WO2020245968A1 - Dispositif de détection de signe d'anomalie, procédé de détection de signe d'anomalie, et programme de détection de signe d'anomalie - Google Patents

Dispositif de détection de signe d'anomalie, procédé de détection de signe d'anomalie, et programme de détection de signe d'anomalie Download PDF

Info

Publication number
WO2020245968A1
WO2020245968A1 PCT/JP2019/022495 JP2019022495W WO2020245968A1 WO 2020245968 A1 WO2020245968 A1 WO 2020245968A1 JP 2019022495 W JP2019022495 W JP 2019022495W WO 2020245968 A1 WO2020245968 A1 WO 2020245968A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
abnormality
normal
sign
feature
Prior art date
Application number
PCT/JP2019/022495
Other languages
English (en)
Japanese (ja)
Inventor
佳典 ▲高▼田
昂平 桑島
Original Assignee
三菱電機株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 三菱電機株式会社 filed Critical 三菱電機株式会社
Priority to JP2021524591A priority Critical patent/JP7016450B2/ja
Priority to PCT/JP2019/022495 priority patent/WO2020245968A1/fr
Publication of WO2020245968A1 publication Critical patent/WO2020245968A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B23/00—Testing or monitoring of control systems or parts thereof
    • G05B23/02—Electric testing or monitoring

