event sequence is the same, the prediction model can be created by distinguishing when the time (event occurrence interval) between events included in the event sequence is significantly different. In other words, in the fourth embodiment, it is possible to create a prediction model that can perform prediction based on the time interval at which events occur in addition to the order in which events occur. In the fourth embodiment, the same reference numerals as those in the first embodiment are used to describe the portions having substantially the same functions as those in the first embodiment and the processes for executing the same processes. Omitted.

<Details of processing>
Hereinafter, details of the processing of the alarm prediction system 1 according to the present embodiment will be described.

≪Prediction model creation and evaluation process≫
The process of creating a prediction model and presenting the evaluation result of the prediction model to the user in the “model creation” phase will be described with reference to FIG. FIG. 15 is a flowchart of an example of a prediction model creation and evaluation process according to the fourth embodiment.

In step S1501, the prediction model creation unit 104 extracts an event sequence (prediction source event sequence) preceding the prediction target alarm in the extracted event sequence. This is the same as the method of extracting the prediction source event sequence in the first embodiment.

In step S1502, the prediction model creation unit 104 acquires the same event sequence as the prediction source event sequence from the event information storage unit 110.

That is, when the prediction source event sequence is “ABCDE”, the prediction model creation unit 104 acquires the event sequence “ABCDE” from the event information storage unit 110. Here, it is assumed that the prediction model creation unit 104 has acquired n event strings “ABCDE” from the event information storage unit 110. In addition, in order to distinguish the acquired n event strings from each other, hereinafter, for the sake of convenience, they will be referred to as “first ABCDE”, “second ABCDE”,..., “Nth ABCDE”, respectively.

In step S1503, the prediction model creation unit 104 clusters each acquired event sequence based on the time interval between events, assigns a label to each cluster, and identifies the cluster to which the label is attached as a prediction source event sequence. Create a prediction model as

More specifically, as shown in FIG. 16, the following Step 1 to Step 3 are performed.

Step 1) For each of “first ABCDE”, “second ABCDE”,..., “Nth ABCDE”, a difference in time at which each event occurs is obtained. For example, in “first ABCDE”, the difference between the occurrence time t B of B and the occurrence time t A of A is obtained, and this is defined as t 11 . Similarly, the difference between the occurrence time t C of C and the occurrence time t B of B is obtained, and this is defined as t 12 . It obtains the difference between the occurrence time t C of occurrence time t D and C and D, which is referred to as t 13. The difference between the occurrence time t E of E and the occurrence time t D of D is obtained, and this is defined as t 14 . As for “second ABCDE”,..., “Nth ABCDE”, as in “first ABCDE”, the difference in time at which each event occurs is obtained.

Step 2) For “first ABCDE”, t 11 , t 12 , t 13 , and t 14 obtained in the above Step 1 are converted into vectors T 1 = (t 11 , t 12 , t 13 , t 14 ) t (where , T indicates transposition). "Second ABCDE", ..., the "ABCDE of the n", like the "first ABCDE", respectively, the vector T 2, ..., to define T n.

Step 3) The vectors T 1 , T 2 ,..., T n are clustered by, for example, K-means clustering. Then, a label for identifying each cluster is given to the K clusters. Hereinafter, it is assumed that the vectors T 1 , T 2 ,..., T n are clustered into three clusters, and the labels of each cluster are α, β, and γ.

And each cluster with a label is used as a prediction model. That is, in the above case, the prediction model “ABCDE → F” of the label α is created using the event sequence “ABCDE” included in the cluster of the label α as the prediction source event sequence. Similarly, the prediction model “ABCDE → F” of the label β is created using the event sequence “ABCDE” included in the label β as a prediction source event sequence. Similarly, the prediction model “ABCDE → F” of the label γ is created with the event string “ABCDE” included in the label γ as the prediction source event string.

In step S1504, the prediction model evaluation unit 105 evaluates the created prediction model. That is, the prediction model evaluation unit 105 calculates the prediction failure rate and the misprediction rate of the created prediction model. The calculation method of the prediction omission rate and the misprediction rate is the same as in the first embodiment, but the first number, the second number, and the third number are calculated for each label. However, the event information storage unit 110 includes time information between events.

More specifically, the number of times that the prediction target alarm “F” occurs after “ABCDE” of label α is defined as the first number of labels α. Further, the number of times that an event string other than “ABCDE” with label α occurs before the prediction target alarm “F” is set as the second number of labels α. Further, the number of times an event other than the prediction target alarm “F” occurs after “ABCDE” of the label α is set as a third number of times of the label α. The same applies to label β and label γ.

In step S1505, the display control unit 106 causes the display device 12 to display the evaluation results of the plurality of prediction models calculated in step S1504. More specifically, the display control unit 106 causes the display device 12 to display a screen G400 showing an evaluation result as shown in FIG.

