WO2020245968A1 - Abnormality sign detection device, abnormality sign detection method, and abnormality sign detection program - Google Patents

Abstract

This abnormality sign detection device (100) comprises: an abnormality degree calculation unit (106) that calculates an abnormality degree of partial time-series data on the basis of a feature amount of the partial time-series data that is at least a portion of time-series data; an abnormality sign determination unit (108) that determines, as abnormality sign data, the partial time-series data when the abnormality degree of the partial time-series data exceeds a threshold value; and a normality determination unit (110) that calculates the reliability of abnormality sign data on the basis of feature data corresponding to a feature amount of the abnormality sign data, and determines, as normal data, the abnormality sign data when the reliability cannot be permitted.

Description

Abnormal sign detection device, abnormal sign detection method, and abnormal sign detection program

The present invention relates to an abnormality sign detection device, an abnormality sign detection method, and an abnormality sign detection program.

In recent years, as part of data utilization, efforts have been made in various fields to estimate the system status using data that can be acquired from the system and to detect abnormal signs to identify future abnormalities.

The conventional monitoring system monitors the occurrence of anomalies, and as a specific example, it is a rule-based anomaly detection that is realized using conditions that can be clearly judged, such as individual sensor values exceeding a certain threshold value. there were. When such a monitoring system is used, it is possible to determine an abnormality, but it is difficult to detect an abnormality sign.

In the detection of abnormal signs of a system such as a power plant, which is regularly maintained and has few failures in the past, it is almost impossible to collect data including abnormal signs. Therefore, it is difficult to catch abnormal signs by supervised learning focusing on the difference between the data in the normal state and the data in the abnormal state.

Therefore, in the power plant abnormality sign detection system, a normal model corresponding to the normal state is generated from the data of the power plant in the normal state, and the degree of deviation between the normal model and the verification target data is defined as the degree of abnormality. When the degree of abnormality exceeds a certain threshold value, abnormality sign detection by unsupervised learning is used, which detects it as data representing a sign of abnormality.

When using unsupervised learning, the acquired data is converted into features, and the pattern, regularity, distribution, etc. of the data are analyzed based on the features to generate a normal model. At this time, in order to determine the features used to generate the normal model, it is attempted to generate a plurality of normal models based on the features expected to be effective, and the degree of appropriateness of the normal model is determined. Are individually confirmed and the most appropriate normal model is adopted.

In order to automatically enumerate these features and judge the effectiveness of each model, the coverage rate of data in the normal state is important. However, it is difficult to comprehensively learn the data of the normal state in the actual operation from the viewpoint that it is difficult to create the situation as well as collecting the data of the abnormal state in the system in which the abnormality hardly occurs. .. In addition, there are issues to be examined regarding the decision policy of what kind of features should be used to attempt model generation, and how it is appropriate to determine the threshold value for determining an abnormal sign.

In addition, it can be said that it is difficult to comprehensively learn the data in the normal state in actual operation from the viewpoint of increasing the amount of data to be handled.

Patent Document 1 cuts out an event sequence from an event signal representing the state of human operation and at least one of the units, which can be obtained from the equipment, and generates in advance a matrix of the event sequence and the frequency of alarms generated within a predetermined time. By doing so, it discloses a method for distinguishing a deviation from the normal state caused by a change in the state of at least one of the human operation and the unit.
According to the method disclosed in Patent Document 1, it is possible to remove the influence of the state change of the equipment based on human operation or the like at the time of constructing the normal model and improve the detection accuracy.

Japanese Unexamined Patent Publication No. 2011-081697

However, when a normal model is generated using learning data with low coverage for the range of data that can be obtained by normal system operation, the evaluation target data that is actually normal may be judged as abnormal. In many cases, there was a problem that the accuracy of judgment was low.

The abnormality sign detection device of the present invention
An abnormality degree calculation unit that calculates the abnormality degree of the partial time series data based on the feature amount of the partial time series data that is at least a part of the time series data.
When the degree of abnormality of the partial time-series data exceeds the threshold value, the abnormality sign determination unit that determines the partial time-series data as abnormality sign data,
A normal determination unit that calculates the reliability of the abnormal sign data based on the feature data corresponding to the feature amount of the abnormal sign data, and determines the abnormal sign data as normal data when the reliability cannot be tolerated. With and
The normal determination unit stores the abnormal feature data corresponding to the feature amount of the abnormal sign data in the feature data storage unit as the feature data.

According to the abnormality sign detection device of the present invention, even when a normal model is generated using learning data having low comprehensiveness, the normal determination unit determines the abnormal sign data using the feature amount of the abnormal sign data. By doing so, the accuracy of determining the partial time series data can be improved.

FIG. 3 is a configuration diagram of an abnormality sign detection system using the abnormality sign detection device 100 according to the first embodiment. The block diagram of the normal determination part 110 which concerns on Embodiment 1. FIG. The data structure of the feature data storage unit 109 according to the first embodiment. The data structure of the feature data storage unit 109 according to the first embodiment. The hardware block diagram of the abnormality sign detection apparatus 100 which concerns on Embodiment 1. FIG. The flowchart which shows the operation of the learning phase of the abnormality sign detection apparatus 100 which concerns on Embodiment 1. The flowchart which shows the operation of the operation phase of the abnormality sign detection apparatus 100 which concerns on Embodiment 1. FIG. The flowchart which shows the operation of the normal determination part 110 which concerns on Embodiment 1. The flowchart which shows the operation of the reliability determination unit 202 which concerns on Embodiment 1. The conceptual diagram of the reliability determination process which concerns on Embodiment 1. FIG. The block diagram of the normal determination part 110 which concerns on Embodiment 2. FIG. The flowchart which shows the process of the normal determination part 110 which concerns on Embodiment 2. FIG. 3 is a configuration diagram of an abnormality sign detection system using the abnormality sign detection device 100 according to the third embodiment. The flowchart which shows the operation of the abnormality sign detection apparatus 100 which concerns on Embodiment 3.

Embodiment 1.
Hereinafter, the present embodiment will be described in detail with reference to the drawings.

*** Explanation of configuration ***
FIG. 1 shows an example of the configuration of the abnormality sign detection device 100 according to the present embodiment and an example of the configuration of the abnormality sign detection system using the abnormality sign detection device 100.
The arrows in the figure represent the flow of data. During the execution of the anomaly sign detection device 100, the data flows in the direction of the arrowhead, and if the arrowheads are at both ends, the data flows in either direction.