Definitions

  • the present invention relates to an abnormality sign detection device, an abnormality sign detection method, and an abnormality sign detection program.
  • the conventional monitoring system monitors the occurrence of anomalies, and as a specific example, it is a rule-based anomaly detection that is realized using conditions that can be clearly judged, such as individual sensor values exceeding a certain threshold value. there were.
  • a monitoring system When such a monitoring system is used, it is possible to determine an abnormality, but it is difficult to detect an abnormality sign.
  • the acquired data is converted into features, and the pattern, regularity, distribution, etc. of the data are analyzed based on the features to generate a normal model.
  • the features used to generate the normal model it is attempted to generate a plurality of normal models based on the features expected to be effective, and the degree of appropriateness of the normal model is determined. Are individually confirmed and the most appropriate normal model is adopted.
  • the coverage rate of data in the normal state is important.
  • Patent Document 1 cuts out an event sequence from an event signal representing the state of human operation and at least one of the units, which can be obtained from the equipment, and generates in advance a matrix of the event sequence and the frequency of alarms generated within a predetermined time. By doing so, it discloses a method for distinguishing a deviation from the normal state caused by a change in the state of at least one of the human operation and the unit. According to the method disclosed in Patent Document 1, it is possible to remove the influence of the state change of the equipment based on human operation or the like at the time of constructing the normal model and improve the detection accuracy.
  • the abnormality sign detection device of the present invention An abnormality degree calculation unit that calculates the abnormality degree of the partial time series data based on the feature amount of the partial time series data that is at least a part of the time series data.
  • the abnormality sign determination unit that determines the partial time-series data as abnormality sign data
  • a normal determination unit that calculates the reliability of the abnormal sign data based on the feature data corresponding to the feature amount of the abnormal sign data, and determines the abnormal sign data as normal data when the reliability cannot be tolerated.
  • the normal determination unit stores the abnormal feature data corresponding to the feature amount of the abnormal sign data in the feature data storage unit as the feature data.
  • the normal determination unit determines the abnormal sign data using the feature amount of the abnormal sign data. By doing so, the accuracy of determining the partial time series data can be improved.
  • FIG. 3 is a configuration diagram of an abnormality sign detection system using the abnormality sign detection device 100 according to the first embodiment.
  • the block diagram of the normal determination part 110 which concerns on Embodiment 1.
  • FIG. The data structure of the feature data storage unit 109 according to the first embodiment.
  • the hardware block diagram of the abnormality sign detection apparatus 100 which concerns on Embodiment 1.
  • FIG. The flowchart which shows the operation of the learning phase of the abnormality sign detection apparatus 100 which concerns on Embodiment 1.
  • the flowchart which shows the operation of the operation phase of the abnormality sign detection apparatus 100 which concerns on Embodiment 1.
  • FIG. The flowchart which shows the operation of the normal determination part 110 which concerns on Embodiment 1.
  • FIG. 3 is a configuration diagram of an abnormality sign detection system using the abnormality sign detection device 100 according to the third embodiment.
  • FIG. 1 shows an example of the configuration of the abnormality sign detection device 100 according to the present embodiment and an example of the configuration of the abnormality sign detection system using the abnormality sign detection device 100.
  • the arrows in the figure represent the flow of data. During the execution of the anomaly sign detection device 100, the data flows in the direction of the arrowhead, and if the arrowheads are at both ends, the data flows in either direction.
  • the abnormality sign detection device 100 Acquire time series data related to sensor data and operation data from the target equipment 101, It is a device that detects the presence or absence of abnormal signs from the sensor data at each time. Data transmission from the target equipment 101 to the abnormality sign detection device 100 may be performed by any method.
  • the abnormality sign detection device 100 and the target equipment 101 are connected by a network, and the target equipment 101 may transmit data to the abnormality sign detection device 100 via the network.
  • the abnormality sign detection device 100 may be incorporated in the target equipment 101.
  • the abnormality sign detection device 100 can detect the abnormality sign based on the feature amount of the partial time series data which is at least a part of the time series data. However, for convenience of explanation, a case where the abnormality sign detection device 100 analyzes time-series data including sensor data will be described. The following sensor data may be read as time series data or partial time series data.
  • the target equipment 101 is The equipment for which the abnormality sign detection device 100 detects the presence or absence of an abnormality sign. It can be anything that produces time series data.
  • the abnormality sign detection device 100 monitors the current operation status of the plant by utilizing the operation data representing the operation status of the equipment of various plants such as factories or power plants and the data acquired from the sensors incorporated in the equipment. Not only that, it is also possible to detect the possibility of future plant abnormalities.
  • the signs of abnormality are The target equipment 101 has not reached an abnormal state because the threshold value has not been exceeded, but it is also considered to be a sign of an abnormality in the target equipment 101. It also means that the state of the target equipment 101 is different from the normal state, which is the normal state.
  • the normal state is a normal state derived from the training data.
  • the time-series data includes data acquired by the abnormality sign detection device 100 in chronological order.
  • the sensor data is data acquired by the sensor of the target equipment 101.
  • the sensor data includes data acquired by the sensor of the target equipment 101 at a certain time and data continuously acquired by the sensor of the target equipment 101 between two different times.
  • the operation data includes an operation performed by a person on the target equipment 101 and data indicating the result of the operation.
  • the detection result management unit 102 manages the sensor data and operation data output by the target equipment 101 in association with the result of the abnormality sign detection device 100 detecting the abnormality sign based on the sensor data.
  • the feature amount conversion unit 103 From the sensor data acquired by the abnormality sign detection device 100, the sensor data corresponding to the model used for the abnormality sign detection is extracted, and the sensor data is extracted. Based on the extracted sensor data, the feature amount is calculated by arithmetic calculation etc. If necessary, the sensor data output by the sensor of the target equipment 101 is subjected to processing such as dealing with missing values and removing noise.
  • the feature amount conversion unit 103 Any method may be applied to the extraction of sensor data. For the calculation of the feature amount, a method of calculating the feature amount from the sensor data obtained by extracting each input sensor data with a fixed time width, or a method of calculating one feature amount from a plurality of sensor data at the same time, etc. , Any method may be applied.
  • the equipment state determination unit 104 executes a process of determining the equipment state, which is the state of the target equipment 101, based on the operation data.
  • the equipment state may include the operating status of a part or the whole of the target equipment 101 and the operation performed by a person or the like on the target equipment 101.
  • the abnormality sign detection device 100 may set a state different from the state managed by the target equipment 101 as the state of the target equipment 101 as the equipment state.
  • the equipment state determination unit 104 classifies the equipment state of the target equipment 101 into one or more equipment states, the target equipment 101 is equipment that can take one or more equipment states.
