WO2020262353A1 - Anomaly detection device and anomaly detection method - Google Patents

Abstract

The purpose of the present invention is to enable an anomaly measure calculation and clustering to be processed at high speeds while maintaining anomaly detection sensitivity, during anomaly detection based on a plurality of time-series sensor signals. In order to achieve the purpose, in an anomaly detection device, feature vectors in a specified learning period are clustered to adjust the number of feature vectors belonging to each cluster to a certain number, one cluster is selected in accordance with a newly extracted feature vector, and an anomaly measure is calculated on the basis of a reference vector calculated using all the feature vectors belonging to the selected cluster.

Description

Anomaly detection device and abnormality detection method

The present invention relates to an abnormality detection device and an abnormality detection method for early detection of an abnormality based on a plurality of time-series sensor signals output by a plant, equipment, or the like.

Electric power companies use waste heat from gas turbines to supply hot water for district heating, and supply high-pressure steam and low-pressure steam to factories. Petrochemical companies operate gas turbines and other equipment as power supply equipment. In various plants and equipment using gas turbines and the like, abnormality detection for detecting equipment malfunctions or signs thereof is extremely important for minimizing damage to society.

Not only gas turbines and steam turbines, but also water turbines at hydropower plants, nuclear reactors at nuclear power plants, wind turbines at wind power plants, engines for aircraft and heavy machinery, railroad vehicles and tracks, escalator, elevators, equipment / parts level. There is no time to list the equipment that requires preventive maintenance such as deterioration and life of the on-board battery.

Therefore, the target equipment or plant is equipped with multiple sensors that acquire various physical information, and it is judged whether the target equipment or plant is normal or abnormal according to the monitoring standard for each sensor.

Patent Document 1 is a conventional technique in this technical field. In Patent Document 1, a feature vector is extracted from a sensor signal, the extracted feature vector is clustered, data belonging to the center of each cluster and the cluster are accumulated as learning data, and newly observed from these. One or several clusters are selected according to the feature vector, a predetermined number of training data is selected from the data belonging to the selected cluster according to the newly observed feature vector, and the selected training data is selected. A normal model is created using the above, an abnormality measurement is calculated based on a newly observed feature vector and a normal model, and an abnormality detection method for determining whether an abnormality is normal or normal based on the calculated abnormality measurement is disclosed. Here, the anomaly measure is an amount of deviation from the vector value in the normal state by expressing the value measured by a plurality of sensors as one vector value.

Japanese Unexamined Patent Publication No. 2014-32455

The anomaly detection method described in Patent Document 1 is predetermined from the data belonging to one or several neighboring clusters of the newly observed feature vector when calculating the anomaly measure from the newly observed feature vector. Since a number of neighborhood data is searched, it can be processed at a higher speed than searching a predetermined number of neighborhood data from all the training data. However, a process for searching nearby data is required, and this calculation time is still long. In addition, since clustering is performed during learning, the time required for learning is long.

An object of the present invention is an anomaly detection device and anomaly detection capable of high-speed processing of both anomaly measurement calculation and clustering while maintaining anomaly detection sensitivity in anomaly detection based on a plurality of time-series sensor signals in order to solve the above problems. To provide a method.

In view of the above background technology and problems, the present invention is, for example, an abnormality detection device, which is a sensor signal for inputting a plurality of time-series sensor signals output from a plurality of sensors mounted on equipment. An input unit, a feature vector extraction unit that extracts feature vectors from sensor signals at each time, and a clustering unit that clusters feature vectors for a specified learning period and adjusts the feature vectors belonging to each cluster to a certain number. A reference vector is created using the cluster selection unit that selects one from the clusters according to the feature vector extracted in, and all the feature vectors belonging to the selected cluster, and is based on the created reference vector and the newly extracted feature vector. It is provided with an abnormality measurement calculation unit that calculates an abnormality measurement, and an abnormality detection unit that determines whether the sensor signal at each time is normal or abnormal by comparing the abnormality measurement with a threshold value.

According to the present invention, it is possible to provide an abnormality detection device and an abnormality detection method capable of high-speed processing.

It is a functional block diagram of the abnormality detection device in this Example. It is a block block diagram of the hardware image of the abnormality detection device in this Example. It is a figure which shows the example which made a list of a plurality of sensor signals in this Example and represented them in a tabular form. It is a schematic process flow diagram of the whole performed by the abnormality detection device in this Example. It is a flow diagram of the clustering process at the time of learning in this Example. It is a processing flow diagram of the cluster initial position setting processing in this Example. It is a processing flow diagram of k-means clustering processing in this Example. It is a flow chart of the cluster member adjustment processing in this Example. It is a figure explaining the anomaly measure calculation process by the neighborhood data preset method in this Example. It is a figure explaining the anomaly measure calculation process by the neighborhood data search method in this Example. It is a flow chart of the abnormality measure calculation processing at the time of learning in this Example. It is a flow chart of other abnormality measure calculation processing at the time of learning in this Example. It is a flow chart of the abnormality measure calculation processing at the time of abnormality detection in this Example. It is a flow chart of another abnormality measure calculation processing at the time of abnormality detection in this Example. It is a figure which shows the GUI which sets the offline analysis condition in this Example. It is a figure which shows the GUI which specifies the display target of the online analysis result in this Example. It is a figure which shows the analysis result whole display screen in this Example. It is a figure which shows the analysis result enlarged display screen in this Example.