The abnormality sign detection device 100
Acquire time series data related to sensor data and operation data from the target equipment 101,
It is a device that detects the presence or absence of abnormal signs from the sensor data at each time.
Data transmission from the target equipment 101 to the abnormality sign detection device 100 may be performed by any method. The abnormality sign detection device 100 and the target equipment 101 are connected by a network, and the target equipment 101 may transmit data to the abnormality sign detection device 100 via the network.
The abnormality sign detection device 100 may be incorporated in the target equipment 101.

The abnormality sign detection device 100 can detect the abnormality sign based on the feature amount of the partial time series data which is at least a part of the time series data. However, for convenience of explanation, a case where the abnormality sign detection device 100 analyzes time-series data including sensor data will be described.
The following sensor data may be read as time series data or partial time series data.

The target equipment 101 is
The equipment for which the abnormality sign detection device 100 detects the presence or absence of an abnormality sign.
It can be anything that produces time series data.

The abnormality sign detection device 100 monitors the current operation status of the plant by utilizing the operation data representing the operation status of the equipment of various plants such as factories or power plants and the data acquired from the sensors incorporated in the equipment. Not only that, it is also possible to detect the possibility of future plant abnormalities.

The signs of abnormality are
The target equipment 101 has not reached an abnormal state because the threshold value has not been exceeded, but it is also considered to be a sign of an abnormality in the target equipment 101.
It also means that the state of the target equipment 101 is different from the normal state, which is the normal state.
The normal state is a normal state derived from the training data.
The time-series data includes data acquired by the abnormality sign detection device 100 in chronological order.
The sensor data is data acquired by the sensor of the target equipment 101. The sensor data includes data acquired by the sensor of the target equipment 101 at a certain time and data continuously acquired by the sensor of the target equipment 101 between two different times.
The operation data includes an operation performed by a person on the target equipment 101 and data indicating the result of the operation.

The detection result management unit 102 manages the sensor data and operation data output by the target equipment 101 in association with the result of the abnormality sign detection device 100 detecting the abnormality sign based on the sensor data.

The feature amount conversion unit 103
From the sensor data acquired by the abnormality sign detection device 100, the sensor data corresponding to the model used for the abnormality sign detection is extracted, and the sensor data is extracted.
Based on the extracted sensor data, the feature amount is calculated by arithmetic calculation etc.
If necessary, the sensor data output by the sensor of the target equipment 101 is subjected to processing such as dealing with missing values and removing noise.

The feature amount conversion unit 103
Any method may be applied to the extraction of sensor data.
For the calculation of the feature amount, a method of calculating the feature amount from the sensor data obtained by extracting each input sensor data with a fixed time width, or a method of calculating one feature amount from a plurality of sensor data at the same time, etc. , Any method may be applied.

The equipment state determination unit 104 executes a process of determining the equipment state, which is the state of the target equipment 101, based on the operation data.
The equipment state may include the operating status of a part or the whole of the target equipment 101 and the operation performed by a person or the like on the target equipment 101. The abnormality sign detection device 100 may set a state different from the state managed by the target equipment 101 as the state of the target equipment 101 as the equipment state.
When the equipment state determination unit 104 classifies the equipment state of the target equipment 101 into one or more equipment states, the target equipment 101 is equipment that can take one or more equipment states.

The equipment status determination unit 104 has a function of determining not only the equipment status of the entire target equipment 101 but also the equipment status of each smaller unit constituting the target equipment 101, specifically, for each component of the target equipment 101. It may be implemented. When the target equipment 101 is the entire power plant, specific examples of smaller units are a generator, a boiler, and the like.

The normal model generation unit 105 generates a normal model for each equipment state of the target equipment 101 based on the feature amount calculated by the feature amount conversion unit 103 and the equipment state determined by the equipment state determination unit 104.
The normal model generation unit 105 generates a normal model based on the learning data stored in the normal data storage unit 111.

When the normal model generation unit 105 uses the sensor data acquired by the abnormality sign detection device 100 as learning data,
The sensor data and the operation data corresponding to the sensor data are associated with each other and stored in the normal data storage unit 111.
When a predetermined condition is satisfied, such as when the number of sensor data stored in the normal data storage unit 111 reaches a certain number, a normal model is generated.
The normal model generation unit 105
Arbitrary conditions may be adopted as the conditions for generating a normal model.
Different conditions may be adopted for each equipment condition.

The normal model generation unit 105
When analyzing time-series data, it is not only possible to judge anomalies by focusing on the time-series movement of one sensor data.
As in the correlation analysis, the relationship between the movements and values between a plurality of sensor data can be focused on and the relationship can be considered as one feature quantity.

The normal model is
Corresponding to the range that the feature amount of the sensor data can be taken when the target equipment 101 is in the normal state,
Corresponding to the range that the feature amount of normal data can be taken,
Usually generated by unsupervised learning.
The feature quantity may be a one-dimensional value or a multidimensional value.

The abnormal sign detection system by unsupervised learning determines a "normal state" based on a state that has been seen so far, and determines a state that has never been seen as an "unnormal state".
The states that have been seen so far are the states included in the training data.
An "abnormal state" consists of a state showing a true sign of abnormality and a state determined by the abnormality sign detection system as a sign of abnormality but not really a sign of abnormality. The cause of the abnormal sign detection system determining that it is an abnormal sign but not really an abnormal sign is the area that is not covered by the learning data due to lack of training data, and it becomes a true normal state. It is possible to make a mistake in judging the data in the corresponding area.
The true normal state is the state in which the target equipment 101 is actually normal.
The "normal state" corresponds to the normal state.

The abnormality degree calculation unit 106 calculates the abnormality degree of each feature amount from the normal model generated by the normal model generation unit 105 and each feature amount calculated from the sensor data.

The abnormality degree calculation unit 106
Any definition of anomaly may be adopted
As a specific example, the degree of abnormality may be defined based on the distance between the normal model and the feature amount of the sensor data.
The anomaly degree calculation unit 106 may adopt an arbitrary definition of the distance between the normal model and the feature amount. As a specific example of the definition of the distance from the feature amount, the distance between the statistical representative value of the entire normal model such as the center of gravity and the feature amount may be used, which is an element of the normal model and is the normal one closest to the feature amount. It may be the distance between the elements of the model and the features.

The threshold value determination unit 107 performs a process of determining a threshold value for determining an abnormal sign based on a normal model or the like.
The threshold value determination unit 107 determines the threshold value for determining the abnormality sign in consideration of the degree of abnormality calculated from each feature amount.