  • the normal model generation unit 105 generates a normal model for each equipment state of the target equipment 101 based on the feature amount calculated by the feature amount conversion unit 103 and the equipment state determined by the equipment state determination unit 104.
  • the normal model generation unit 105 generates a normal model based on the learning data stored in the normal data storage unit 111.
  • the normal model generation unit 105 uses the sensor data acquired by the abnormality sign detection device 100 as learning data,
  • the sensor data and the operation data corresponding to the sensor data are associated with each other and stored in the normal data storage unit 111.
  • a predetermined condition such as when the number of sensor data stored in the normal data storage unit 111 reaches a certain number, a normal model is generated.
  • the normal model generation unit 105 Arbitrary conditions may be adopted as the conditions for generating a normal model. Different conditions may be adopted for each equipment condition.
  • the normal model generation unit 105 When analyzing time-series data, it is not only possible to judge anomalies by focusing on the time-series movement of one sensor data. As in the correlation analysis, the relationship between the movements and values between a plurality of sensor data can be focused on and the relationship can be considered as one feature quantity.
  • the normal model is Corresponding to the range that the feature amount of the sensor data can be taken when the target equipment 101 is in the normal state, Corresponding to the range that the feature amount of normal data can be taken, Usually generated by unsupervised learning.
  • the feature quantity may be a one-dimensional value or a multidimensional value.
  • the abnormal sign detection system by unsupervised learning determines a "normal state” based on a state that has been seen so far, and determines a state that has never been seen as an "unnormal state".
  • the states that have been seen so far are the states included in the training data.
  • An "abnormal state” consists of a state showing a true sign of abnormality and a state determined by the abnormality sign detection system as a sign of abnormality but not really a sign of abnormality.
  • the cause of the abnormal sign detection system determining that it is an abnormal sign but not really an abnormal sign is the area that is not covered by the learning data due to lack of training data, and it becomes a true normal state. It is possible to make a mistake in judging the data in the corresponding area.
  • the true normal state is the state in which the target equipment 101 is actually normal.
  • the "normal state” corresponds to the normal state.
  • the abnormality degree calculation unit 106 calculates the abnormality degree of each feature amount from the normal model generated by the normal model generation unit 105 and each feature amount calculated from the sensor data.
  • the abnormality degree calculation unit 106 Any definition of anomaly may be adopted As a specific example, the degree of abnormality may be defined based on the distance between the normal model and the feature amount of the sensor data.
  • the anomaly degree calculation unit 106 may adopt an arbitrary definition of the distance between the normal model and the feature amount. As a specific example of the definition of the distance from the feature amount, the distance between the statistical representative value of the entire normal model such as the center of gravity and the feature amount may be used, which is an element of the normal model and is the normal one closest to the feature amount. It may be the distance between the elements of the model and the features.
  • the threshold value determination unit 107 performs a process of determining a threshold value for determining an abnormal sign based on a normal model or the like.
  • the threshold value determination unit 107 determines the threshold value for determining the abnormality sign in consideration of the degree of abnormality calculated from each feature amount.
  • the threshold value determination unit 107 may adopt an arbitrary method for threshold value determination, or may use a statistical method.
  • the normal model generation unit 105 uses the normal model as the average of the distribution of the features of the training data.
  • the threshold value determination unit 107 may determine the threshold value as a value based on the standard deviation of the distribution of the feature amount of the training data.
  • the threshold is 3 ⁇ .
  • ⁇ is the standard deviation of the distribution of the degree of anomaly.
  • the abnormality degree calculation unit 106 may dynamically determine the threshold value according to the actual sensor data.
  • the abnormality sign determination unit 108 determines whether or not the abnormality degree of the feature amount calculated by the abnormality degree calculation unit 106 exceeds the threshold value determined by the threshold value determination unit 107, that is, whether or not the feature amount exceeds the threshold value. To do.
  • the abnormality sign determination unit 108 When the degree of abnormality of the feature amount of the sensor data exceeds the threshold value, the sensor data is determined as abnormality sign data, and the abnormality is determined. In other cases, the sensor data is determined to be normal data. Abnormal sign data is also a general term for sensor data in which abnormal signs are observed. Normal data is also a general term for sensor data with no signs of abnormality.
  • the feature data storage unit 109 stores the feature amount determined by the abnormality sign determination unit 108 to exceed the threshold value, that is, the abnormality feature data corresponding to the feature amount of the abnormality sign data as feature data.
  • the abnormal feature data is data that has some correspondence with the feature amount of the abnormal sign data.
  • Anomalous feature data It may be data that aggregates the features of multiple abnormal sign data. The data may have a one-to-one correspondence with the feature amount of the abnormality sign data.
  • the normal determination unit 110 The reliability of the abnormality sign data is calculated based on the feature data stored in the feature data storage unit 109 and the feature amount of the abnormality sign data. Based on the reliability, it is determined whether or not the abnormality sign data is normal data. Reliability is The sensor data determined by the abnormality sign determination unit 108 as abnormality sign data indicates the degree to which the abnormality sign data is actually. It may be calculated by any method. The reliability may be a truth value.
  • the abnormality sign data to be determined by the normal determination unit 110 is referred to as abnormality sign data to be determined.
  • the sensor data that has been determined to be the abnormality sign data of the abnormality sign determination unit 108 in the past and corresponds to the abnormality feature data stored in the feature data storage unit 109 is referred to as the past abnormality sign data.
  • FIG. 2 is a configuration diagram of the normal determination unit 110 according to the present embodiment.
  • the result confirmation unit 201 Check the determination result of the abnormality sign determination unit 108, When the determination result is normal data, "normal” is output as the output of the normal determination unit 110. When the determination result is the abnormality sign data, the "abnormal sign” is output. “Normal” means that the target equipment 101 is in a normal state. The “abnormal sign” means that the target equipment 101 is not in a normal state.
  • the reliability determination unit 202 When the result confirmation unit 201 outputs an "abnormal sign", the reliability is calculated based on the feature data stored in the feature data storage unit 109 and the feature amount of the abnormality sign data to be determined. When the reliability is unacceptable, the abnormality sign data to be judged is judged as normal data.
  • the abnormality sign data learning unit 203 The feature data storage unit 109 stores the abnormal feature data corresponding to the feature amount of the abnormality sign data to be determined as feature data.
  • "normal” is output as the output of the normal determination unit 110.
  • an "abnormal sign” is output as the output of the normal determination unit 110. That is, the normal determination unit 110 stores the abnormal feature data corresponding to the feature amount of the abnormality sign data in the feature data storage unit 109 as the feature data.
  • FIG. 3 is an example of the data structure of the feature data storage unit 109.
  • the feature data storage unit 109 of this figure stores the cumulative number of abnormality sign data 404 for each feature data layer 401.