Hereinafter, examples of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a functional configuration block diagram of the abnormality detection device in this embodiment. In FIG. 1, the abnormality detection device 100 acquires the sensor signal 102 output from the sensor mounted on the equipment 101 to be detected (periodically) at predetermined time intervals. The acquired sensor signal 102 is temporarily stored in the sensor signal storage unit 103. The sensor signal input unit 104 inputs the sensor signal 102 directly from the sensor signal storage unit 103 or from the sensor mounted on the equipment 101, and sends the sensor signal 102 to the feature vector extraction unit 105. The feature vector extraction unit 105 extracts a feature vector at predetermined time intervals (hereinafter, may be expressed as each time) based on the sensor signal 102, and sends the feature vector to the clustering unit 106 and the cluster selection unit 108. The clustering unit 106 performs clustering using the feature vectors of the learning period specified in advance, and stores the center of the cluster and the feature vectors belonging to the cluster as learning data in the learning result storage unit 107. The cluster selection unit 108 selects a cluster according to the feature vector for each feature vector from the clusters accumulated as training data, and the anomaly measure calculation unit 109 selects all the features belonging to the selected cluster for each feature vector. Calculate the anomaly measure using a vector.

The threshold value calculation unit 110 calculates the threshold value based on the abnormality measure of the learning data by the abnormality measure calculation unit 109. The threshold value calculated by the threshold value calculation unit 110 is stored in the learning result storage unit 107 as a learning result. The anomaly detection unit 111 detects and detects an abnormality in the equipment 101 by comparing the anomaly measure of each feature vector sent from the anomaly measure calculation unit 109 with the threshold value calculated by the threshold value calculation unit 110. The result 112 is output to the outside.

Further, FIG. 2 is a block configuration diagram of a hardware image of the abnormality detection device in this embodiment. In FIG. 2, the abnormality detection device 100 is realized by a device having a processing device (CPU), a storage device (memory), and an input / output interface (I / F), which are general information processing devices. That is, the processing of the sensor signal input unit 104, the feature vector extraction unit 105, the clustering unit 106, the cluster selection unit 108, the abnormality measurement calculation unit 109, the threshold value calculation unit 110, and the abnormality detection unit 111 of the abnormality detection device 100 in FIG. Is executed by the CPU 10 software processing those processing programs stored in the memory 20 in FIG. Further, the sensor signal storage unit 103 and the learning result storage unit 107 in FIG. 1 correspond to the memory 20 in FIG. Further, the sensor signal 102 is acquired by the input I / F30. Further, the abnormality detection signal from the abnormality detection unit 111 in FIG. 1 is output to an external display device or the like via the output I / F40.

Note that each configuration of FIG. 1 may be realized by hardware, for example, by designing a part or all of them with an integrated circuit. When each configuration is realized by software, information such as programs, data, and files that realize each function can be stored not only in a memory but also in a recording device such as a hard disk or a recording medium such as an IC card. However, it is also possible to download and install it via a wireless network or the like as needed. Further, the processing performed by the CPU 10 may be performed on the cloud via a wireless network or the like.

Here, a brief explanation of the terms used below will be given. The feature vector is a representation of the values measured by a plurality of sensors as one vector value. The anomalous measure is the amount of offset of the feature vector of interest from the feature vector over a specified time period. The equipment 101 targeted for abnormality detection is, for example, equipment or a plant such as a gas turbine or a steam turbine.

FIG. 3 is an example in which a plurality of sensor signals 102 are listed and represented in a table format. The sensor signal 102 is a multidimensional time-series signal in which a plurality of physical information having different physical characteristics is acquired at predetermined intervals. The structure of the table shown in FIG. 3 shows the information of the date and time 201 and the sensor signal values 202 of the plurality of sensors in correspondence with each other. Sensors can range from hundreds to thousands, depending on their type, for example, temperature of cylinders, oil, cooling water, pressure of oil or cooling water, shaft speed, room temperature, operating time, etc. Is output as a sensor value. The sensor value not only represents the output or state of equipment or plant, but may also be a control signal for controlling the state of something to a certain value (for example, a target value).

FIG. 4 is an overall outline processing flow diagram performed by the abnormality detection device 100 in this embodiment. Here, the operation of the abnormality detection device 100 includes a "learning" process in which learning data is generated and saved using the data stored in the sensor signal storage unit 103, and "abnormality detection" in which an abnormality is detected based on an input signal. There is a processing phase. Basically, "learning" is an offline process, and "anomaly detection" is an online process. However, it is also possible to make "abnormality detection" an offline process. In the following explanation, they are distinguished by the words "at the time of learning" and "at the time of abnormality detection".

FIG. 4A shows an abnormality measure calculation process during learning, in which a sensor signal during the learning period is input (S301), feature vector extraction (S302), clustering (S303), cluster selection (S304), and abnormality measure calculation. (S305) and the calculation of the threshold value (S306) are performed. FIG. 4B shows an abnormality determination process at the time of abnormality detection, in which a sensor signal to be detected is input (S311), feature vector extraction (S312), cluster selection (S313), and abnormality measure calculation (S314) are performed. .. Then, the normality / abnormality of the equipment is determined by comparing the calculated abnormality measure with the threshold value obtained in S306 (S315).
The details of FIGS. 4 (a) and 4 (b) will be described below, but the detailed flow of FIG. 4 (a) is shown in FIGS. 5, 6, 7, 8, 10, 10A, and 10B. The detailed flow of (b) will be described with reference to FIGS. 11A and 11B.