The threshold value determination unit 107 may adopt an arbitrary method for threshold value determination, or may use a statistical method.
As a concrete example of the statistical method,
The normal model generation unit 105 uses the normal model as the average of the distribution of the features of the training data.
When the anomaly degree calculation unit 106 sets the anomaly degree as the distance between the feature amount of the sensor data and the normal model,
The threshold value determination unit 107 may determine the threshold value as a value based on the standard deviation of the distribution of the feature amount of the training data.
As a specific example, when the feature amount of the sensor data is outside the normal model ± 3σ, that is, when it is (normal model-3σ) or less, or (normal model + 3σ) or more, an abnormal sign is shown. It shall be. In this case, the threshold is 3σ. Σ is the standard deviation of the distribution of the degree of anomaly.
The abnormality degree calculation unit 106 may dynamically determine the threshold value according to the actual sensor data.

The abnormality sign determination unit 108 determines whether or not the abnormality degree of the feature amount calculated by the abnormality degree calculation unit 106 exceeds the threshold value determined by the threshold value determination unit 107, that is, whether or not the feature amount exceeds the threshold value. To do.

The abnormality sign determination unit 108
When the degree of abnormality of the feature amount of the sensor data exceeds the threshold value, the sensor data is determined as abnormality sign data, and the abnormality is determined.
In other cases, the sensor data is determined to be normal data.
Abnormal sign data is also a general term for sensor data in which abnormal signs are observed. Normal data is also a general term for sensor data with no signs of abnormality.

The feature data storage unit 109 stores the feature amount determined by the abnormality sign determination unit 108 to exceed the threshold value, that is, the abnormality feature data corresponding to the feature amount of the abnormality sign data as feature data. Here, the abnormal feature data is data that has some correspondence with the feature amount of the abnormal sign data.
Anomalous feature data
It may be data that aggregates the features of multiple abnormal sign data.
The data may have a one-to-one correspondence with the feature amount of the abnormality sign data.

The normal determination unit 110
The reliability of the abnormality sign data is calculated based on the feature data stored in the feature data storage unit 109 and the feature amount of the abnormality sign data.
Based on the reliability, it is determined whether or not the abnormality sign data is normal data.
Reliability is
The sensor data determined by the abnormality sign determination unit 108 as abnormality sign data indicates the degree to which the abnormality sign data is actually.
It may be calculated by any method. The reliability may be a truth value.
The abnormality sign data to be determined by the normal determination unit 110 is referred to as abnormality sign data to be determined.
The sensor data that has been determined to be the abnormality sign data of the abnormality sign determination unit 108 in the past and corresponds to the abnormality feature data stored in the feature data storage unit 109 is referred to as the past abnormality sign data.

FIG. 2 is a configuration diagram of the normal determination unit 110 according to the present embodiment.

The result confirmation unit 201
Check the determination result of the abnormality sign determination unit 108,
When the determination result is normal data, "normal" is output as the output of the normal determination unit 110.
When the determination result is the abnormality sign data, the "abnormal sign" is output.
“Normal” means that the target equipment 101 is in a normal state. The “abnormal sign” means that the target equipment 101 is not in a normal state.

The reliability determination unit 202
When the result confirmation unit 201 outputs an "abnormal sign", the reliability is calculated based on the feature data stored in the feature data storage unit 109 and the feature amount of the abnormality sign data to be determined.
When the reliability is unacceptable, the abnormality sign data to be judged is judged as normal data.

The abnormality sign data learning unit 203
The feature data storage unit 109 stores the abnormal feature data corresponding to the feature amount of the abnormality sign data to be determined as feature data.
When the reliability determination unit 202 determines that the abnormality sign data to be determined is normal data, "normal" is output as the output of the normal determination unit 110.
In other cases, an "abnormal sign" is output as the output of the normal determination unit 110.
That is, the normal determination unit 110 stores the abnormal feature data corresponding to the feature amount of the abnormality sign data in the feature data storage unit 109 as the feature data.

FIG. 3 is an example of the data structure of the feature data storage unit 109.

The feature data storage unit 109 of this figure stores the cumulative number of abnormality sign data 404 for each feature data layer 401.
Each feature data layer 401 is defined by a lower limit value 402 and an upper limit value 403. That is, the feature data layer 401 of 1 is determined by the lower limit value 402 of 1 and the upper limit value 403 of 1.
The abnormal sign data cumulative number 404 is a feature amount having a lower limit value 402 or more corresponding to the abnormal sign data cumulative number 404 and an upper limit value 403 or less corresponding to the abnormal sign data cumulative number 404, and the abnormal sign determination is performed in the past. Part 108 is the cumulative number of feature quantities determined to exceed the threshold.
The cumulative number of abnormal sign data 404 is also abnormal feature data corresponding to the feature amount of the abnormal sign data.

When the feature data storage unit 109 is implemented as shown in this figure, a specific feature data layer with respect to the total number of abnormal sign data cumulative numbers 404 stored in the feature data storage unit 109 from the abnormal sign data cumulative number 404. The ratio of the cumulative number of abnormal sign data 404 of 401 can be obtained.

This figure shows an example of the feature data layer 401 when the feature amount of the abnormality sign data is a one-dimensional value, but the feature amount may be a multidimensional value.
The definition of the feature data layer 401 may be arbitrary depending on the feature amount of the abnormality sign data.

According to this example
The normal determination unit 110 is stored in the feature data storage unit 109.
It is stored in association with the feature data layer 401, which is a layer corresponding to the range of the feature amount values of the abnormality sign data.
For each feature data layer 401, the cumulative number of abnormality sign data 404 of the abnormality sign data corresponding to the feature data layer 401 is stored as feature data.
The normal determination unit 110 calculates the reliability of the abnormal sign data based on the ratio of the cumulative number of abnormal sign data 404 corresponding to the abnormal sign data to the total number of cumulative numbers of abnormal sign data 404.

FIG. 4 is another example of the data structure of the feature data storage unit 109.

The feature data storage unit 109 of this figure stores the abnormality sign data feature amount 405, which is the feature amount of the abnormality sign data, in addition to the abnormality sign data cumulative number 604 for each feature data layer 401.
The abnormality sign data feature amount 405 is also the abnormality feature data corresponding to the feature amount of the abnormality sign data.

The feature data storage unit 109 also stores the abnormality sign data feature amount 405, so that the abnormality sign detection device 100 sets the lower limit value 402 and the upper limit value 403 of each feature data layer 401 during the operation of the abnormality sign detection device 100. Can be changed to.
When the lower limit value 402 and the upper limit value 403 of each feature data layer 401 are changed, the abnormality sign detection device 100 recycles the cumulative number of abnormality sign data 604 stored in the feature data storage unit 109 for each feature data layer 401. Can be calculated. Therefore, it is considered that the operability of the abnormality sign detection device 100 adopting the data structure shown in FIG. 4 is higher than the operability of the abnormality sign detection device 100 adopting the data structure shown in FIG.