  • Each feature data layer 401 is defined by a lower limit value 402 and an upper limit value 403. That is, the feature data layer 401 of 1 is determined by the lower limit value 402 of 1 and the upper limit value 403 of 1.
  • the abnormal sign data cumulative number 404 is a feature amount having a lower limit value 402 or more corresponding to the abnormal sign data cumulative number 404 and an upper limit value 403 or less corresponding to the abnormal sign data cumulative number 404, and the abnormal sign determination is performed in the past.
  • Part 108 is the cumulative number of feature quantities determined to exceed the threshold.
  • the cumulative number of abnormal sign data 404 is also abnormal feature data corresponding to the feature amount of the abnormal sign data.
  • This figure shows an example of the feature data layer 401 when the feature amount of the abnormality sign data is a one-dimensional value, but the feature amount may be a multidimensional value.
  • the definition of the feature data layer 401 may be arbitrary depending on the feature amount of the abnormality sign data.
  • the normal determination unit 110 is stored in the feature data storage unit 109. It is stored in association with the feature data layer 401, which is a layer corresponding to the range of the feature amount values of the abnormality sign data. For each feature data layer 401, the cumulative number of abnormality sign data 404 of the abnormality sign data corresponding to the feature data layer 401 is stored as feature data. The normal determination unit 110 calculates the reliability of the abnormal sign data based on the ratio of the cumulative number of abnormal sign data 404 corresponding to the abnormal sign data to the total number of cumulative numbers of abnormal sign data 404.
  • FIG. 4 is another example of the data structure of the feature data storage unit 109.
  • the feature data storage unit 109 of this figure stores the abnormality sign data feature amount 405, which is the feature amount of the abnormality sign data, in addition to the abnormality sign data cumulative number 604 for each feature data layer 401.
  • the abnormality sign data feature amount 405 is also the abnormality feature data corresponding to the feature amount of the abnormality sign data.
  • the feature data storage unit 109 also stores the abnormality sign data feature amount 405, so that the abnormality sign detection device 100 sets the lower limit value 402 and the upper limit value 403 of each feature data layer 401 during the operation of the abnormality sign detection device 100. Can be changed to.
  • the abnormality sign detection device 100 recycles the cumulative number of abnormality sign data 604 stored in the feature data storage unit 109 for each feature data layer 401. Can be calculated. Therefore, it is considered that the operability of the abnormality sign detection device 100 adopting the data structure shown in FIG. 4 is higher than the operability of the abnormality sign detection device 100 adopting the data structure shown in FIG.
  • FIG. 5 is a hardware configuration diagram of the abnormality sign detection device 100.
  • the abnormality sign detection device 100 is composed of a general computer 10.
  • the feature amount conversion unit 103, the equipment state determination unit 104, the normal model generation unit 105, the abnormality degree calculation unit 106, the threshold value determination unit 107, the abnormality sign determination unit 108, and the normality determination unit 110 are the processors 11.
  • the feature data storage unit 109 and the normal data storage unit 111 are composed of a memory 12 and a storage device 13.
  • the processor 11 is connected to other hardware via the data bus 14 (signal line) and controls these other hardware.
  • the storage device 13 stores the abnormality sign detection program.
  • the processor 11 is a processing device that executes a program, an OS (Operating System), and the like.
  • the processing device is sometimes called an IC (Integrated Circuit), and specific examples of the processor 11 are a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit).
  • the processor 11 reads and executes the program stored in the memory 12.
  • the computer 10 in this figure includes only one processor 11, but the computer 10 may include a plurality of processors that replace the processor 11. These plurality of processors share the execution of programs and the like.
  • the memory 12 is a storage device that temporarily stores data, and functions as a main memory used as a work area of the processor 11.
  • the memory 12 is a RAM (Random Access Memory) such as a SRAM (Static Random Access Memory) or a DRAM (Dynamic Random Access Memory).
  • the memory 12 holds the calculation result of the processor 11.
  • the storage device 13 is a storage device that stores data non-volatilely, and stores the OS, each program executed by the processor 11, data used when executing each program, and the like. Specific examples of the storage device 13 are an HDD (Hard Disk Drive) and an SSD (Solid State Drive).
  • the storage device 13 includes a memory card, an SD (Secure Digital, registered trademark) memory card, a CF (Compact Flash), a NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, and a DVD (Digital Whatever Disk). ) Etc. may be a portable recording medium.
  • the OS is loaded from the storage device 13 by the processor 11, expanded into the memory 12, and executed on the processor 11.
  • the OS may be any one compatible with the processor 11, such as Linux (registered trademark) or Windows (registered trademark).
  • the abnormality sign detection program and the OS may be stored in the memory 12.
  • the operation of the abnormality sign detection device 100 is divided into a learning phase in which the normal model is learned based on the learning data and an operation phase in which the normal model learned in the learning phase is used to determine whether or not there is an abnormality sign.
  • the operation procedure of the abnormality sign detection device 100 corresponds to the abnormality sign detection method. Further, the program that realizes the operation of the abnormality sign detection device 100 corresponds to the abnormality sign detection program.
  • FIG. 6 is an example of a flowchart showing the operation of the learning phase of the abnormality sign detection device 100. The order of processing shown in this flowchart may be changed as appropriate.
  • Step S201 Feature conversion process
  • the feature amount conversion unit 103 converts the sensor data acquired by the abnormality sign detection device 100 into a feature amount.
  • Step S202 Operating state determination process
  • the equipment state determination unit 104 determines the equipment state of the target equipment 101 from the operation data acquired by the abnormality sign detection device 100.
  • Step S203 Normal model generation process
  • the normal model generation unit 105 The feature amount converted by the feature amount conversion unit 103 in step S201 is associated with the equipment state determined by the equipment state determination unit 104 in step S202, and is stored in the normal data storage unit 111. When a predetermined condition is satisfied, a normal model is generated for each equipment state based on the feature amount stored in the normal data storage unit 111 and the equipment state.
  • the normal model generation unit 105 A normal model may be generated each time the conditions corresponding to the equipment condition are met.
  • a normal model may be generated when all the conditions corresponding to the equipment conditions are satisfied.
  • step S204 When the normal model generation unit 105 completes the generation of the normal model, that is, when the normal model is generated for all the equipment states, step S204 is executed. Otherwise, step S201 is executed.
  • the threshold value determination unit 107 determines the threshold value.
  • the threshold value determination unit 107 The abnormality degree of the feature amount stored in the normal data storage unit 111 is calculated by the abnormality degree calculation unit 106.
  • the threshold value may be determined based on the degree of abnormality.
  • the threshold value may be determined based on the degree of abnormality and the normal model.
  • FIG. 7 is an example of a flowchart showing the operation of the operation phase of the abnormality sign detection device 100.
  • the order of processing shown in this flowchart may be changed as appropriate.
  • Step S211 Feature conversion process
  • the feature amount conversion unit 103 converts the sensor data acquired by the abnormality sign detection device 100 into a feature amount.
  • the sensor data is referred to as sensor data to be determined.
  • the feature amount is referred to as a feature amount to be determined.
  • Step S212 Abnormal sign determination process