First, the abnormality measure calculation process during learning in FIG. 4A will be described. In step S302, the feature vector extraction unit 105 normalizes the input sensor signal and extracts the feature vector. Normalization of sensor signals is performed in order to handle a plurality of sensor signals having different units and scales in the same manner. Specifically, each sensor signal is converted so that the average is 0 and the variance is 1 by using the average and standard deviation of the learning period of each sensor signal. The average and standard deviation of each sensor signal are stored in the learning result storage unit 107 so that the same conversion can be performed when an abnormality is detected. Alternatively, each sensor signal is converted so that the maximum is 1 and the minimum is 0 by using the maximum and minimum values of the learning period of each sensor signal. Alternatively, preset upper and lower limit values may be used instead of the maximum and minimum values. In this case, the maximum value and the minimum value or the upper limit value and the lower limit value of each sensor signal are stored in the learning result storage unit 107 so that the same conversion can be performed when an abnormality is detected.

In the feature vector extraction, the canonicalized sensor signal is arranged as it is as an element to form a vector. Alternatively, a window of ± 1, ± 2, ... For a certain time is provided, and the time change of the sensor signal is represented by setting the window width (3, 5, ...) × the feature vector of the number of sensors. Features can also be extracted. Further, the discrete wavelet transform (DWT: Discrete Wavelet Transform) may be performed to decompose into frequency components.

FIG. 5 is a flow chart of the clustering process (S303) at the time of learning in this embodiment. In FIG. 5, first, the feature vector of the learning period extracted by the feature vector extraction unit 105 is input (S401). Next, in the clustering unit 106, the learning period is divided into a plurality of sections (S402). It is desirable that one section has a constant length, and for example, one day is set as one section. Alternatively, in the case of batch processing such as a chemical plant, it may be for each batch, in the case of a processing device, it may be for each individual to be processed, and in the case of a medical device such as MRI, it may be for each inspection target. Next, based on the input feature vector, cluster center initial placement is performed (S403), and k-means clustering is performed (S404). Then, the members of each cluster are adjusted (S405). Here, the member of the cluster is a feature vector belonging to the cluster. In S403, the similarity between the feature vectors of different sections is regarded as 0. Further, in the processes of steps S404 and S405, feature vectors of different sections are prevented from being mixed in one cluster. Next, in the learning result storage unit 107, the section ID, the center, and the cluster members of each cluster are recorded (S406). Hereinafter, the cluster center initial arrangement (S403), k-means clustering (S404), and cluster member adjustment (S405) will be described in detail.

First, the cluster center initial arrangement (S403) will be described. FIG. 6 is a flow chart of the initial setting process of the cluster center position in this embodiment. In FIG. 6, first, the maximum number of clusters and the censoring reference value of the initial arrangement, that is, the reference similarity, are input (S501). Next, the first feature vector of the specified learning period is set as the first cluster center (S502). Next, the processes of steps S504 to S507 are repeated up to the maximum number of clusters (S503). First, the degree of similarity between the set cluster center and all the feature vectors of the learning period is calculated (S504). The degree of similarity is calculated as 1 / (1 + distance). However, if the intervals are different, the similarity is set to 0. Next, the maximum value of similarity with the cluster center is obtained for all feature vectors (S505). If the minimum value of this value is smaller than the censoring reference value (S506), the feature vector that minimizes the maximum value of similarity with the cluster center is set as the next cluster center (S507). That is, the feature vector farthest to the nearest cluster center is the cluster center. When the number of clusters reaches the maximum number, the loop is exited and the process ends (S508). If the minimum value of the maximum value of the similarity is equal to or greater than the censoring reference value in step S506, the processing is censored, that is, the loop is exited and the processing is terminated (S508). By this censoring, the number of clusters can be suppressed to the minimum necessary, so that not only the calculation time of the cluster center initial placement process can be shortened, but also the calculation time of the entire clustering process and the anomaly measure calculation process can be shortened.

The initial position of the cluster center is generally arranged randomly, and may be arranged randomly in this embodiment as well. However, in equipment with switching between operation and stop, the data in the transient state is less than the data in the steady state, so it is difficult to select the initial center position if randomly selected. Then, the influence of the transient data on the cluster center calculation becomes relatively small. The method of the cluster center initial placement process described above aims at initial placement of the cluster centers far from each other, whereby the number of transient clusters can be increased.

Next, k-means clustering (S404) will be described. FIG. 7 is a flow chart of the clustering process by the k-means method in this embodiment. In FIG. 7, first, the maximum number of repetitions and the censoring reference value are input (S601). Next, the processes of steps S603 to S605 are repeated up to the maximum number of repetitions (S602). First, cluster members are distributed to all feature vectors in the designated learning period (S603). Specifically, each feature vector is a member of the cluster with the shortest distance to the center. For each cluster, the average of the feature vectors of all cluster members is taken as the new cluster center vector (S604). When the movement amount at the center of the cluster is larger than the censoring reference value (S605), the process returns to the first processing of the loop (S603). If not, the loop is exited and the process ends (S606). When the maximum number of repetitions is reached, the loop is exited and the process is terminated (S606).

In the cluster member distribution (S603), if the section of the feature vector and the section ID of the cluster recorded in step S406 do not match, the distance is regarded as infinite. Therefore, all members of one cluster are feature vectors of the same interval. As a result, the distance calculation process can be largely omitted.