FIG. 5 is a hardware configuration diagram of the abnormality sign detection device 100.

As shown in this figure, the abnormality sign detection device 100 is composed of a general computer 10.
The feature amount conversion unit 103, the equipment state determination unit 104, the normal model generation unit 105, the abnormality degree calculation unit 106, the threshold value determination unit 107, the abnormality sign determination unit 108, and the normality determination unit 110 are the processors 11. And memory 12.
The feature data storage unit 109 and the normal data storage unit 111 are composed of a memory 12 and a storage device 13.

The processor 11 is connected to other hardware via the data bus 14 (signal line) and controls these other hardware.
The storage device 13 stores the abnormality sign detection program.

The processor 11 is a processing device that executes a program, an OS (Operating System), and the like. The processing device is sometimes called an IC (Integrated Circuit), and specific examples of the processor 11 are a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit). The processor 11 reads and executes the program stored in the memory 12.

The computer 10 in this figure includes only one processor 11, but the computer 10 may include a plurality of processors that replace the processor 11. These plurality of processors share the execution of programs and the like.

The memory 12 is a storage device that temporarily stores data, and functions as a main memory used as a work area of the processor 11. As a specific example, the memory 12 is a RAM (Random Access Memory) such as a SRAM (Static Random Access Memory) or a DRAM (Dynamic Random Access Memory). The memory 12 holds the calculation result of the processor 11.

The storage device 13 is a storage device that stores data non-volatilely, and stores the OS, each program executed by the processor 11, data used when executing each program, and the like. Specific examples of the storage device 13 are an HDD (Hard Disk Drive) and an SSD (Solid State Drive). The storage device 13 includes a memory card, an SD (Secure Digital, registered trademark) memory card, a CF (Compact Flash), a NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, and a DVD (Digital Versailles Disk). ) Etc. may be a portable recording medium.

Although not shown in this figure, the OS is loaded from the storage device 13 by the processor 11, expanded into the memory 12, and executed on the processor 11. As a specific example, the OS may be any one compatible with the processor 11, such as Linux (registered trademark) or Windows (registered trademark). The abnormality sign detection program and the OS may be stored in the memory 12.

*** Explanation of operation ***
The operation of the abnormality sign detection device 100 is divided into a learning phase in which the normal model is learned based on the learning data and an operation phase in which the normal model learned in the learning phase is used to determine whether or not there is an abnormality sign.

The operation procedure of the abnormality sign detection device 100 corresponds to the abnormality sign detection method. Further, the program that realizes the operation of the abnormality sign detection device 100 corresponds to the abnormality sign detection program.

*** Explanation of the operation of the learning phase ***
FIG. 6 is an example of a flowchart showing the operation of the learning phase of the abnormality sign detection device 100.
The order of processing shown in this flowchart may be changed as appropriate.

(Step S201: Feature conversion process)
The feature amount conversion unit 103 converts the sensor data acquired by the abnormality sign detection device 100 into a feature amount.

(Step S202: Operating state determination process)
The equipment state determination unit 104 determines the equipment state of the target equipment 101 from the operation data acquired by the abnormality sign detection device 100.

(Step S203: Normal model generation process)
The normal model generation unit 105
The feature amount converted by the feature amount conversion unit 103 in step S201 is associated with the equipment state determined by the equipment state determination unit 104 in step S202, and is stored in the normal data storage unit 111.
When a predetermined condition is satisfied, a normal model is generated for each equipment state based on the feature amount stored in the normal data storage unit 111 and the equipment state.
The normal model generation unit 105
A normal model may be generated each time the conditions corresponding to the equipment condition are met.
A normal model may be generated when all the conditions corresponding to the equipment conditions are satisfied.

The abnormality sign detection device 100
When the normal model generation unit 105 completes the generation of the normal model, that is, when the normal model is generated for all the equipment states, step S204 is executed.
Otherwise, step S201 is executed.

(Step S204: Threshold determination process)
The threshold value determination unit 107 determines the threshold value.
The threshold value determination unit 107
The abnormality degree of the feature amount stored in the normal data storage unit 111 is calculated by the abnormality degree calculation unit 106.
The threshold value may be determined based on the degree of abnormality.
The threshold value may be determined based on the degree of abnormality and the normal model.

*** Explanation of operation in the operation phase ***
FIG. 7 is an example of a flowchart showing the operation of the operation phase of the abnormality sign detection device 100.
The order of processing shown in this flowchart may be changed as appropriate.
(Step S211: Feature conversion process)
The feature amount conversion unit 103 converts the sensor data acquired by the abnormality sign detection device 100 into a feature amount.
The sensor data is referred to as sensor data to be determined.
The feature amount is referred to as a feature amount to be determined.

(Step S212: Abnormal sign determination process)
The equipment state determination unit 104 determines the equipment state from the operation data acquired by the abnormality sign detection device 100.

The abnormality degree calculation unit 106 is a normal model corresponding to the equipment state, and calculates the abnormality degree of the feature amount converted by the feature amount conversion unit 103 in step S211 based on the normal model generated in step S203.

The abnormality sign determination unit 108
It is determined whether or not the degree of abnormality exceeds the threshold value determined by the threshold value determination unit 107 in step S204.
When the degree of abnormality exceeds the threshold value, the sensor data to be determined is determined to be abnormality sign data.
In other cases, the sensor data to be determined is determined to be normal data.

The processing of this step is
By coordinating the equipment status determination unit 104, the abnormality degree calculation unit 106, and the abnormality sign determination unit 108, "the abnormality sign determination is performed based on the normal model corresponding to the current equipment condition".
It is not necessary to process in the above order.

(Step S213: Normal determination process)
The normal determination unit 110 determines whether or not the sensor data to be determined, which is determined to be abnormal sign data in step S212, is normal data.
Details of this step will be described in steps S301 to S307.
The abnormality sign detection device 100 repeatedly executes the processes from steps S211 to S213.

*** Explanation of the operation of the normal determination unit 110 ***
FIG. 8 is an example of a flowchart showing the operation of the normal determination unit 110 according to the present embodiment.
The order of processing shown in this flowchart may be changed as appropriate.