  • the equipment state determination unit 104 determines the equipment state from the operation data acquired by the abnormality sign detection device 100.
  • the abnormality degree calculation unit 106 is a normal model corresponding to the equipment state, and calculates the abnormality degree of the feature amount converted by the feature amount conversion unit 103 in step S211 based on the normal model generated in step S203.
  • the abnormality sign determination unit 108 It is determined whether or not the degree of abnormality exceeds the threshold value determined by the threshold value determination unit 107 in step S204. When the degree of abnormality exceeds the threshold value, the sensor data to be determined is determined to be abnormality sign data. In other cases, the sensor data to be determined is determined to be normal data.
  • the processing of this step is By coordinating the equipment status determination unit 104, the abnormality degree calculation unit 106, and the abnormality sign determination unit 108, "the abnormality sign determination is performed based on the normal model corresponding to the current equipment condition". It is not necessary to process in the above order.
  • Step S213 Normal determination process
  • the normal determination unit 110 determines whether or not the sensor data to be determined, which is determined to be abnormal sign data in step S212, is normal data. Details of this step will be described in steps S301 to S307.
  • the abnormality sign detection device 100 repeatedly executes the processes from steps S211 to S213.
  • FIG. 8 is an example of a flowchart showing the operation of the normal determination unit 110 according to the present embodiment. The order of processing shown in this flowchart may be changed as appropriate.
  • Step S301 Result confirmation process
  • the result confirmation unit 201 confirms the determination result of the abnormality sign determination unit 108.
  • the normal determination unit 110 If the determination result of the abnormality sign determination unit 108 exceeds the threshold value, step S302 is executed. Otherwise, step S305 is executed.
  • Step S302 Reliability calculation process
  • the reliability determination unit 202 calculates the reliability of the feature amount of the abnormality sign data based on the data stored in the feature data storage unit 109.
  • the process of this step is not limited to calculating the value by arithmetic calculation.
  • Step S303 Reliability determination process
  • the reliability determination unit 202 determines whether or not the abnormality sign data to be determined is normal data based on whether or not the reliability calculated in step S302 can be tolerated.
  • the reliability determination unit 202 A threshold may be set and whether or not it is acceptable may be determined based on the threshold. When a certain degree of similarity is found between the feature amount of the past abnormality sign data and the feature amount of the abnormality sign data to be determined, it may be judged that the reliability is acceptable.
  • the reliability determination unit 202 When the feature data storage unit 109 stores the feature data having a similar relationship with the feature amount determined by the abnormality sign determination unit 108 to exceed the threshold value, it is determined that the determination of the abnormality sign determination unit 108 is unreliable. , Judge the abnormal sign data to be judged as normal data, In other cases, the abnormality sign data to be determined may be determined as the abnormality sign data.
  • the reliability determination unit 202 may be used.
  • the reliability is calculated by the abnormality calculation method adopted by the abnormality calculation unit 106.
  • the threshold value is determined in the same manner as the threshold value determination unit 107, When the reliability is equal to or less than the threshold value, the abnormality sign data to be determined may be determined as normal data.
  • the reliability determination unit 202 may be used. Of the feature data stored in the feature data storage unit 109, the distance between the feature amount of the abnormality sign data to be determined and the feature data having the shortest distance from the feature amount of the abnormality sign data to be judged is set as the reliability. Calculate and When the reliability is equal to or less than a certain threshold value, the abnormality sign data to be determined may be determined as normal data. The reciprocal of the number of the feature data existing within a certain distance from the feature amount of the abnormality sign data to be judged is calculated as the reliability. When the reliability is equal to or less than a certain threshold value, the abnormality sign data to be determined may be determined as normal data.
  • the reliability determination unit 202 has an abnormality corresponding to the abnormality sign data to be determined with respect to the total number of accumulated abnormality sign data.
  • the reciprocal of the ratio of the cumulative number of symptom data is used as the reliability.
  • the reliability is equal to or less than a certain threshold value, the abnormality sign data to be determined may be determined as normal data.
  • FIG. 10 shows an example of the concept of processing in this step when the feature amount of the abnormality sign data is a three-dimensional value.
  • the feature amount is a three-dimensional value for convenience of illustration, but the feature amount may be a value of any dimension.
  • the storage feature amount 701 is a feature amount stored by the feature data storage unit 109, and is a feature amount determined by the abnormality sign determination unit 108 to exceed the threshold value in the past.
  • the determination target feature amount 702 is a determination target feature amount.
  • the neighborhood 703 is an area where the distance from the determination target feature amount 702 is within a certain value.
  • the reliability determination unit 202 It is determined whether or not the storage feature amount 701 is included in the vicinity 703 of the determination target feature amount 702. If it is included, the abnormality sign data to be judged is judged as normal data, and If it is not included, the abnormality sign data to be determined is determined to be the abnormality sign data.
  • the reliability is a truth value determined by whether or not the storage feature amount 701 is included in the vicinity 703 of the determination target feature amount 702.
  • the reliability determination unit 202 may use the reciprocal of the number of the storage feature amount 701 included in the vicinity 703 of the determination target feature amount 702 as the reliability.
  • the reliability determination unit 202 The distance between the judgment target feature amount 702 and the storage feature amount 701 closest to the judgment target feature amount 702 is defined as the reliability, and when the reliability is equal to or less than a certain value, that is, it is equal to or less than the maximum value of the distance regarded as the vicinity. In this case, the abnormality sign data to be judged is judged as normal data, and In other cases, the abnormality sign data to be determined may be determined as the abnormality sign data.
  • the reliability determination unit 202 determines in this way, Any one may be adopted as the definition of the distance and the maximum value of the distance considered to be in the vicinity. These may be freely changed depending on the system to which the abnormality sign detection device 100 is applied.
  • Step S304 Judgment result confirmation process
  • the abnormality sign data learning unit 203 When the determination result in step S303 is normal data, the determination result of the normal determination unit 110 is determined to be "normal". In other cases, the determination result of the normal determination unit 110 is determined as an "abnormal sign".
  • Step S305 Judgment result confirmation process
  • Step S306 Abnormal sign data learning process
  • the abnormality sign data learning unit 203 stores the abnormality feature data corresponding to the feature amount of the abnormality sign data to be determined in the feature data storage unit 109 as feature data.
  • Step S307 Result output processing
  • the result confirmation unit 201 or the abnormality sign data learning unit 203 outputs the determination result of the normal determination unit 110.
  • FIG. 9 is an example of a flowchart showing the operation of the reliability determination unit 202. The order of processing shown in this flowchart may be changed as appropriate.
  • the reliability determination unit 202 may adopt an arbitrary method as the reliability calculation method, but here, when the feature data storage unit 109 adopts the data structure shown in FIG. 3 or FIG. The method in is described.