Next, cluster member adjustment (S405) will be described. The purpose of this process is to align the number of members of each cluster with the number of neighboring data required for calculating the anomaly measure. FIG. 8 is a flow chart of the cluster member adjustment process in this embodiment. First, the specified value of the number of cluster members is input (S701). Next, the processes of steps S703 to S706 are repeated for each cluster (S702). First, if the number of members in the cluster is less than the specified number (S703), members are added to the cluster so that the number becomes the specified number (S704). The members to be added are determined in order of proximity to the cluster center among the feature vectors other than the members. If the number of cluster members is equal to or greater than the specified value in step S703, step S704 is skipped. Next, if the number of cluster members is greater than the specified value (S705), the number is thinned out to the specified number (S706). Members to be thinned out may be randomly determined. The large number of cluster members means that the vector density is high in the feature space, and it does not make much difference if any member is deleted.

Next, the learning processes (S304 to S306) of FIG. 4A in the cluster selection unit 108, the abnormality measure calculation unit 109, and the threshold value calculation unit 110 will be described. There are two types of anomaly measure calculation processing, and one of the methods shall be selected in advance. In the following description, they will be referred to as a neighborhood data preset method and a neighborhood data search method, respectively.

FIG. 9A is a diagram illustrating an abnormality measure calculation process by the neighborhood data preset method. The projection distance when the attention vector q is projected onto the k-1 dimensional affine subspace spanned by k vectors that are members of the nearest cluster of the attention vector q is measured. FIG. 9A is an example in the case of k = 3. The affine subspace, that is, the plane is formed by the three vectors x1 to x3, the point Xb on the affine subspace closest to the attention vector q becomes the projection point (reference vector), and the distance from the attention vector q to the reference vector Xb is It is an anomalous measure. It should be noted that k may be any number as long as it is sufficiently smaller than the number of dimensions of the feature vector.

Explain the specific calculation method. From the evaluation data q and k vectors xi (i = 1, ..., K), a matrix Q in which k qs are arranged and a matrix X in which xis are arranged are created, and a correlation matrix of both is created from Eq. Find C. Next, the coefficient vector b representing the weighting of the neighborhood vector xi is calculated from the equation (2). The anomaly measure d is calculated by the norm of the vector (q-Xb) or its square.

FIG. 9B is a diagram illustrating an anomaly measure calculation process by the neighborhood data search method. A k-1 dimensional affine subspace in which k neighborhood vectors with respect to the attention vector q are searched and selected for members of one or several neighborhood clusters of the attention vector q, and the selected k neighborhood vectors are stretched. Measure the projection distance when the attention vector q is projected to. Let xi (i = 1, ..., K) be the k selected neighborhood vectors, calculate the vector b using equations (1) and (2), and use the norm of the vector (q-Xb) or The anomaly measure is calculated from the square.

FIG. 10A is a flow chart of the abnormality measure calculation process at the time of learning when the neighborhood data preset method is selected. In FIG. 10A, first, the feature vector of the learning period is input (S901), and the learning period is divided into a plurality of sections (S902). This section shall be divided so as to be the same as step S402. Next, the following processing is repeated for all the extracted feature vectors (S903). First, the distance from the attention vector to the reference vector one time ago is calculated (S904). When the calculated distance is larger than the maximum value of the calculated anomaly measure of the section to be processed (S905), the cluster selection unit 108 selects the nearest neighbor cluster closest to the attention vector among the clusters in the section different from the attention vector. (S906). Next, the anomaly measure calculation unit 109 calculates a reference vector by the method shown in FIG. 9A using all the members of the nearest neighbor cluster (S907), and calculates the distance to the reference vector to obtain an anomaly measure (S908). .. If the condition of step S905 is not satisfied, that is, if the distance to the reference vector one time before is equal to or less than the maximum value of the calculated abnormality measure of the processing target section, the processing from steps S906 to S908 is skipped. The maximum value of the anomaly measure is a candidate for the anomaly determination threshold, and the distance calculated in step S908 is not larger than the distance calculated in step S904. Therefore, the calculation is discontinued because the maximum value is not changed. There is. By discontinuing the calculation, the calculation time for calculating the anomaly measure can be shortened. When the abnormality measure calculation process for all feature vectors is completed, the threshold value calculation unit 110 calculates the threshold value (S909). Specifically, the maximum value of the anomaly measure is set as the threshold value.

In step S905, since the entire loop of step S903 was intended to be processed in parallel for each section, it was compared with the maximum value of the section to be processed. However, it is not always necessary to perform parallel processing, and if parallel processing is not performed, the entire loop is processed. Compare with the calculated maximum value of the anomaly measure.

FIG. 10B is a flow chart of the abnormality measure calculation process at the time of learning when the neighborhood data search method is selected. When selecting the neighborhood data search method, it is difficult to prevent the feature vectors of different sections from being mixed in one cluster in the clustering process described with reference to FIG. 5, so the feature vectors of different sections in one cluster. It is assumed that there is a possibility that

In FIG. 10B, first, the feature vector of the learning period is input (S911), and the learning period is divided into a plurality of sections in the same manner as in step S402 (S912). Next, the following processing is repeated for all the extracted feature vectors (S913). First, the distance from the attention vector to the reference vector one time ago is calculated (S914). When the calculated distance is larger than the maximum value of the calculated anomaly measure of the processing target section (S915), the cluster selection unit 108 selects a specified number of neighboring clusters from the one closest to the attention vector (S916). Next, the anomaly measure calculation unit 109 extracts a neighborhood search target from the members of the selected cluster, excluding the vector in the same section as the attention vector (S917). As shown in FIG. 9B, a specified number of neighborhood data is searched from the extracted neighborhood search target (S918), a reference vector is calculated using the searched neighborhood data (S919), and the distance to the reference vector is calculated. Calculate and use as an abnormality measure (S920). If the condition of step S915 is not satisfied, that is, if the distance to the reference vector one time before is equal to or less than the maximum value of the calculated abnormality measure of the processing target section, the processing from steps S916 to S920 is skipped.