(Step S301: Result confirmation process)
The result confirmation unit 201 confirms the determination result of the abnormality sign determination unit 108.
The normal determination unit 110
If the determination result of the abnormality sign determination unit 108 exceeds the threshold value, step S302 is executed.
Otherwise, step S305 is executed.

(Step S302: Reliability calculation process)
The reliability determination unit 202 calculates the reliability of the feature amount of the abnormality sign data based on the data stored in the feature data storage unit 109.
The process of this step is not limited to calculating the value by arithmetic calculation.

(Step S303: Reliability determination process)
The reliability determination unit 202 determines whether or not the abnormality sign data to be determined is normal data based on whether or not the reliability calculated in step S302 can be tolerated.

The reliability determination unit 202
A threshold may be set and whether or not it is acceptable may be determined based on the threshold.
When a certain degree of similarity is found between the feature amount of the past abnormality sign data and the feature amount of the abnormality sign data to be determined, it may be judged that the reliability is acceptable.

The reliability determination unit 202
When the feature data storage unit 109 stores the feature data having a similar relationship with the feature amount determined by the abnormality sign determination unit 108 to exceed the threshold value, it is determined that the determination of the abnormality sign determination unit 108 is unreliable. , Judge the abnormal sign data to be judged as normal data,
In other cases, the abnormality sign data to be determined may be determined as the abnormality sign data.

As a specific example, the reliability determination unit 202 may be used.
The reliability is calculated by the abnormality calculation method adopted by the abnormality calculation unit 106.
The threshold value is determined in the same manner as the threshold value determination unit 107,
When the reliability is equal to or less than the threshold value, the abnormality sign data to be determined may be determined as normal data.

As a specific example, the reliability determination unit 202 may be used.
Of the feature data stored in the feature data storage unit 109, the distance between the feature amount of the abnormality sign data to be determined and the feature data having the shortest distance from the feature amount of the abnormality sign data to be judged is set as the reliability. Calculate and
When the reliability is equal to or less than a certain threshold value, the abnormality sign data to be determined may be determined as normal data.
The reciprocal of the number of the feature data existing within a certain distance from the feature amount of the abnormality sign data to be judged is calculated as the reliability.
When the reliability is equal to or less than a certain threshold value, the abnormality sign data to be determined may be determined as normal data.

When the feature data storage unit 109 adopts the data structure as shown in FIG. 3 or 4, the reliability determination unit 202 has an abnormality corresponding to the abnormality sign data to be determined with respect to the total number of accumulated abnormality sign data. The reciprocal of the ratio of the cumulative number of symptom data is used as the reliability.
When the reliability is equal to or less than a certain threshold value, the abnormality sign data to be determined may be determined as normal data.

FIG. 10 shows an example of the concept of processing in this step when the feature amount of the abnormality sign data is a three-dimensional value. In this example, the feature amount is a three-dimensional value for convenience of illustration, but the feature amount may be a value of any dimension.
The storage feature amount 701 is a feature amount stored by the feature data storage unit 109, and is a feature amount determined by the abnormality sign determination unit 108 to exceed the threshold value in the past.
The determination target feature amount 702 is a determination target feature amount.
The neighborhood 703 is an area where the distance from the determination target feature amount 702 is within a certain value.

The reliability determination unit 202
It is determined whether or not the storage feature amount 701 is included in the vicinity 703 of the determination target feature amount 702.
If it is included, the abnormality sign data to be judged is judged as normal data, and
If it is not included, the abnormality sign data to be determined is determined to be the abnormality sign data.
In this example, the reliability is a truth value determined by whether or not the storage feature amount 701 is included in the vicinity 703 of the determination target feature amount 702.

The reliability determination unit 202 may use the reciprocal of the number of the storage feature amount 701 included in the vicinity 703 of the determination target feature amount 702 as the reliability.

The reliability determination unit 202
The distance between the judgment target feature amount 702 and the storage feature amount 701 closest to the judgment target feature amount 702 is defined as the reliability, and when the reliability is equal to or less than a certain value, that is, it is equal to or less than the maximum value of the distance regarded as the vicinity. In this case, the abnormality sign data to be judged is judged as normal data, and
In other cases, the abnormality sign data to be determined may be determined as the abnormality sign data.
When the reliability determination unit 202 determines in this way,
Any one may be adopted as the definition of the distance and the maximum value of the distance considered to be in the vicinity.
These may be freely changed depending on the system to which the abnormality sign detection device 100 is applied.

(Step S304: Judgment result confirmation process)
The abnormality sign data learning unit 203
When the determination result in step S303 is normal data, the determination result of the normal determination unit 110 is determined to be "normal".
In other cases, the determination result of the normal determination unit 110 is determined as an "abnormal sign".

(Step S305: Judgment result confirmation process)
The result confirmation unit 201 determines the determination result of the normal determination unit 110 to be "normal".

(Step S306: Abnormal sign data learning process)
The abnormality sign data learning unit 203 stores the abnormality feature data corresponding to the feature amount of the abnormality sign data to be determined in the feature data storage unit 109 as feature data.

(Step S307: Result output processing)
The result confirmation unit 201 or the abnormality sign data learning unit 203 outputs the determination result of the normal determination unit 110.

*** Explanation of the operation of the reliability determination unit 202 ***
FIG. 9 is an example of a flowchart showing the operation of the reliability determination unit 202.
The order of processing shown in this flowchart may be changed as appropriate.
As described above, the reliability determination unit 202 may adopt an arbitrary method as the reliability calculation method, but here, when the feature data storage unit 109 adopts the data structure shown in FIG. 3 or FIG. The method in is described.

(Step S5011: Total value calculation process)
The reliability determination unit 202
Acquire all the abnormal sign data cumulative number 404 stored in the feature data storage unit 109,
Calculate the total value.

(Step S502: Reliability calculation process)
The reliability determination unit 202
The cumulative number of abnormal sign data 404 corresponding to the abnormal sign data to be determined is acquired from the feature data storage unit 109.
The ratio of the cumulative number of abnormal sign data 404 corresponding to the abnormal sign data to be determined is calculated with respect to the total value calculated in step S502.

(Step S503: Reliability determination process)
The reliability determination unit 202
When the value calculated in step S502 does not exceed a certain value, the abnormality sign data to be determined is determined to be normal data.
In other cases, the abnormality sign data to be determined is determined to be the abnormality sign data.