In the screen G400 shown in FIG. 17, the first number (correct answer) of the label α described above is “86”, the second number (predicted omission) of the label α is “7”, and the third number of the label α. In the case where (misprediction) is “7”, the evaluation result of calculating the prediction omission rate and the misprediction rate is shown. Similarly, the first number (correct answer) of label β is “1”, the second number of labels β (prediction omission) is “92”, and the third number of labels β (misprediction) is “40”. The evaluation result which calculated the prediction omission rate and the misprediction rate about a certain case is shown. Similarly, the first number (correct answer) of label γ is “3”, the second number of labels γ (prediction omission) is “90”, and the third number of labels γ (misprediction) is “53”. The evaluation result which calculated the prediction omission rate and the misprediction rate about a certain case is shown.

Here, when the user thinks that the desired prediction accuracy is satisfied, the user selects a desired prediction model on the screen G400 shown in FIG. 17, for example, and presses the “OK” button. Thereby, the created prediction model is adopted. On the other hand, when the user thinks that the desired prediction accuracy is not satisfied, the user presses a “cancel” button on a screen G400 shown in FIG. 16, for example. Thus, the created prediction model is deleted from the prediction model storage unit 120.

As described above, in the fourth embodiment, a prediction model capable of performing prediction based on the time interval at which events occur in addition to the order in which events occur is created. Thereby, for example, when a prediction model with a high misprediction rate is obtained, the prediction source event sequence of the prediction model is clustered to create a plurality of prediction models, thereby achieving high prediction accuracy (low misprediction rate is low). ) A prediction model can be obtained.

≪Alarm prediction process≫
Next, processing in the “prediction” phase for predicting the occurrence of an alarm based on the prediction model created in the “model creation” phase will be described with reference to FIG. FIG. 18 is a flowchart of an example of an alarm prediction process according to the fourth embodiment. In the following description, it is assumed that the prediction model is “ABCDE → F” with label α.

In step S1801, the alarm prediction unit 107 determines whether the five latest event sequences stored in the event information storage unit 110 belong to the cluster with the label α. If it does not belong to the cluster with label α, the process returns to step S901, whereas if it belongs to the cluster with label α, the process proceeds to step S904. When a plurality of prediction models are stored in the prediction model storage unit 120, the alarm prediction unit 107 determines whether it belongs to the label class of any prediction model.

More generally, when the prediction source event sequence of the prediction model is classified as a cluster with a label “X 1 X 2 ... X m ”, the m most recent events stored in the event information storage unit 110. It is determined whether or not the column “Y 1 Y 2 ... Y m ” belongs to the cluster α.

[Fifth embodiment]
Next, an alarm prediction system 1 according to the fifth embodiment will be described. In each of the above embodiments, the user could not know the prediction process by the prediction model. In other words, the user cannot know what kind of event may occur between the current state and the occurrence of the alarm. On the other hand, if the user can know what kind of event may occur before the alarm occurs, the user can take action to prevent or avoid the occurrence of the alarm There is.

Therefore, the alarm prediction system 1 according to the fifth embodiment presents information until a predetermined event occurs. In the fifth embodiment, the same reference numerals as in the first embodiment are used to describe the portions having substantially the same functions as those in the first embodiment and the processes for executing the same processes. Omitted.

<Functional configuration>
First, the functional configuration of the alarm prediction system 1 according to the present embodiment will be described with reference to FIG. FIG. 19 is a functional configuration diagram of an example of the alarm prediction system 1 according to the fifth embodiment.

As illustrated in FIG. 19, the alarm prediction unit 107 of the alarm prediction device 10 according to the present embodiment uses a state information number 130 until a prediction target alarm is generated when a prediction target alarm is generated. An event that may occur in the device 40 is predicted. Then, the alarm prediction unit 107 notifies the monitoring device 20 of the prediction result. Note that the prediction result includes information on an event signal (that is, an event that may occur in the device 40) that may be transmitted from the device control apparatus 30 until the prediction target alarm is generated. .

Thereby, for example, a plant operator or the like can know an event that may occur in the device 40 before a prediction target alarm is generated based on the prediction result. The state information number 130 is a number for uniquely identifying the state information included in the prediction model, as will be described later. The status information number 130 is stored in the RAM 14 or the like, for example.

Here, the prediction model stored in the prediction model storage unit 120 of the alarm prediction device 10 according to the present embodiment will be described with reference to FIG. FIG. 20 is a diagram for explaining an example of the prediction model stored in the prediction model storage unit.

As shown in FIG. 20, the prediction model includes one or more “state information” and “distance” associated with “state information”. Further, the “state information” is given a “number” for uniquely identifying the “state information” in the prediction model. Furthermore, the “status information” includes a “current event sequence” and a “subsequent event sequence”.

For example, the current event sequence of the state information with the number “4” is “A”, and the subsequent event sequence is “B, C, D”. This is because when the alarm prediction device 10 receives an event “A” from the device control device 30 (more precisely, when an event signal encoded as an event “A” is received), the event “B”, When “C” and “D” are received in this order, a prediction target alarm is generated. Further, the distance “L 4 ” is an index value (for example, prediction time) until the prediction target alarm is generated when the event “A” is received from the device control device 30, and the prediction target alarm becomes smaller as the distance becomes smaller. It shows that the time until the occurrence of is short.