  • Step S5011 Total value calculation process
  • the reliability determination unit 202 Acquire all the abnormal sign data cumulative number 404 stored in the feature data storage unit 109, Calculate the total value.
  • Step S502 Reliability calculation process
  • the reliability determination unit 202 The cumulative number of abnormal sign data 404 corresponding to the abnormal sign data to be determined is acquired from the feature data storage unit 109.
  • the ratio of the cumulative number of abnormal sign data 404 corresponding to the abnormal sign data to be determined is calculated with respect to the total value calculated in step S502.
  • Step S503 Reliability determination process
  • the reliability determination unit 202 When the value calculated in step S502 does not exceed a certain value, the abnormality sign data to be determined is determined to be normal data. In other cases, the abnormality sign data to be determined is determined to be the abnormality sign data.
  • the abnormality sign detection device 100 includes an abnormality degree calculation unit 106 that calculates an abnormality degree of the partial time series data based on a feature amount of the partial time series data that is at least a part of the time series data.
  • the abnormality sign determination unit 108 that determines the partial time series data as the abnormality sign data
  • a normal judgment unit that calculates the reliability, which is the degree of abnormality of the abnormal sign data, based on the feature amount of the abnormal sign data and the corresponding feature data, and determines the abnormal sign data as normal data when the reliability is acceptable.
  • the normal determination unit 110 stores the abnormal feature data corresponding to the feature amount of the abnormality sign data in the feature data storage unit 109 as feature data.
  • the abnormality sign detection device 100 includes a threshold value determination unit 107 for determining a threshold value.
  • the abnormality sign determination unit 108 determines based on the threshold value determined by the threshold value determination unit 107.
  • the abnormality sign detection device 100 includes a normal model generation unit 105 that generates a normal model corresponding to a range in which the feature amount of normal data can be taken.
  • the abnormality degree calculation unit 106 calculates the abnormality degree based on the feature amount of the partial time series data and the normal model generated by the normal model generation unit 105.
  • the normal model generation unit 105 generates a normal model for each equipment state of the target equipment 101 (equipment) capable of taking one or more equipment states.
  • the abnormality sign detection device 100 acquires time series data from the target equipment 101 (equipment) and obtains time series data.
  • the abnormality degree calculation unit 106 calculates the abnormality degree based on the feature amount of the partial time series data and the normal model corresponding to the equipment state corresponding to the partial time series data.
  • the normal determination unit 110 reviews the determination result of the abnormality sign determination unit 108. Even when a normal model is generated as training data from a set of normal data having a low coverage rate, the sensor data finally determined by the abnormality sign detection device 100 as abnormality sign data is actually the abnormality sign data. The degree can be improved.
  • a set of normal data having a low coverage rate means a set of normal data in which the ratio of the space corresponding to the set of normal data to the space consisting of all normal data is low.
  • the abnormality sign detection device 100 is Since various methods for evaluating reliability can be adopted, Abnormal signs can be detected based on time series data having various characteristics.
  • the abnormality sign detection device 100 does not have to acquire sensor data from the target equipment 101.
  • the abnormality sign detection device 100 is Detects abnormal signs of time series data prepared in advance, It is not necessary to output the state of the target equipment 101.
  • the abnormality sign detection device 100 can also analyze time-series data composed of data other than sensor data.
  • the abnormality sign detection device 100 can analyze time-series data including operation patterns of an operator of the device or the like, and detect whether or not there is a sign of an abnormality in the state of the operator.
  • the detection result management unit 102 is mounted outside the abnormality sign detection device 100 in FIG. However, the detection result management unit 102 may be mounted inside the abnormality sign detection device 100.
  • the normal model generation unit 105 does not have to generate a normal model using the data acquired from the target equipment 101.
  • the abnormality sign detection device 100 is A normal model is not generated using the data acquired from the target equipment 101, The processes of steps S201 and S202 shown in FIG. 6 are not executed.
  • the normal data storage unit 111 of this modification stores the prepared sensor data and operation data. According to this modification, The time required to generate a normal model can be shortened, It is possible to generate a constant normal model.
  • the abnormality sign detection device 100 does not have to include the normal model generation unit 105.
  • the abnormality sign detection device 100 of this modification is Using the prepared normal model, The processes from steps S201 to S203 in FIG. 6 are not executed.
  • the normal model generation unit 105 does not have to generate a normal model for each equipment state. Even if the normal model generation unit 105 does not generate a normal model for each equipment state, it is considered that the normal model generation unit 105 has generated a normal model for each equipment state.
  • the abnormality sign detection device 100 of this modification is It is not necessary to provide the equipment status determination unit 104.
  • the processing of step S202 and step S213 is not executed.
  • the normal data storage unit 111 of this modification does not have to store the equipment state.
  • the normal model generation unit 105 may generate a normal model by a method different for each equipment state.
  • the abnormality sign detection device 100 does not have to include the threshold value determination unit 107. In this modification, The abnormality sign detection device 100 does not execute the process of step S204 of FIG.
  • the abnormality sign determination unit 108 makes a determination using a threshold value or the like prepared in advance.
  • the threshold value determination unit 107 may determine the threshold value for each equipment state.
  • the abnormality sign determination unit 108 makes a determination using a threshold value corresponding to the equipment state of the sensor data to be determined.
  • the abnormality sign data learning unit 203 may store the feature amount of the determination target and the sensor data of the determination target together in the feature data storage unit 109.
  • the reliability determination unit 202 uses a feature amount different from the feature amount converted by the feature amount conversion unit 103, that is, a feature amount different from the feature amount used for generating the normal model. Can be used to evaluate the abnormality sign data to be determined.
  • the reliability determination unit 202 may calculate the reliability by a different method for each equipment state.
  • the abnormality sign data learning unit 203 The feature data storage unit 109 may also store the equipment status. Feature data may be stored for each equipment state.
  • the abnormality degree calculation unit 106 may calculate the abnormality degree by a method different for each equipment state.
  • the abnormality sign detection device 100 classifies whether the state of the target equipment 101 is “normal” or “abnormal sign”. However, the abnormality sign detection device 100 may classify the state of the target equipment 101 into more stages. In this modification, the abnormality sign detection device 100 outputs a determination result other than "normal” and "abnormal sign". In this modification, as a specific example, the reliability determination unit 202 determines that the abnormality sign data of the determination target has low reliability of the determination result by the abnormality sign determination unit 108 because the threshold value is exceeded but there are many similar data. Judging that it is "low abnormality sign data" indicating that it is data indicating that it has been done, The abnormality sign detection device 100 may output a "low abnormality sign" as the state of the target equipment 101.
  • the abnormality sign detection device 100 includes an electronic circuit (processing circuit) instead of the processor 11.