*** Features of Embodiment 1 ***
The abnormality sign detection device 100 according to the present embodiment includes an abnormality degree calculation unit 106 that calculates an abnormality degree of the partial time series data based on a feature amount of the partial time series data that is at least a part of the time series data.
When the degree of abnormality of the partial time series data exceeds the threshold value, the abnormality sign determination unit 108 that determines the partial time series data as the abnormality sign data, and
A normal judgment unit that calculates the reliability, which is the degree of abnormality of the abnormal sign data, based on the feature amount of the abnormal sign data and the corresponding feature data, and determines the abnormal sign data as normal data when the reliability is acceptable. With 110
The normal determination unit 110 stores the abnormal feature data corresponding to the feature amount of the abnormality sign data in the feature data storage unit 109 as feature data.

The abnormality sign detection device 100 according to the present embodiment includes a threshold value determination unit 107 for determining a threshold value.
The abnormality sign determination unit 108 determines based on the threshold value determined by the threshold value determination unit 107.

The abnormality sign detection device 100 according to the present embodiment includes a normal model generation unit 105 that generates a normal model corresponding to a range in which the feature amount of normal data can be taken.
The abnormality degree calculation unit 106 calculates the abnormality degree based on the feature amount of the partial time series data and the normal model generated by the normal model generation unit 105.

According to the abnormality sign detection device 100 according to the present embodiment.
The normal model generation unit 105 generates a normal model for each equipment state of the target equipment 101 (equipment) capable of taking one or more equipment states.
The abnormality sign detection device 100 acquires time series data from the target equipment 101 (equipment) and obtains time series data.
The abnormality degree calculation unit 106 calculates the abnormality degree based on the feature amount of the partial time series data and the normal model corresponding to the equipment state corresponding to the partial time series data.

*** Explanation of the effect of Embodiment 1 ***
As described above, according to the abnormality sign detection device 100 according to the present embodiment,
By utilizing the sensor data determined by the abnormality sign determination unit 108 to exceed the threshold value, the normal determination unit 110 reviews the determination result of the abnormality sign determination unit 108.
Even when a normal model is generated as training data from a set of normal data having a low coverage rate, the sensor data finally determined by the abnormality sign detection device 100 as abnormality sign data is actually the abnormality sign data. The degree can be improved.
A set of normal data having a low coverage rate means a set of normal data in which the ratio of the space corresponding to the set of normal data to the space consisting of all normal data is low.

The abnormality sign detection device 100 according to the present embodiment is
Since various methods for evaluating reliability can be adopted,
Abnormal signs can be detected based on time series data having various characteristics.

<Modification example 1>
The abnormality sign detection device 100 does not have to acquire sensor data from the target equipment 101.
In this modification, the abnormality sign detection device 100 is
Detects abnormal signs of time series data prepared in advance,
It is not necessary to output the state of the target equipment 101.

<Modification 2>
The abnormality sign detection device 100 can also analyze time-series data composed of data other than sensor data.
As a specific example, the abnormality sign detection device 100 can analyze time-series data including operation patterns of an operator of the device or the like, and detect whether or not there is a sign of an abnormality in the state of the operator.

<Modification example 3>
The detection result management unit 102 is mounted outside the abnormality sign detection device 100 in FIG. However, the detection result management unit 102 may be mounted inside the abnormality sign detection device 100.

<Modification example 4>
The normal model generation unit 105 does not have to generate a normal model using the data acquired from the target equipment 101.
In this modification, the abnormality sign detection device 100 is
A normal model is not generated using the data acquired from the target equipment 101,
The processes of steps S201 and S202 shown in FIG. 6 are not executed.
The normal data storage unit 111 of this modification stores the prepared sensor data and operation data.
According to this modification,
The time required to generate a normal model can be shortened,
It is possible to generate a constant normal model.

<Modification 5>
The abnormality sign detection device 100 does not have to include the normal model generation unit 105.
The abnormality sign detection device 100 of this modification is
Using the prepared normal model,
The processes from steps S201 to S203 in FIG. 6 are not executed.

<Modification 6>
The normal model generation unit 105 does not have to generate a normal model for each equipment state. Even if the normal model generation unit 105 does not generate a normal model for each equipment state, it is considered that the normal model generation unit 105 has generated a normal model for each equipment state.
The abnormality sign detection device 100 of this modification is
It is not necessary to provide the equipment status determination unit 104.
The processing of step S202 and step S213 is not executed.
The normal data storage unit 111 of this modification does not have to store the equipment state.

<Modification 7>
The normal model generation unit 105 may generate a normal model by a method different for each equipment state.

<Modification 8>
The abnormality sign detection device 100 does not have to include the threshold value determination unit 107.
In this modification,
The abnormality sign detection device 100 does not execute the process of step S204 of FIG.
The abnormality sign determination unit 108 makes a determination using a threshold value or the like prepared in advance.

<Modification 9>
The threshold value determination unit 107 may determine the threshold value for each equipment state.
In this modification, the abnormality sign determination unit 108 makes a determination using a threshold value corresponding to the equipment state of the sensor data to be determined.

<Modification example 10>
The abnormality sign data learning unit 203 may store the feature amount of the determination target and the sensor data of the determination target together in the feature data storage unit 109.
According to this modification, the reliability determination unit 202 uses a feature amount different from the feature amount converted by the feature amount conversion unit 103, that is, a feature amount different from the feature amount used for generating the normal model. Can be used to evaluate the abnormality sign data to be determined.

<Modification 11>
The reliability determination unit 202 may calculate the reliability by a different method for each equipment state.
In this modification, the abnormality sign data learning unit 203
The feature data storage unit 109 may also store the equipment status.
Feature data may be stored for each equipment state.

<Modification example 12>
The abnormality degree calculation unit 106 may calculate the abnormality degree by a method different for each equipment state.

<Modification example 13>
The abnormality sign detection device 100 according to the present embodiment classifies whether the state of the target equipment 101 is “normal” or “abnormal sign”. However, the abnormality sign detection device 100 may classify the state of the target equipment 101 into more stages.
In this modification, the abnormality sign detection device 100 outputs a determination result other than "normal" and "abnormal sign".
In this modification,
As a specific example, the reliability determination unit 202 determines that the abnormality sign data of the determination target has low reliability of the determination result by the abnormality sign determination unit 108 because the threshold value is exceeded but there are many similar data. Judging that it is "low abnormality sign data" indicating that it is data indicating that it has been done,
The abnormality sign detection device 100 may output a "low abnormality sign" as the state of the target equipment 101.

<Modification 14>
In the present embodiment, the case where each function of the abnormality sign detection device 100 is realized by software has been described. However, as a modification, each of the above functions may be realized by hardware.