Similarly, for example, the current event sequence of the state information with the number “5” is “A, B”, and the subsequent event sequence is “C, D”. This is because, when the alarm prediction device 10 receives events from the device control device 30 in the order of “A” and “B”, if the event “C” and “D” are subsequently received in that order, a prediction target alarm is generated. Show. The distance “L 5 ” is an index value until the prediction target alarm is generated when the events “A” and “B” are sequentially received from the device control apparatus 30. Here, the relationship between the distance “L 4 ” and the distance “L 5 ” is described as L 4 > L 5 .

Further, for example, the current event sequence of the state information with the number “6” is “A, B, C”, and the subsequent event sequence is “D”. This indicates that when the alarm prediction device 10 receives events from the device control device 30 in the order of “A”, “B”, and “C”, when the event “D” is received thereafter, a prediction target alarm is generated. ing. Further, the distance “L 6 ” is an index value until the prediction target alarm is generated when the events “A”, “B”, and “C” are sequentially received from the device control apparatus 30. Here, the relationship between the distance “L 6 ”, the distance “L 4 ”, and the distance “L 5 ” is described as L 4 > L 5 > L 6 .

<Details of processing>
Next, details of processing of the alarm prediction system 1 according to the present embodiment will be described.

≪Prediction model creation≫
First, the process of creating a prediction model in the “model creation” phase will be described with reference to FIG. FIG. 21 is a flowchart of an example of a prediction model creation process according to the fifth embodiment. Hereinafter, as an example, a case where the prediction model shown in FIG. 20 is created will be described.

In step S2101, the user designates an alarm to be predicted from the input device 11 or the like. Then, the prediction target alarm setting unit 102 sets the alarm designated by the user as the prediction target alarm. Here, it is assumed that the user has designated an event (alarm) represented by the symbol “F” as a prediction target alarm.

In step S2102, the event sequence extraction unit 103 extracts from the event information storage unit 110 an event sequence that includes the prediction target alarm “F” set by the prediction target alarm setting unit 102 at the end. Here, the event sequence extraction unit 103 uses, for example, a sequential pattern mining (sequence pattern mining) method disclosed in Japanese Patent Application Laid-Open No. 2004-157830 as an event sequence including the prediction target alarm “F”. What is necessary is just to extract from the information storage part 110.

More specifically, the event sequence extraction unit 103 inputs a minimum appearance frequency a, a minimum event sequence length min, and a maximum event sequence length max specified in advance by a user or the like, and performs sequence pattern mining to generate a plurality of event sequences. To extract. In the following description, it is assumed that three event sequences “ABCDEF”, “ABDF”, and “BCDF” have been extracted.

In step S2103, the prediction model creation unit 104 extracts an event sequence preceding the prediction target alarm in the extracted event sequence.

More specifically, for the event sequences “ABCDEF”, “ABDF”, and “BCDF” extracted in step S2102, the event sequences “ABCDE”, “ABD”, which precede the prediction target alarm “F”, respectively. Extract “BCD”.

In step S2104, the prediction model creation unit 104 creates state information in which “current event sequence” is “none” and “subsequent event sequence” is the event sequence extracted in step S2103, and each distance is determined. Set to maximum. Then, a “number” is assigned to each state information, and a prediction model is created.

More specifically, state information is created in which “current event sequence” is “none” and “subsequent event sequence” is the event sequence “ABCDE” extracted in step S2103, and the distance is set to L 1 ( = Max). This state information is number “1”.

Similarly, state information is created in which “current event sequence” is “none” and “subsequent event sequence” is the event sequence “ABD” extracted in step S2103, and the distance is set to L 2 (= Max). Set to. This state information is number “2”.

Similarly, state information is created in which “current event sequence” is “none” and “subsequent event sequence” is the event sequence “BCD” extracted in step S2103, and the distance is set to L 3 (= Max). This state information is number “3”.

The state information and distance of numbers “1” to “3” created as described above are used as a prediction model. That is, as a result, the portion shown in FIG. 20A is created in the prediction model shown in FIG.

In step S2105, the prediction model creation unit 104 creates state information in which a part of the “subsequent event sequence” of the one state information having the maximum distance is set as the “current event sequence”. Details of this processing will be described later.

In step S2106, the prediction model creation unit 104 determines whether there is other state information whose distance is set to the maximum. If there is other state information in which the distance is set to the maximum, the process returns to step S2105. On the other hand, if there is no other state information whose distance is set to the maximum, the process is terminated. This means that the process of step S2105 is executed for all state information whose distance is set to the maximum. More specifically, this means that the processing of step S2105 is executed for all the status information items “1” to “3” shown in FIG.

Next, details of the processing in step S2105 described above will be described with reference to FIG. Hereinafter, a case where the process of step S2105 is executed for the status information of number “1” illustrated in FIG.

In step S2201, the prediction model creation unit 104 creates state information in which the first event in the “subsequent event sequence” is moved to the end of the “current event sequence”.