  • the abnormality sign detection device 100 includes an electronic circuit instead of the processor 11 and the memory 12.
  • the electronic circuit is a dedicated electronic circuit that realizes each of the above functions (and the memory 12).
  • the electronic circuit is assumed to be a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field-Programmable Gate Array). To.
  • Each of the above functions may be realized by one electronic circuit, or each of the above functions may be distributed and realized in a plurality of electronic circuits.
  • processing circuit Lee The above-mentioned processor 11, memory 12, and electronic circuit are collectively referred to as "processing circuit Lee". That is, each of the above functions is realized by the processing circuit.
  • FIG. 11 shows the functional configuration of the normal determination unit 110 according to the second embodiment.
  • the normal determination unit 110 according to the present embodiment includes a normal data learning unit 204.
  • FIG. 12 shows an example of a flowchart showing the operation of the normal determination unit 110 according to the present embodiment. The order of processing shown in this flowchart may be changed as appropriate.
  • Step S308 Normal data learning process
  • the feature data storage unit 109 stores the normal feature data corresponding to the feature amount of the sensor data determined by the abnormality sign determination unit 108 as the normal data as the feature data.
  • the "normal" output by the result confirmation unit 201 is output as it is.
  • Normal feature data is data that has some correspondence with the features of normal data.
  • the format of the normal feature data may be the same as or different from the anomalous feature data.
  • the sensor data corresponding to the normal feature data stored in the feature data storage unit 109 is referred to as past normal data.
  • the abnormality sign determination unit 108 determines that the partial time series data is normal data when the degree of abnormality of the partial time series data does not exceed the threshold value.
  • the normal determination unit 110 stores the normal feature data corresponding to the feature amount of the normal data in the feature data storage unit 109 as the feature data.
  • the normal data learning unit 204 stores the normal feature data corresponding to the feature amount of the sensor data determined by the abnormality sign determination unit 108 as normal data in the feature data storage unit 109 as feature data.
  • the reliability determination unit 202 also considers past normal data for determination. Therefore, the reliability determination unit 202 according to the present embodiment is Considering the past abnormal sign data, even if the abnormal sign data to be judged can be judged as normal data, In view of the past normal data, when the abnormal sign data to be determined cannot be determined as normal data, the abnormal sign data to be determined is not determined to be normal data.
  • the reliability determination unit 202 determines the abnormal sign data to be determined. Not judged as normal data.
  • the abnormality sign detection device 100 can improve the accuracy of abnormality sign data detection.
  • the normal data learning unit 204 does not have to store the normal feature data corresponding to the feature amount of the sensor data determined by the abnormality sign determination unit 108 as normal data in the feature data storage unit 109 as feature data.
  • the normal data learning unit 204 The abnormality sign determination unit 108 counts the cumulative number of sensor data determined to be normal data, and The cumulative value may be stored in the feature data storage unit 109.
  • FIG. 13 shows an example of a configuration diagram of the abnormality sign detection device 100 according to the present embodiment and a configuration example of an abnormality sign detection system using the abnormality sign detection device 100 according to the present embodiment.
  • the abnormality sign detection device 100 according to the present embodiment includes a feature data management unit 121.
  • FIG. 14 is an example of a flowchart showing the operation of the abnormality sign detection device 100 according to the present embodiment. The order of processing shown in this flowchart may be changed as appropriate.
  • Step S214 Normal model regeneration instruction processing
  • the abnormality sign detection device 100 When the feature data management unit 121 issues a regeneration instruction to regenerate the normal model, step S215 is executed. In other cases, step S211 is executed.
  • the feature data management unit 121 may issue a regeneration instruction any number of times.
  • the feature data management unit 121 may issue a regeneration instruction under arbitrary conditions.
  • a specific example of the above condition is the number of feature data stored in the feature data storage unit 109, when the number of feature data corresponding to the abnormal sign data of the normal data exceeds a certain value.
  • the feature data management unit 121 You may issue a regeneration instruction for each normal model, Regeneration instructions may be issued for all normal models.
  • the abnormality sign data of the normal data is the abnormality sign data of the determination target determined by the reliability determination unit 202 as the normal data.
  • Step S215 Normal model regeneration process
  • the normal model generation unit 105 is based on the abnormal sign data stored by the feature data storage unit 109 as the abnormal sign data of the normal data and the learning data stored by the normal data storage unit 111.
  • the normal model corresponding to the regeneration instruction issued by the feature data management unit 121 is regenerated.
  • the normal model generation unit 105 may regenerate the normal model many times.
  • Step S306 Abnormal sign data learning process
  • the abnormality sign data learning unit 203 Abnormal feature data corresponding to the feature amount of the abnormality sign data to be determined is stored in the feature data storage unit 109 as feature data.
  • the abnormal sign data to be determined is the abnormal sign data of the normal data
  • the abnormality sign data learning unit 203 determines.
  • the abnormal sign data to be determined is stored in the feature data storage unit 109 as the abnormal sign data of normal data.
  • the equipment status corresponding to the abnormality sign data of the judgment target is stored in correspondence with the abnormality sign data of the judgment target.
  • Embodiment 3 *** Features of Embodiment 3 *** According to the abnormality sign detection device 100 according to the present embodiment.
  • the feature data storage unit 109 stores the abnormality data.
  • Abnormal sign data is stored as abnormal sign data of normal data
  • the equipment status corresponding to the abnormal sign data is stored in correspondence with the abnormal sign data.
  • the normal model generation unit 105 regenerates the normal model based on the abnormal sign data stored as the abnormal sign data of the normal data by the feature data storage unit 109 for each equipment state.
  • the normal model generation unit 105 has the feature data storage unit 109 and the normal data storage unit triggered by the regeneration instruction of the feature data management unit 121.
  • a normal model is regenerated based on the data stored by the unit 111.
  • the abnormality sign detection device 100 according to the present embodiment since the comprehensiveness of the normal model used by the abnormality sign detection device 100 according to the present embodiment gradually increases during the operation of the abnormality sign detection device 100, the abnormality sign detection device 100 according to the present embodiment gradually increases. The accuracy of abnormality sign data detection can be improved.
  • the reliability determination unit 202 may store the abnormal sign data of the normal data in the normal data storage unit 111.
  • the feature data management unit 121 monitors the normal data storage unit 111,
  • the normal model generation unit 105 regenerates the normal model based on the learning data stored in the normal data storage unit 111 and the abnormal sign data of the normal data.
  • the threshold value determination unit 107 may dynamically determine the threshold value. As a specific example, the threshold value determination unit 107 may reset the threshold value in accordance with the normal model generation unit 105 regenerating the normal model. According to this modification, the abnormality sign determination unit 108 can determine by using the threshold value corresponding to the normal model even when the normal model is regenerated.
  • the embodiment is not limited to the one shown in the first to third embodiments, and various changes can be made as needed.