When the abnormality measure calculation process for all feature vectors is completed, the threshold value calculation unit 110 calculates the threshold value (S921). This threshold value is compared with the abnormality measure input to the abnormality detection unit 113, and is used to determine the normality / abnormality of the equipment. The threshold value calculation unit 110 calculates a threshold value that does not determine normal learning data as abnormal. In other words, the maximum value of the anomalous measure obtained from normal learning data is calculated as the threshold value.

Since the process of FIG. 10A does not require the neighborhood data search process after selecting the cluster, the effect of shortening the calculation time is greater than the process of FIG. 10B. However, it is preferable that both the process of FIG. 10A and the process of FIG. 10B are provided and can be selected according to the data. This is because the processing of FIG. 10B has the same sensitivity as the conventional method, whereas the processing of FIG. 10A may reduce the sensitivity beyond the permissible range depending on the data.

In the learning process, the learning result is saved in the learning result storage unit 107. The data saved as the training result includes at least the parameters for feature vector extraction, the parameters for calculating the anomaly measure, the parameters for sensor normalization, the number of clusters, and the center position and member vectors of each cluster. There are ID and interval ID, all feature vector data that are members of any cluster, and anomaly determination threshold. The parameters for extracting the feature vector and the parameters for calculating the anomaly measure are the same as those specified at the time of learning. The parameters for sensor normalization are the average, standard deviation, maximum value, minimum value, and the like of each sensor signal calculated by the feature vector extraction unit 105 in the process of step S302.

The anomaly measure calculation process described with reference to FIGS. 9A and 9B is a modification of the local subspace method, but the projection distance method or the Gaussian process may be used.

The projection distance method is a method of creating a subspace with a unique origin for the selected feature vector, that is, an affine subspace (space with the maximum variance). A plurality of feature vectors corresponding to the attention vector are selected by some method, and the affine subspace is calculated by the following method.

First, the mean μ of the selected feature vectors and the covariance matrix Σ are obtained, then the eigenvalue problem of Σ is solved, and a matrix U in which the eigenvectors corresponding to r predetermined eigenvalues are arranged from the largest value is obtained. Let it be an orthonormal basis of the affine subspace. r is a number smaller than the dimension of the feature vector and smaller than the number of selected data. Alternatively, r may not be a fixed number, but may be a value when the cumulative contribution rate from the larger eigenvalue exceeds a predetermined ratio. The point on the affine subspace closest to the attention vector is the reference vector. Further, the vector obtained by subtracting the reference vector from the vector of interest is the residual vector, and the norm of the residual vector or the square of the norm is the anomalous measure.

Here, as a method of selecting a plurality of feature vectors, if the feature vectors to be learned are clustered in advance and the feature vectors included in the cluster closest to the attention vector are selected, the processing flow described with reference to FIG. 10A can be used. , The anomaly measure can be calculated. The difference from the local subspace method is that the affine subspace having a dimension smaller than k-1 is calculated from k feature vectors.

Next, the abnormality determination process at the time of abnormality detection in FIG. 4B will be described. In step S311, the sensor signal input unit 104 inputs the sensor signal 102 directly from the sensor signal storage unit 103 or from the sensor mounted on the equipment 101. In step S312, the feature vector extraction unit 105 normalizes the input sensor signal and extracts the feature vector in the same manner as in step S302. The normalization of the sensor signals is performed using the average and standard deviation of each sensor signal or the maximum and minimum values calculated in step S302 and stored in the learning result storage unit 107.

Hereinafter, the processing (S313 to S315) at the time of abnormality detection in FIG. 4B in the cluster selection unit 108, the abnormality measure calculation unit 109, and the abnormality detection unit 111 will be described in detail.

FIG. 11A is a flow chart of abnormality determination processing at the time of abnormality detection when the neighborhood data preset method is selected. The selection method is the same as during learning. In FIG. 11A, the following processing is repeated for all the feature vectors extracted in step S312 (S1001). First, the distance from the attention vector to the reference vector one time ago is calculated (S1002). When the calculated distance is larger than the abnormality determination threshold value calculated in step S306 and stored in the learning result storage unit 107 (S1003), it is stored in the learning result storage unit 107 in the cluster selection unit 108. The nearest neighbor cluster closest to the vector of interest is selected from the clusters (S1004). Next, the distance from the attention vector to the center of the nearest neighbor cluster is calculated (S1005), and when the value is larger than the abnormality determination threshold value (S1005), the anomaly measure calculation unit 109 determines all the members of the nearest neighbor cluster. The reference vector is calculated by the method shown in FIG. 9A (S1006), and the distance to the reference vector is calculated and used as an abnormality measure (S1007). The abnormality detection unit 111 compares the abnormality measure with the abnormality determination threshold value to determine whether it is normal or abnormal (S1008). Specifically, if the anomaly measure is below the threshold value, the equipment is determined to be "normal", and if the anomaly measure is greater than the threshold value, it is determined to be "abnormal". If the condition of step S1003 is not satisfied, that is, if the distance to the reference vector one time before is equal to or less than the abnormality determination threshold value, it is immediately determined to be normal (S1009), and the processing of the attention vector is terminated. Further, when the condition of step S1005 is not satisfied, that is, when the distance to the nearest neighbor cluster is equal to or less than the abnormality determination threshold value, it is immediately determined to be normal (S1009), and the processing of the attention vector is terminated. From the idea that the distance calculated in step S1007 does not become larger than the distance calculated in step S1002 or step S1005, if either of them is equal to or less than the threshold value, it is judged as normal and the calculation is terminated. Can be shortened. In addition, since it is not necessary to search for neighboring data after selecting a cluster, the calculation time when the calculation is not terminated can be shortened. That is, when calculating the anomaly measure from the newly observed feature vector, one cluster is selected according to the newly observed feature vector, and a reference vector is created from all the feature vectors belonging to the selected cluster. Therefore, it is not necessary to search for nearby data, and the calculation time for calculating the anomaly measure can be shortened.