More specifically, state information obtained by moving the first event sequence “A” of the subsequent event sequence “ABCD” to the end of the current event sequence “none”, that is, the subsequent event sequence is “BCD”, The status information whose current event string is “A” is created.

In step S2202, the prediction model creation unit 104 calculates the distance from the last event in the “current event sequence” to the last event in the “subsequent event”, and the state information created in step S2201 above. Set to. Then, a “number” is assigned to the created state information and added to the prediction model.

More specifically, as shown in FIG. 23A, the time from the event “A” at the end of the “current event sequence” to the event “D” at the end of the “subsequent event sequence” is calculated. This is referred to as distance L 4. That is, the difference between the time when the event “B” occurs and the time when the event “A” occurs is t 1 , and the difference between the time when the event “C” occurs and the time when the event “B” occurs is t 2 , When the difference between the time at which the event “D” occurs and the time at which the event “C” occurs is t 3 , the distance L 4 = t 1 + t 2 + t 3 is calculated. And this state information is added to the prediction model shown in FIG. 20 as number "4".

In step S2203, the prediction model creation unit 104 determines whether or not the number of events in the “subsequent event sequence” in the state information created in step S2202 is 1. If the number of events in the “subsequent event sequence” is not 1, the process returns to step S2201. On the other hand, if the number of events in the “subsequent event sequence” is 1, the process is terminated. That is, the series of processes shown in FIG. 22, the prediction modeling unit 104, status information and distance L 5 in number "5" as shown in FIG. 20 (b), as well as status information and the distance L 6 in number "6" Create and add to the predictive model. At this time, the distance L 5 and the distance L 6 are respectively calculated as L 5 = t 2 + t 3 and L 6 = t 3 as shown in FIGS. 23 (b) and 23 (c), respectively.

Similarly to the above, the state information and distance shown in FIG. 20C are added to the prediction model by performing a series of processing shown in FIG. 22 for the state information of number “2” shown in FIG. Is done. Similarly, the state information and the distance shown in FIG. 20D are added to the prediction model by performing a series of processing shown in FIG. 22 for the state information of the number “3” shown in FIG. Is done. In this way, in the present embodiment, a prediction model for predicting the prediction target alarm is created in the “prediction” phase.

In step S2202 in FIG. 22, the distance is calculated based on the difference in time when the event occurred as shown in FIG. 23, but the present invention is not limited to this. For example, a predetermined weight is assigned to the difference in time at which the event occurs. The distance may be calculated by going. That is, as shown in FIG. 24A, the number of times “A” appears in the event information storage unit 110 is “C 1 ”, the number of times “AB” appears is “C 2 ”, and “ABC” appears. The number of times is “C 3 ”, and the number of times “ABCD” appears is “C 4 ”. In this case, the distance L 4 may be calculated by the following equation. In addition, what is necessary is just to use the technique of a known character string search for such appearance frequency.

Figure JPOXMLDOC01-appb-M000001
Similarly, as shown in FIG. 24 (b), the distance L 5 may be calculated by the following equation.

Figure JPOXMLDOC01-appb-M000002
Similarly, as shown in FIG. 24 (c), the distance L 6 may be calculated by the following equation.

Figure JPOXMLDOC01-appb-M000003
The same applies to the distances L 7 to L 10 . That is, for example, for the distance L 7 and the distance L 8 , a coefficient (weighting coefficient) based on the number of times “A” appears, the number of times “AB” appears, and the number of times “ABD” appears in the event information storage unit 110. And weighting may be performed in the same manner as described above. For example, the distance L 9 and the distance L 10 are described above using the number of times “B” appears, the number of times “BC” appears, and the number of times “BCD” appears in the event information storage unit 110. Similarly, weighting may be performed. In this way, by weighting by the number of appearances in the distance calculation formula, it is possible to reflect the value evaluation that the event sequence having a high appearance frequency has a high importance in the calculated distance value.

≪Alarm prediction process≫
Next, the process of the “prediction” phase for predicting the occurrence of an alarm based on the prediction model created in the “model creation” phase will be described with reference to FIG. FIG. 25 is a flowchart of an example of an alarm prediction process according to the fifth embodiment. In the following description, it is assumed that the prediction model created in the “model creation” phase is the prediction model shown in FIG.

In step S2501, the alarm prediction unit 107 acquires the number of the state information in which the maximum distance is set among the state information included in the prediction model stored in the prediction model storage unit 120. Then, the alarm prediction unit 107 stores the acquired number as a state information number 130 in a memory such as the RAM 14, for example.

More specifically, the alarm prediction unit 107 acquires the number “1”, “2”, and “3” of the state information in which the maximum distance is set from the prediction model shown in FIG. Then, the alarm prediction unit 107 holds the acquired number as the state information number 130. Accordingly, at this time, the state information number 130 is {1, 2, 3}.

In step S2502, the alarm prediction device 10 receives an event signal from the device control device 30.