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Testing And Monitoring For Control Systems (AREA)

Abstract

La présente invention concerne un dispositif de détection de signe d'anomalie (100) qui comprend : une unité de calcul de degré d'anomalie (106) qui calcule un degré d'anomalie de données chronologiques partielles sur la base d'une quantité caractéristique des données chronologiques partielles qui sont au moins une partie de données chronologiques ; une unité de détermination de signe d'anomalie (108) qui détermine, en tant que données de signe d'anomalie, les données chronologiques partielles lorsque le degré d'anomalie des données chronologiques partielles dépasse une valeur seuil ; et une unité de détermination de normalité (110) qui calcule la fiabilité de données de signe d'anomalie sur la base de données de caractéristique correspondant à une quantité caractéristique des données de signe d'anomalie, et détermine, en tant que données normales, les données de signe d'anomalie lorsque la fiabilité ne peut pas être autorisée.
PCT/JP2019/022495 2019-06-06 2019-06-06 Dispositif de détection de signe d'anomalie, procédé de détection de signe d'anomalie, et programme de détection de signe d'anomalie WO2020245968A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
JP2021524591A JP7016450B2 (ja) 2019-06-06 2019-06-06 異常兆候検知装置、異常兆候検知方法、及び、異常兆候検知プログラム
PCT/JP2019/022495 WO2020245968A1 (fr) 2019-06-06 2019-06-06 Dispositif de détection de signe d'anomalie, procédé de détection de signe d'anomalie, et programme de détection de signe d'anomalie

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2019/022495 WO2020245968A1 (fr) 2019-06-06 2019-06-06 Dispositif de détection de signe d'anomalie, procédé de détection de signe d'anomalie, et programme de détection de signe d'anomalie

Publications (1)

Publication Number Publication Date
WO2020245968A1 true WO2020245968A1 (fr) 2020-12-10

Family

ID=73653055

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2019/022495 WO2020245968A1 (fr) 2019-06-06 2019-06-06 Dispositif de détection de signe d'anomalie, procédé de détection de signe d'anomalie, et programme de détection de signe d'anomalie

Country Status (2)

Country Link
JP (1) JP7016450B2 (fr)
WO (1) WO2020245968A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024047859A1 (fr) * 2022-09-02 2024-03-07 三菱電機株式会社 Dispositif de détection d'anomalie, procédé de détection d'anomalie et programme de détection d'anomalie

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2006163517A (ja) * 2004-12-02 2006-06-22 Petroleum Energy Center 異常検知装置
JP2009259020A (ja) * 2008-04-17 2009-11-05 Japan Energy Corp 異常検知装置
JP2017097712A (ja) * 2015-11-26 2017-06-01 株式会社日立製作所 機器診断装置及びシステム及び方法
JP2019067136A (ja) * 2017-09-29 2019-04-25 ファナック株式会社 数値制御システム

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2006163517A (ja) * 2004-12-02 2006-06-22 Petroleum Energy Center 異常検知装置
JP2009259020A (ja) * 2008-04-17 2009-11-05 Japan Energy Corp 異常検知装置
JP2017097712A (ja) * 2015-11-26 2017-06-01 株式会社日立製作所 機器診断装置及びシステム及び方法
JP2019067136A (ja) * 2017-09-29 2019-04-25 ファナック株式会社 数値制御システム

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024047859A1 (fr) * 2022-09-02 2024-03-07 三菱電機株式会社 Dispositif de détection d'anomalie, procédé de détection d'anomalie et programme de détection d'anomalie

Also Published As

Publication number Publication date
JPWO2020245968A1 (ja) 2021-10-21
JP7016450B2 (ja) 2022-02-04

Similar Documents

Publication Publication Date Title
CN102713862B (zh) 故障原因提取装置、故障原因提取方法和程序记录介质
CN105474577B (zh) 用于监测系统性能和可用性的系统和方法
Shang et al. Automated detection of performance regressions using regression models on clustered performance counters
EP1729243B1 (fr) Système de détection de l'erreur et procédé utilisant la classification de la signature de l'erreur basée sur l'espace nul avoisinant
US10354197B2 (en) Pattern analytics for real-time detection of known significant pattern signatures
CN110164501B (zh) 一种硬盘检测方法、装置、存储介质及设备
US20170139759A1 (en) Pattern analytics for real-time detection of known significant pattern signatures
KR102079359B1 (ko) 개선된 sax 기법 및 rtc 기법을 이용한 공정 모니터링 장치 및 방법
JP6699012B2 (ja) 異常予兆検出システムおよび異常予兆検出方法
US20150046757A1 (en) Performance Metrics of a Computer System
WO2019239542A1 (fr) Appareil de détection d'anomalie, procédé de détection d'anomalie, et programme de détection d'anomalie
CN111742462A (zh) 用于基于音频和振动的功率分配装备状况监测的系统和方法
US20170257304A1 (en) Systems and methods for monitoring system performance and availability
JP7016450B2 (ja) 異常兆候検知装置、異常兆候検知方法、及び、異常兆候検知プログラム
CN102792278B (zh) 用于计算环境中的诊断数据捕获的方法和设备
JP2014120001A (ja) 監視装置、監視対象ホストの監視方法、監視プログラム及び記録媒体
KR20200028249A (ko) 설비 데이터의 이상 정도 평가 방법
CN111555899B (zh) 告警规则配置方法、设备状态监测方法、装置和存储介质
CN115794479B (zh) 日志数据处理方法、装置、电子设备及存储介质
CN115659351B (zh) 一种基于大数据办公的信息安全分析方法、系统及设备
US10157113B2 (en) Information processing device, analysis method, and recording medium
WO2023181241A1 (fr) Dispositif serveur de surveillance, système, procédé et programme
CN115189961A (zh) 一种故障识别方法、装置、设备及存储介质
JP2019133470A (ja) 挙動判別方法、挙動判別装置及びプログラム
Deb et al. Towards systems level prognostics in the cloud

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19931931

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021524591

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19931931

Country of ref document: EP

Kind code of ref document: A1