FIG. 11B is a flow chart of abnormality determination processing at the time of abnormality detection when the neighborhood data search method is selected. In FIG. 11B, the following processing is repeated for all the feature vectors extracted in step S312 (S1011). First, the distance from the attention vector to the reference vector one time ago is calculated (S1012). When the calculated distance is larger than the abnormality determination threshold value calculated in step S306 and stored in the learning result storage unit 107 (S1013), it is stored in the learning result storage unit 107 in the cluster selection unit 108. A specified number of neighboring clusters are selected from the clusters closest to the attention vector (S1014). Next, when the distance from the attention vector to the center of the nearest cluster is larger than the abnormality determination threshold value (S1015), the anomaly measure calculation unit 109 extracts all the members of the selected cluster as neighbor search targets (S1016). ). As shown in FIG. 9B, a specified number of neighborhood data is searched from the extracted neighborhood search target (S1017), a reference vector is calculated using the searched neighborhood data (S1018), and the distance to the reference vector is calculated. Calculate and use as an abnormality measure (S1019). The abnormality detection unit 111 compares the abnormality measure with the abnormality determination threshold value and determines whether it is normal or abnormal (S1020). If the condition of step S1013 is not satisfied, that is, if the distance to the reference vector one time before is equal to or less than the abnormality determination threshold value, it is immediately determined to be normal (S1021), and the processing of the attention vector is terminated. Further, when the condition of step S1015 is not satisfied, that is, when the distance to the nearest neighbor cluster is equal to or less than the abnormality determination threshold value, it is immediately determined to be normal (S1021), and the processing of the attention vector is terminated. Similar to the process of FIG. 11A, the calculation time can be shortened by discontinuing the calculation process.

Next, an example of the user interface (GUI) of the abnormality detection device 100 for realizing the above operation will be described.

FIGS. 12A and 12B are examples of GUIs for setting the learning period for performing offline analysis and analysis conditions including processing parameters. On this screen, it is also possible to register the calculated learning result as a recipe. Further, it is assumed that the past sensor signal 102 is stored in the database in association with the equipment ID and the time.

FIG. 12A is an example when the neighborhood data preset method is selected as the abnormality measure calculation method, and FIG. 12B is an example when the neighborhood data search method is selected. On the offline analysis condition setting screen 1101, the target equipment, learning period, test period, clustering parameter, and abnormality measure calculation parameter are input. In the equipment ID input window 1102, the ID of the target equipment is input. By pressing the equipment list display button 1103, a list of device IDs of data stored in the sensor signal storage unit 103 is displayed, and a list is selected and input from the list. If there is only one equipment 101 connected to the abnormality detection device 100, the equipment ID input window 1102 is not displayed.

In the learning period input window 1104, enter the start date and end date of the period for which learning data is to be extracted. In the test period input window 1105, enter the start date and end date of the period to be analyzed. The sensor to be used is input to the sensor selection input window 1106. A sensor list (not shown) is displayed by clicking the list display button 1107, so select and input from the list.

In the clustering parameter setting input window 1108, the number of clusters (1108a) and the number of cluster members (1108b) specified in the processing in the clustering unit 106, and the censoring reference value of the cluster center initial arrangement used in step S506 are converted into distances (1108c). ), The clustering repetition cutoff reference value (1108d) used in step S605 is input. Further, the number of cluster selections (1108e) specified in the process in the cluster selection unit 108 is input. Further, the neighborhood data preset method selection check button (1108f) is specified. Here, when the check button 1108f is checked as shown in FIG. 12A, the number of cluster members is fixed to the same value as the number of data k used for creating the reference vector, and the number of selected clusters is fixed to 1, making it uneditable. .. Then, processing is performed according to the processing flow shown in FIG. 10A during learning and FIG. 11A during abnormality detection. The larger the initial arrangement and the repeat censoring reference value, the faster the censoring is performed, and when it is set to 0, the censoring is not performed. As shown in FIG. 12B, when the check button 1108f is not checked, the number of cluster members (1108b) and the number of cluster selections (1108e) can be edited, as shown in FIG. 10B during learning and in FIG. 11B when an abnormality is detected. It is processed according to the processing flow shown.

In the anomaly measure calculation parameter input window 1109, input the parameters used in the anomaly measure calculation. The figure is an example when a local subspace is adopted as a method, and the number of neighborhood vectors k (1109a) and the regularization parameter (1109b) used for creating the reference vector are input. The regularization parameter is a small number to be added to the diagonal component in order to prevent the inverse matrix of the correlation matrix C from being obtained in Eq. (2). In addition, a check button (1109c) for whether to execute the anomaly measure calculation discontinuation based on the distance to the reference vector one time ago, and a check button (1109c) for executing the anomaly measure calculation discontinuation based on the distance to the nearest cluster. 1109d) is specified. If the check button 1109c is not checked, the processes of steps S904 to S905 or S914 to S915 and the processes of steps S1002 to S1003 or S1012 to S1013 are not executed. If the check button 1109d is not checked, the process of step S1005 or S1015 is not executed.