In step S2503, the symbolizing unit 101 converts the event signal received from the device control apparatus 30 into a predetermined symbol. The symbolizing unit 101 stores the symbolized event signal (event) in the event information storage unit 110. Here, for the sake of convenience, the event stored in the event information storage unit 110 in this step is represented as a “determination target event”.

In step S2504, the alarm prediction unit 107 determines whether or not the determination target event matches the first event in the “subsequent event sequence” of the state information with the number held as the state information number 130. If the determination target event matches the first event in the “subsequent event sequence” of the status information of any number held as the status information number 130, the process proceeds to step S 2505. On the other hand, if the determination target event does not match the first event in the “subsequent event sequence” of the state information of all the numbers held as the state information number 130, the process returns to step S2501.

More specifically, for example, when the number held as the state information number 130 is {1, 2, 3} and the determination target event is “A”, the alarm prediction unit 107 sets the numbers “1” and “2”. ”In the“ subsequent event string ”. Similarly, for example, when the determination target event is “B”, the alarm predicting unit 107 sets the “subsequent event sequence” of the number “3” among the numbers {1, 2, 3} held as the state information number 130. It is determined that it matches the first event “B”. On the other hand, when the determination target event is “C”, the alarm prediction unit 107 sets the “subsequent event sequence” of the state information of all the numbers {1, 2, 3} held as the state information number 130. It is determined that the head event does not match.

In step S2205, the alarm prediction unit 107 deletes from the state information number 130 the number of the state information determined not to match in step S2504. In addition, the alarm prediction unit 107 sets the state information number determined to match in step S2504 in the state information number 130, and the first event in the “subsequent event string” of the state information of the number “current”. Update to the number of the status information moved to the end of the “event string”.

More specifically, for example, the number held as the status information number 130 is {1, 2, 3}, the status information numbers determined to match are “1” and “2”, and the status is determined not to match When the information number is “3”, the alarm prediction unit 107 deletes “3” from the state information number 130. Further, the alarm prediction unit 107 moves the number “1” and the state information number “A” in the “subsequent event sequence” of the status information of the number to the end of the “current event sequence”. Update to "4". Similarly, the alarm prediction unit 107 moves the number “2” and the state information number obtained by moving the first event “A” of the “subsequent event sequence” of the state information of the number to the end of the “current event sequence”. Update to “7”. Therefore, the number held as the status information number 130 is {4, 7}.

Similarly, for example, when the number held as the status information number 130 is {4, 7} and the status information numbers determined to be coincident are “4” and “7”, the alarm prediction unit 107 sets the number “ 4 ”is updated to the number“ 5 ”of the status information obtained by moving the first event“ B ”of the“ subsequent event sequence ”of the status information of the number to the end of the“ current event sequence ”. Also, the alarm prediction unit 107 moves the number “7” and the state information number “B” in the “subsequent event sequence” of the status information of the number to the end of the “current event sequence”. To 8 ”. Therefore, the number held as the state information number 130 is {5, 8}.

In step S2506, the alarm prediction unit 107 acquires the state information of the number held as the state information number 130 from the prediction model storage unit 120. Then, the alarm prediction unit 107 transmits a prediction result including the acquired state information to the monitoring device 20 to display an alarm prediction screen G500 as shown in FIG. 26, for example.

That is, the monitoring device 20 displays “current event sequence” and “subsequent event sequence” of the state information included in the prediction result. An alarm prediction screen G500 illustrated in FIG. 26 illustrates an alarm prediction screen when a prediction result including state information of number “5” and number “8” is transmitted to the monitoring device 20.

In addition, “predicted time until alarm occurrence” is displayed on the alarm prediction screen G500 shown in FIG. This is the maximum, minimum, and average distance of the state information included in the prediction result. In the alarm prediction screen G500 shown in FIG. 26, the distance L 5 (= 20 minutes) of the state information with the number “5” as “maximum” and the distance L 8 (= 10) of the state information with the number “8” as “minimum”. Minute), and “average” (= 15 minutes) of distance L 5 and distance L 8 are displayed. As a result, for example, an operator such as a plant can generate a current event sequence that has occurred and a subsequent event sequence that may occur when a prediction target alarm occurs on the alarm prediction screen G500 displayed on the monitoring device 20. You can know. Further, for example, an operator such as a plant can know the maximum, minimum, and average prediction times when a prediction target alarm occurs.

As described above, for example, a user such as an operator of a plant or the like can set the subsequent event sequence displayed on the alarm prediction screen G500 illustrated in FIG. 26 and the predicted time until the prediction target alarm is generated. Based on this, it is possible to take measures to prevent or avoid the occurrence of the prediction target alarm.

In step S2506, the alarm prediction unit 107 may transmit a prediction result including the prediction reliability for each state information to the monitoring device 20 to display an alarm prediction screen G600 as shown in FIG. 27, for example. good.