When each of the above functions is realized by hardware, the abnormality sign detection device 100 includes an electronic circuit (processing circuit) instead of the processor 11. Alternatively, the abnormality sign detection device 100 includes an electronic circuit instead of the processor 11 and the memory 12. The electronic circuit is a dedicated electronic circuit that realizes each of the above functions (and the memory 12).

The electronic circuit is assumed to be a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field-Programmable Gate Array). To.

Each of the above functions may be realized by one electronic circuit, or each of the above functions may be distributed and realized in a plurality of electronic circuits.

Alternatively, some of the above-mentioned functions may be realized by hardware, and other above-mentioned functions may be realized by software.

The above-mentioned processor 11, memory 12, and electronic circuit are collectively referred to as "processing circuit Lee". That is, each of the above functions is realized by the processing circuit.

Embodiment 2.
Hereinafter, points different from the above-described embodiment will be described with reference to the drawings.

*** Explanation of configuration ***
FIG. 11 shows the functional configuration of the normal determination unit 110 according to the second embodiment.
As shown in this figure, the normal determination unit 110 according to the present embodiment includes a normal data learning unit 204.

*** Explanation of operation ***
FIG. 12 shows an example of a flowchart showing the operation of the normal determination unit 110 according to the present embodiment.
The order of processing shown in this flowchart may be changed as appropriate.

(Step S308: Normal data learning process)
Normal data learning unit 204
The feature data storage unit 109 stores the normal feature data corresponding to the feature amount of the sensor data determined by the abnormality sign determination unit 108 as the normal data as the feature data.
The "normal" output by the result confirmation unit 201 is output as it is.
Normal feature data is data that has some correspondence with the features of normal data.
The format of the normal feature data may be the same as or different from the anomalous feature data.
The sensor data corresponding to the normal feature data stored in the feature data storage unit 109 is referred to as past normal data.

*** Features of Embodiment 2 ***
According to the abnormality sign detection device 100 according to the present embodiment.
The abnormality sign determination unit 108 determines that the partial time series data is normal data when the degree of abnormality of the partial time series data does not exceed the threshold value.
The normal determination unit 110 stores the normal feature data corresponding to the feature amount of the normal data in the feature data storage unit 109 as the feature data.

*** Explanation of the effect of Embodiment 2 ***
As described above, according to the abnormality sign detection device 100 according to the present embodiment,
The normal data learning unit 204 stores the normal feature data corresponding to the feature amount of the sensor data determined by the abnormality sign determination unit 108 as normal data in the feature data storage unit 109 as feature data.
The reliability determination unit 202 also considers past normal data for determination.
Therefore, the reliability determination unit 202 according to the present embodiment is
Considering the past abnormal sign data, even if the abnormal sign data to be judged can be judged as normal data,
In view of the past normal data, when the abnormal sign data to be determined cannot be determined as normal data, the abnormal sign data to be determined is not determined to be normal data.

As a specific example, when the ratio of the number of past abnormal sign data corresponding to the abnormal sign data to be determined to the number of past normal data is extremely low, the reliability determination unit 202 determines the abnormal sign data to be determined. Not judged as normal data.

Therefore, the abnormality sign detection device 100 according to the present embodiment can improve the accuracy of abnormality sign data detection.

<Modification 15>
The normal data learning unit 204 does not have to store the normal feature data corresponding to the feature amount of the sensor data determined by the abnormality sign determination unit 108 as normal data in the feature data storage unit 109 as feature data.
In this modified example, the normal data learning unit 204
The abnormality sign determination unit 108 counts the cumulative number of sensor data determined to be normal data, and
The cumulative value may be stored in the feature data storage unit 109.

Embodiment 3.
Hereinafter, points different from the above-described embodiment will be described with reference to the drawings.

*** Explanation of configuration ***
FIG. 13 shows an example of a configuration diagram of the abnormality sign detection device 100 according to the present embodiment and a configuration example of an abnormality sign detection system using the abnormality sign detection device 100 according to the present embodiment.
As shown in this figure, the abnormality sign detection device 100 according to the present embodiment includes a feature data management unit 121.

*** Explanation of operation ***
FIG. 14 is an example of a flowchart showing the operation of the abnormality sign detection device 100 according to the present embodiment.
The order of processing shown in this flowchart may be changed as appropriate.

(Step S214: Normal model regeneration instruction processing)
The abnormality sign detection device 100
When the feature data management unit 121 issues a regeneration instruction to regenerate the normal model, step S215 is executed.
In other cases, step S211 is executed.
The feature data management unit 121 may issue a regeneration instruction any number of times.

The feature data management unit 121 may issue a regeneration instruction under arbitrary conditions. A specific example of the above condition is the number of feature data stored in the feature data storage unit 109, when the number of feature data corresponding to the abnormal sign data of the normal data exceeds a certain value.
The feature data management unit 121
You may issue a regeneration instruction for each normal model,
Regeneration instructions may be issued for all normal models.
The abnormality sign data of the normal data is the abnormality sign data of the determination target determined by the reliability determination unit 202 as the normal data.

(Step S215: Normal model regeneration process)
The normal model generation unit 105 is based on the abnormal sign data stored by the feature data storage unit 109 as the abnormal sign data of the normal data and the learning data stored by the normal data storage unit 111. The normal model corresponding to the regeneration instruction issued by the feature data management unit 121 is regenerated.
The normal model generation unit 105 may regenerate the normal model many times.

*** Explanation of the operation of the normal determination unit 110 ***
An example of a flowchart showing the operation of the normal determination unit 110 is the same as the flowchart shown in FIG. 8 or FIG.
However, since there are differences in the contents of some processes, they will be described below.

(Step S306: Abnormal sign data learning process)
The abnormality sign data learning unit 203
Abnormal feature data corresponding to the feature amount of the abnormality sign data to be determined is stored in the feature data storage unit 109 as feature data.
When the abnormal sign data to be determined is the abnormal sign data of the normal data, the abnormality sign data learning unit 203 determines.
The abnormal sign data to be determined is stored in the feature data storage unit 109 as the abnormal sign data of normal data.
The equipment status corresponding to the abnormality sign data of the judgment target is stored in correspondence with the abnormality sign data of the judgment target.

*** Features of Embodiment 3 ***
According to the abnormality sign detection device 100 according to the present embodiment.
When the normality determination unit 110 determines that the abnormal sign data is normal data, the feature data storage unit 109 stores the abnormality data.
Abnormal sign data is stored as abnormal sign data of normal data,
The equipment status corresponding to the abnormal sign data is stored in correspondence with the abnormal sign data.
The normal model generation unit 105 regenerates the normal model based on the abnormal sign data stored as the abnormal sign data of the normal data by the feature data storage unit 109 for each equipment state.