When the above analysis condition information is confirmed, the offline analysis is executed by pressing the execute button 1111.
First, learning is executed according to the processing flow of FIG. 4A using the sensor signal during the learning period. As learning results, the average and standard deviation for each sensor signal calculated in step S302, the center position of each cluster calculated in step S303, the ID and section ID of the vector to be a member, and the feature vector data extracted in step S302. Among them, the data that becomes a member of any of the clusters and the threshold value calculated in step S306 are saved. Further, the abnormality measure calculated in step S305 is compared with the threshold value to determine whether it is normal or abnormal, and the determination result, the abnormality measure, and the threshold value are also stored as time-series data. Next, using the sensor signal during the test period, the anomaly measure is calculated according to the processing flow shown in FIG. 4 (b), and whether it is normal or abnormal is determined. Save as.

After the analysis is completed, the result display screen described later is displayed. When the confirmation by the user is completed, the screen returns to the offline analysis condition setting screen 1101. By inputting the recipe name in the recipe name input window 1110 and pressing the registration button 1112, the learning result and the analysis result are saved in association with the equipment ID and the recipe name, and the process ends. Here, the learning result includes the sensor selection information, the clustering parameter, and the abnormality measurement calculation parameter input in the input windows 1106, 1108, and 1109, in addition to the data created and saved by executing the learning. When the end button 1113 is pressed, the process ends without doing anything. In this case, the learning result created and saved by learning and the analysis result created and saved by the subsequent abnormality detection process are deleted or overwritten by the analysis executed next.

The registered learning results are managed with a label of active or inactive, and then online analysis is executed. In the online analysis, the newly input data is subjected to the processing shown in FIG. 4B using the information of the active learning result whose device ID matches, and the result is saved in association with the recipe name and the processing date and time. I will do it. These processes are performed on a regular basis, for example, daily. For equipment with a short sampling interval or equipment that requires real-time performance, the execution interval should be shorter.

FIG. 12C is an example of a GUI for designating a display target of online analysis results. The user specifies the equipment, recipe, and period to be displayed from the display target specification screen 1121. First, the equipment ID is selected by the device ID selection window 1122. Next, the recipe to be displayed is selected from the list of recipes for the equipment ID (1122) by the recipe name selection window 1123. The data recording period display unit 1124 displays the start date and end date of the period in which the input recipe is processed and the recording is left. In the result display period specification window 1125, enter the start date and end date of the period for which the result is to be displayed. When the display button 1126 is pressed, the result of the abnormality detection process is displayed. When the end button 1127 is pressed, the process of specifying the display target is terminated.

13A and 13B are examples of GUI for showing the analysis result to the user. When the user selects a tab displayed at the top of each screen, the user switches to either the analysis result overall display screen 1201 or the analysis result enlarged display screen 1202.

FIG. 13A is an example of the analysis result overall display screen 1201. The analysis result overall display screen 1201 displays an abnormality measure, a threshold value, a determination result, and a time series graph of the sensor signal for a specified period. When displaying the result of the offline analysis, the period display window 1203 displays the learning period and the test period specified in FIG. 12A. When displaying the result of the online analysis, although not shown, the result display period specified in FIG. 12C is displayed.

In the abnormality measure display window 1204, the abnormality measure 1204a, the threshold value 1204b (broken line), and the judgment result 1204c in the designated learning period / test period or result display period are displayed. In addition, a circle 1204d is displayed in the section used for learning. In the sensor signal display window 1205, the time series sensor signal 1205a is displayed for the designated sensor in the designated learning period / test period or result display period.

In the sensor selection window 1206, the sensor is specified by the user's input. However, before the user specifies it, the first sensor used is selected. The cursor 1207 represents the starting point at the time of enlarged display, and can be moved by the user's mouse operation. The number of days from the start point to the end point of the enlarged display on the analysis result enlarged display screen 1202 is displayed in the display days designation window 1208, and can be input on this screen. The date at the cursor position is displayed in the date display window 1209. By pressing the end button 1210, both the analysis result overall display screen 1201 and the analysis result enlarged display screen 1202 are erased, and the analysis result display ends.

FIG. 13B is an example of the analysis result enlarged display screen 1202. On the analysis result enlarged display screen 1202, the abnormality measurement, the threshold value, and the determination within the period of the number of days specified by the display days designation window 1208, starting from the date indicated by the cursor 1207 on the analysis result overall display screen 1201. The result and the time series graph of the sensor signal are displayed. That is, the same information as the analysis result overall display screen 1201 is enlarged and displayed on the abnormality measure display window 1204 and the sensor signal display window 1205.

The scroll bar 1211 and the scroll bar area 1212 are additionally displayed on the analysis result enlarged display screen 1202. The length of the scroll bar 1211 corresponds to the number of days specified in the display days designation window 1208, and the total length of the scroll bar area 1212 corresponds to the period displayed on the analysis result overall display screen 1201. Further, the left end portion of the scroll bar 1211 corresponds to the starting point of the enlarged display. The user can also change the starting point of the display by operating the scroll bar 1211, and this change is reflected in the position of the cursor 1207 on the analysis result overall display screen 1201 and the display of the date display window 1209.
As described above, according to the present embodiment, it is possible to provide an abnormality detection device and an abnormality detection method capable of high-speed processing.