That is, as shown in FIG. 26, the monitoring device 20 may further display an alarm prediction screen G600 on which “prediction reliability” for each state information is displayed. Here, for example, when the state information is the prediction model in the first embodiment, the prediction reliability may be the misprediction rate and the prediction failure rate of the prediction model. Therefore, the alarm prediction unit 107 may transmit the prediction result including the state information acquired from the prediction model storage unit 120 and the erroneous prediction rate and the predicted omission rate of the acquired state information to the monitoring device 20.

Thereby, for example, a user such as an operator of a plant or the like can generate a prediction target alarm or a generation of the prediction target alarm based on the “prediction reliability” displayed on the alarm prediction screen G600 illustrated in FIG. It becomes possible to know the reliability of the prediction time.

Note that the misprediction rate and the predicted omission rate are calculated by the prediction model evaluation unit 105 by the same method as in the first embodiment, for example, when the state information is the prediction model in the first embodiment. . However, the prediction reliability is not limited to the false prediction rate and the prediction failure rate. For example, the correct answer rate, the incorrect answer rate, the precision / accuracy, the sensitivity / true positive rate / detection rate, the specificity / true negative rate, and the false positive It may be an index such as a rate or a false negative rate.

In step S2507, the alarm prediction unit 107 determines whether or not any distance of the state information of the number held as the state information number 130 is equal to or less than a predetermined threshold value set in advance. If there is no distance equal to or smaller than the predetermined threshold, the process returns to step S2502. On the other hand, if there is a distance equal to or smaller than the predetermined threshold, the process proceeds to step S2508.

In step S2508, the alarm prediction unit 107 transmits a notification indicating that the occurrence of the prediction target alarm is near to the monitoring device 20. When the monitoring device 20 receives the notification, the monitoring device 20 displays a message indicating that the occurrence of the prediction target alarm is near, for example, on the alarm prediction screen. Thereby, for example, an operator such as a plant can know that the generation of the prediction target alarm is near. Note that the monitoring device 20 may emit a warning sound or the like indicating that the occurrence of the prediction target alarm is near.

<Summary>
As described above, the alarm prediction system 1 according to the first embodiment creates a prediction model for predicting a specified alarm based on events accumulated as time series data. In addition, at this time, evaluation values such as a prediction omission rate and an erroneous prediction rate of the created prediction model are presented to the user. Therefore, the user can know whether or not the created prediction model has a desired prediction accuracy before performing prediction based on the prediction model.

Further, in the alarm prediction system 1 according to the second embodiment and the third embodiment, a plurality of prediction models for predicting a specified alarm are created based on time-series data and accumulated events. At this time, as in the first embodiment, the evaluation values such as the prediction failure rate and the misprediction rate of the created prediction models are presented to the user. Therefore, the user can select a prediction model having desired prediction accuracy from the plurality of created prediction models.

Further, in the alarm prediction system 1 according to the fourth embodiment, a prediction model that takes into account the time interval at which an event occurs is created using a clustering technique. Thereby, a prediction model with high prediction accuracy can be created.

Furthermore, in the alarm prediction system 1 according to the fifth embodiment, a prediction model for predicting a specified alarm is created, and an event sequence or occurrence that may occur when a prediction target alarm occurs Present information such as time to do. Therefore, the user can take measures to prevent or avoid the occurrence of the prediction target alarm based on the presented information.

Note that the present invention is not limited to the specifically disclosed embodiment, and various modifications and changes can be made without departing from the scope of the claims.

DESCRIPTION OF SYMBOLS 1 Alarm prediction system 10 Alarm prediction apparatus 20 Monitoring apparatus 30 Apparatus control apparatus 40 Apparatus 101 Symbolization part 102 Prediction object alarm setting part 103 Event sequence extraction part 104 Prediction model creation part 105 Prediction model evaluation part 106 Display control part 107 Alarm prediction part 110 Event information storage unit 120 Prediction model storage unit 130 State information number

Claims (16)