*** Explanation of the effect of Embodiment 3 ***
As described above, according to the abnormality sign detection device 100 according to the present embodiment, the normal model generation unit 105 has the feature data storage unit 109 and the normal data storage unit triggered by the regeneration instruction of the feature data management unit 121. A normal model is regenerated based on the data stored by the unit 111.

Therefore, since the comprehensiveness of the normal model used by the abnormality sign detection device 100 according to the present embodiment gradually increases during the operation of the abnormality sign detection device 100, the abnormality sign detection device 100 according to the present embodiment gradually increases. The accuracy of abnormality sign data detection can be improved.

<Modification 16>
The reliability determination unit 202 may store the abnormal sign data of the normal data in the normal data storage unit 111.
In this modification,
The feature data management unit 121 monitors the normal data storage unit 111,
The normal model generation unit 105 regenerates the normal model based on the learning data stored in the normal data storage unit 111 and the abnormal sign data of the normal data.

<Modification 17>
The threshold value determination unit 107 may dynamically determine the threshold value.
As a specific example, the threshold value determination unit 107 may reset the threshold value in accordance with the normal model generation unit 105 regenerating the normal model.
According to this modification, the abnormality sign determination unit 108 can determine by using the threshold value corresponding to the normal model even when the normal model is regenerated.

*** Other embodiments ***
It is possible to freely combine the above-described embodiments, modify any component of each embodiment, or omit any component in each embodiment.

Further, the embodiment is not limited to the one shown in the first to third embodiments, and various changes can be made as needed.

10 computer, 11 processor, 12 memory, 13 storage device, 14 data bus, 100 abnormality sign detection device, 101 target equipment, 102 detection result management unit, 103 feature quantity conversion unit, 104 equipment status determination unit, 105 normal model generation unit , 106 Abnormality calculation unit, 107 Threshold determination unit, 108 Abnormal sign determination unit, 109 Feature data storage unit, 110 Normal judgment unit, 111 Normal data storage unit, 121 Feature data management unit, 201 Result confirmation unit, 202 Reliability determination Department, 203 Abnormal sign data learning unit, 204 Normal data learning unit, 401 Feature data layer, 402 Lower limit value, 403 Upper limit value, 404 Abnormal sign data cumulative number, 405 Abnormal sign data feature amount, 701 Memory feature amount, 702 Judgment target Feature amount, near 703.

Claims (9)

1. An abnormality degree calculation unit that calculates the abnormality degree of the partial time series data based on the feature amount of the partial time series data that is at least a part of the time series data.
   When the degree of abnormality of the partial time-series data exceeds the threshold value, the abnormality sign determination unit that determines the partial time-series data as abnormality sign data,
   A normal determination unit that calculates the reliability of the abnormal sign data based on the feature data corresponding to the feature amount of the abnormal sign data, and determines the abnormal sign data as normal data when the reliability cannot be tolerated. With and
   The normal determination unit is an abnormality sign detection device that stores abnormal feature data corresponding to the feature amount of the abnormality sign data in the feature data storage unit as the feature data.
2. Equipped with a threshold value determination unit that determines the threshold value
   The abnormality sign detection device according to claim 1, wherein the abnormality sign determination unit determines based on a threshold value determined by the threshold value determination unit.
3. The normal determination unit is stored in the feature data storage unit.
   It is stored in association with the feature data layer, which is a layer corresponding to the range of the feature amount values of the abnormality sign data.
   For each feature data layer, the cumulative number of abnormal sign data of the abnormal sign data corresponding to the feature data layer is stored as the feature data.
   The normal determination unit calculates the reliability of the abnormal sign data based on the ratio of the cumulative number of the abnormal sign data corresponding to the abnormal sign data to the total number of the cumulative number of the abnormal sign data. The abnormality sign detection device according to 2.
4. When the degree of abnormality of the partial time series data does not exceed the threshold value, the abnormality sign determination unit determines the partial time series data as the normal data.
   The abnormality sign detection according to any one of claims 1 to 3, wherein the normality determination unit stores the normal feature data corresponding to the feature amount of the normal data in the feature data storage unit as the feature data. apparatus.
5. Equipped with a normal model generator that generates a normal model corresponding to the range in which the features of normal data can be taken.
   The abnormality degree calculation unit is any one of claims 1 to 4 for calculating the abnormality degree based on the feature amount of the partial time series data and the normal model generated by the normal model generation unit. Abnormal sign detection device described in.
6. The normal model generation unit generates the normal model for each equipment state of equipment that can take one or more equipment states.
   The abnormality sign detection device acquires the time series data from the equipment and obtains the time series data.
   The fifth aspect of claim 5 is that the abnormality degree calculation unit calculates the abnormality degree based on the feature amount of the partial time series data and the normal model corresponding to the equipment state corresponding to the partial time series data. The described anomaly sign detector.
7. When the abnormal sign data is determined to be the normal data, the normal determination unit stores the characteristic data storage unit.
   The abnormal sign data is stored as the abnormal sign data of the normal data,
   The equipment state corresponding to the abnormality sign data is stored in correspondence with the abnormality sign data.
   6. The normal model generation unit regenerates the normal model based on the abnormal sign data stored as the abnormal sign data of the normal data by the feature data storage unit for each equipment state. Abnormal sign detection device described in.
8. The anomaly degree calculation unit calculates the anomaly degree of the partial time series data based on the feature amount of the partial time series data which is at least a part of the time series data.
   When the degree of abnormality of the partial time-series data exceeds the threshold value, the abnormality sign determination unit determines the partial time-series data as abnormality sign data.
   The normal determination unit calculates the reliability of the abnormal sign data based on the feature data corresponding to the feature amount of the abnormal sign data, and when the reliability cannot be tolerated, the abnormal sign data is referred to as normal data. Judge,
   The normal determination unit is an abnormality sign detection method for storing abnormal feature data corresponding to the feature amount of the abnormality sign data in the feature data storage unit as the feature data.
9. On the computer
   The degree of abnormality of the partial time series data is calculated based on the feature amount of the partial time series data which is at least a part of the time series data.
   When the degree of abnormality of the partial time series data exceeds the threshold value, the partial time series data is determined to be abnormality sign data.
   The reliability of the abnormal sign data is calculated based on the feature data corresponding to the feature amount of the abnormal sign data, and when the reliability is unacceptable, the abnormal sign data is determined to be normal data.
   An abnormality sign detection program that stores abnormal feature data corresponding to the feature amount of the abnormality sign data as the feature data.

Images