  1. An alarm prediction device that predicts the occurrence of an abnormality based on time-series event information output by equipment or equipment,
    Extraction means for extracting, from a plurality of event information stored in advance in a predetermined storage area according to a time series, a first event information column that includes prediction target event information indicating the occurrence of an abnormality of the prediction target at the end;
    A second event information column obtained by removing the prediction target event information from the first event information column extracted by the extraction unit is extracted, and a prediction model is created based on the second event information column. Model creation means;
    An alarm prediction device comprising: display means for displaying an evaluation value of the model created by the model creation means on a display device.
  2. The extraction means includes
    From a plurality of event information stored in advance in a predetermined storage area according to a time series, extract a plurality of first event information columns including the prediction target event information indicating the occurrence of the prediction target abnormality at the end,
    The model creation means includes
    A plurality of second event information columns excluding the prediction target event information are extracted from each of the plurality of first event information columns, and a plurality of prediction models are based on the plurality of second event information columns. The alarm prediction device according to claim 1, wherein
  3. 3. The alarm prediction device according to claim 2, wherein the extraction means extracts all the plurality of first event information columns which are equal to or greater than one and equal to or less than a predetermined length specified in advance.
  4. First calculation means for calculating a first appearance count at which the first event information column appears in the plurality of event information stored in advance in the predetermined storage area;
    In a plurality of pieces of event information stored in advance in the predetermined storage area, a second appearance count in which an event information column other than the second event information column appears before the prediction target event information is calculated. A second calculating means;
    In a plurality of pieces of event information stored in advance in the predetermined storage area, a third appearance number is calculated for event information other than the prediction target event information appearing after the second event information column. Calculating means,
    The display means includes
    4. The display device according to claim 1, wherein the first appearance count, the second appearance count, and the third appearance count are displayed on a display device as an evaluation value of a model created by the model creation means. The alarm prediction device according to item 1.
  5. Based on the first number of appearances and the second number of appearances, a prediction omission rate indicating a probability that an event information column other than the second event information column appears before the prediction target event information is calculated. A fourth calculating means;
    Based on the first number of appearances and the second number of appearances, a fifth misprediction rate is calculated that indicates a probability that event information other than the prediction target event information appears after the second event information column. Calculating means,
    The display means includes
    Furthermore, the alarm prediction apparatus of Claim 4 which displays the said prediction failure rate and the said false prediction rate.
  6. Among the plurality of event information stored in advance in the predetermined storage area, for each event information included in the same event information column as the second event information column extracted by the model creating unit, Classification means for extracting the third event information column by classifying the same event information column based on the interval of time at which each event information occurred,
    The first calculation means includes
    For each third event information extracted by the classifying means, calculate the first number of appearances of the prediction target event information after the third event information,
    The third calculation means includes:
    5. For each of the third event information extracted by the classifying means, a third appearance count at which event information other than the prediction target event information appears after the column of the third event information is calculated. Or the alarm prediction apparatus of 5.
  7. An alarm prediction device that predicts the occurrence of an abnormality based on time-series event information output by equipment or equipment,
    Extraction means for extracting, from a plurality of event information stored in advance in a predetermined storage area according to a time series, a first event information column that includes prediction target event information indicating the occurrence of an abnormality of the prediction target at the end;
    A second event information column obtained by removing the prediction target event information from the first event information column extracted by the extraction unit is extracted, and a prediction model is created based on the second event information column. Model creation means;
    Based on the prediction model created by the model creation means and time-series event information output from the equipment or equipment, the equipment or equipment until the prediction target event information occurs in the prediction model. An alarm prediction device comprising: prediction means for displaying event information whose output is predicted from
  8. The model creation means includes
    The second event information column is divided into a third event information column and a fourth event information column, from event information at the end of the third event information column to the prediction target event information. And a prediction model is created based on the third event information sequence, the fourth event information sequence and the distance,
    The prediction means includes
    The alarm prediction device according to claim 7, further displaying the distance.
  9. The distance is the time until the prediction target event information is generated when the same event information column as the third event information column is output from the device or facility in the created prediction model. The alarm prediction device according to claim 8, wherein
  10. The prediction means includes
    The alarm prediction device according to claim 9, wherein a maximum time, a minimum time, and an average time until the prediction target event information occurs is calculated based on the distance, and the maximum time, the minimum time, and the average time are displayed. .
  11. The distance is the time until the prediction target event information is generated when the same event information column as the third event information column is output from the device or facility in the created prediction model. The alarm prediction device according to claim 8, wherein the alarm prediction device is calculated based on the second event information column and a predetermined coefficient calculated from the second event information sequence.
  12. The prediction means includes
    The alarm according to any one of claims 8 to 10, wherein when the displayed distance is equal to or less than a predetermined threshold set in advance, a notification indicating that the occurrence of the prediction target event information is predicted is performed. Prediction device.
  13. An alarm prediction method used in an alarm prediction device for predicting the occurrence of an abnormality based on time-series event information output by equipment or equipment,
    An extraction procedure for extracting, from a plurality of pieces of event information stored in advance in a predetermined storage area according to a time series, a first event information column including the prediction target event information indicating the occurrence of the prediction target abnormality at the end;
    A second event information column obtained by removing the prediction target event information from the first event information column extracted by the extraction procedure is extracted, and a prediction model is created based on the second event information column. Model creation procedure,
    A display procedure for causing a display device to display an evaluation value of the model created by the model creation procedure.
  14. An alarm prediction method used in an alarm prediction device for predicting the occurrence of an abnormality based on time-series event information output by equipment or equipment,
    An extraction procedure for extracting, from a plurality of pieces of event information stored in advance in a predetermined storage area according to a time series, a first event information column including the prediction target event information indicating the occurrence of the prediction target abnormality at the end;
    A second event information column obtained by removing the prediction target event information from the first event information column extracted by the extraction procedure is extracted, and a prediction model is created based on the second event information column. Model creation procedure,
    Based on the prediction model created by the model creation procedure and the time-series event information output from the device or equipment, the equipment or equipment until the prediction target event information occurs in the prediction model. An alarm prediction method comprising: a prediction procedure for displaying event information whose output is predicted from
  15. An alarm prediction device that predicts the occurrence of an abnormality based on time-series event information output by equipment or equipment,
    Extraction means for extracting a first event information column including the prediction target event information indicating the occurrence of the prediction target abnormality from the plurality of event information stored in advance in a predetermined storage area according to time series,
    A model creation unit for extracting a second event information column obtained by removing the prediction target event information from the first event information column extracted by the extraction unit, and creating a prediction model;
    A program for functioning as display means for displaying an evaluation value of a model created by the model creation means on a display device.
  16. An alarm prediction device that predicts the occurrence of an abnormality based on time-series event information output by equipment or equipment,
    Extraction means for extracting a first event information column including the prediction target event information indicating the occurrence of the prediction target abnormality from the plurality of event information stored in advance in a predetermined storage area according to time series,
    A second event information column obtained by removing the prediction target event information from the first event information column extracted by the extraction unit is extracted, and a prediction model is created based on the second event information column. Model creation means,
    Based on the prediction model created by the model creation means and time-series event information output from the equipment or equipment, the equipment or equipment until the prediction target event information occurs in the prediction model. A program for functioning as a prediction means for displaying event information that is predicted to be output from
PCT/JP2016/076914 2016-09-13 2016-09-13 Alarm prediction apparatus, alarm prediction method, and program WO2018051394A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/JP2016/076914 WO2018051394A1 (en) 2016-09-13 2016-09-13 Alarm prediction apparatus, alarm prediction method, and program

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
PCT/JP2016/076914 WO2018051394A1 (en) 2016-09-13 2016-09-13 Alarm prediction apparatus, alarm prediction method, and program
JP2017545983A JP6358401B1 (en) 2016-09-13 2016-09-13 Alarm prediction device, alarm prediction method, and program

Publications (1)

Publication Number Publication Date
WO2018051394A1 true WO2018051394A1 (en) 2018-03-22

Family

ID=61618709

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2016/076914 WO2018051394A1 (en) 2016-09-13 2016-09-13 Alarm prediction apparatus, alarm prediction method, and program

Country Status (2)

Country Link
JP (1) JP6358401B1 (en)
WO (1) WO2018051394A1 (en)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH0736648A (en) * 1993-07-19 1995-02-07 Toshiba Corp Monitor and display device
JP2014127093A (en) * 2012-12-27 2014-07-07 Yokogawa Electric Corp Event analyzer and computer program
JP2016099938A (en) * 2014-11-26 2016-05-30 株式会社日立製作所 Event analysis system and method

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP5364530B2 (en) * 2009-10-09 2013-12-11 株式会社日立製作所 Equipment state monitoring method, monitoring system, and monitoring program

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH0736648A (en) * 1993-07-19 1995-02-07 Toshiba Corp Monitor and display device
JP2014127093A (en) * 2012-12-27 2014-07-07 Yokogawa Electric Corp Event analyzer and computer program
JP2016099938A (en) * 2014-11-26 2016-05-30 株式会社日立製作所 Event analysis system and method

Also Published As

Publication number Publication date
JPWO2018051394A1 (en) 2018-09-13
JP6358401B1 (en) 2018-07-18

Similar Documents

Publication Publication Date Title
US10254953B2 (en) Text input method using continuous trace across two or more clusters of candidate words to select two or more words to form a sequence, wherein the candidate words are arranged based on selection probabilities
US9471220B2 (en) Posture-adaptive selection
US8819574B2 (en) Space prediction for text input
CN101681218B (en) Visual feedback display
US20180082217A1 (en) Population-Based Learning With Deep Belief Networks
US9021304B2 (en) Fault analysis rule extraction device, fault analysis rule extraction method and storage medium
US20170228278A1 (en) Detecting anomalies in an internet of things network
CN105431809A (en) Virtual keyboard input for international languages
JP4413915B2 (en) Abnormal sign detection apparatus and method
CN103080954B (en) For the method and system of the flying quality recorded during analyzing aircraft flight
US8836667B2 (en) User interface for handwriting inputs
US9317201B2 (en) Predictive virtual keyboard
JP5236564B2 (en) Software reuse support method and apparatus
CN104424354A (en) Detecting Anomalous User Behavior Using Generative Models of User Actions
US20130204808A1 (en) Fault Prediction of Monitored Assets
EP2364467B1 (en) Method for recognising sequential patterns for a method for fault message processing
TWI510916B (en) Storage device lifetime monitoring system and storage device lifetime monitoring method thereof
US9183067B2 (en) Data preserving apparatus, method and system therefor
JP5988740B2 (en) Maintenance management equipment for operating machines
CN106104496A (en) The abnormality detection not being subjected to supervision for arbitrary sequence
JP5285084B2 (en) System for supporting action execution according to detection event, method for supporting action execution according to detection event, support apparatus, and computer program
US9292473B2 (en) Predicting a time of failure of a device
US8698616B2 (en) Monitor control system
CN105022957B (en) The method and its electronic device of on-demand detection rogue program
US10120747B2 (en) Root cause analysis

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2017545983

Country of ref document: JP

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16916180

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase in:

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16916180

Country of ref document: EP

Kind code of ref document: A1