100: Anomaly detection device, 101: Equipment, 102: Sensor signal, 103: Sensor signal storage unit, 104: Sensor signal input unit, 105: Feature vector extraction unit, 106: Clustering unit, 107: Learning result storage unit, 108: Cluster selection unit, 109: Abnormality measurement calculation unit, 110: Threshold calculation unit, 111: Abnormality detection unit, 1101: Offline analysis condition setting screen, 1121: Display target specification screen, 1201: Analysis result overall display screen, 1202: Analysis result enlarged display screen.

Claims (9)

1. A sensor signal input unit that inputs multiple time-series sensor signals output from multiple sensors installed in the equipment,
   A feature vector extraction unit that extracts a feature vector from the sensor signal at each time of day,
   A clustering unit that clusters the feature vectors for a specified learning period and adjusts the feature vectors belonging to each cluster to a certain number.
   A cluster selection unit that selects one or several from the clusters according to the newly extracted feature vector, and
   A predetermined number of feature vectors are selected from the feature vectors belonging to the selected cluster according to the newly extracted feature vector, a reference vector is created using the selected feature vector, and the reference vector is combined with the created reference vector. Anomalous measure calculation unit that calculates anomalous measure based on the newly extracted feature vector,
   It is provided with an abnormality detection unit that determines whether the sensor signal at each time is normal or abnormal by comparing the abnormality measure with a threshold value.
   At the time of abnormality detection, the abnormality measure calculation unit calculates a temporary abnormality measure based on the newly extracted feature vector and the center position of the selected cluster.
   The abnormality detection unit is an abnormality detection device, characterized in that the sensor signal is determined to be normal when the provisional abnormality measure is equal to or less than the threshold value.
2. A sensor signal input unit that inputs multiple time-series sensor signals output from multiple sensors installed in the equipment,
   A feature vector extraction unit that extracts a feature vector from the sensor signal at each time of day,
   A clustering unit that clusters the feature vectors for a specified learning period and adjusts the feature vectors belonging to each cluster to a certain number.
   A cluster selection unit that selects one or several from the clusters according to the newly extracted feature vector, and
   A predetermined number of feature vectors are selected from the feature vectors belonging to the selected cluster according to the newly extracted feature vector, a reference vector is created using all the selected feature vectors, and the created reference vector is created. And the anomaly measure calculation unit that calculates the anomaly measure based on the newly extracted feature vector,
   It is provided with an abnormality detection unit that determines whether the sensor signal at each time is normal or abnormal by comparing the abnormality measure with a threshold value.
   The anomaly measure calculation unit calculates a tentative anomaly measure based on the newly extracted feature vector and the reference vector one time before the cluster selection in the cluster selection unit, and at the time of learning, the tentative measure is calculated. When the anomaly measure is equal to or less than the maximum value of the anomaly measure calculated in the section to be processed, the provisional anomaly measure is defined as the anomaly measure when the provisional anomaly measure is equal to or less than the threshold value at the time of abnormality detection. Anomaly detection device characterized by this.
3. The abnormality detection device according to claim 1 or 2.
   The clustering unit adds clusters one by one so that the initial arrangement of the cluster center positions is low in similarity to each other, and the similarity to each other is higher than the specified reference similarity or the specified maximum number. Anomaly detection device characterized in that addition is stopped when the number exceeds.
4. The abnormality detection device according to claim 1 or 2.
   The clustering unit divides the learning period into a plurality of sections in advance, and performs clustering so that the sections of the feature vectors belonging to one cluster are the same.
   The cluster selection unit selects one from the cluster in a section different from the newly extracted feature vector at the time of learning, and from the cluster at the time of abnormality detection according to the newly extracted feature vector.
   The anomaly measure calculation unit is an anomaly detection device characterized in that a reference vector is created using all the feature vectors belonging to the selected cluster.
5. A feature vector is extracted for each time by inputting multiple time-series sensor signals.
   The feature vectors of the specified learning period are clustered and the feature vectors belonging to each cluster are adjusted to a certain number.
   The center of each cluster and the feature vectors belonging to the clusters are accumulated as training data, and one or several clusters are selected from the clusters accumulated as training data according to the newly extracted feature vector.
   A predetermined number of feature vectors are selected from the feature vectors belonging to the selected cluster according to the newly extracted feature vector, and a reference vector is created using all the selected feature vectors.
   Anomalous measures are calculated based on the newly extracted feature vector and the created reference vector.
   By comparing the anomaly measure with the threshold value, it is determined whether the sensor signal at each time is abnormal or normal.
   In the calculation of the anomaly measure, a temporary anomaly measure is calculated based on the newly extracted feature vector and the center position of the selected cluster at the time of abnormality detection.
   The abnormality detection method is characterized in that the sensor signal is determined to be normal when the provisional abnormality measure is equal to or less than the threshold value.
6. A feature vector is extracted for each time by inputting multiple time-series sensor signals.
   The feature vectors of the specified learning period are clustered and the feature vectors belonging to each cluster are adjusted to a certain number.
   The center of each cluster and the feature vectors belonging to the clusters are accumulated as training data, and one or several clusters are selected from the clusters accumulated as training data according to the newly extracted feature vector.
   A predetermined number of feature vectors are selected from the feature vectors belonging to the selected cluster according to the newly extracted feature vector, and a reference vector is created using the selected feature vector.
   Anomalous measures are calculated based on the newly extracted feature vector and the created reference vector.
   By comparing the anomaly measure with the threshold value, it is determined whether the sensor signal at each time is abnormal or normal.
   In the calculation of the anomaly measure, a provisional anomaly measure is calculated based on the newly extracted feature vector and the reference vector one time before the cluster selection, and the provisional anomaly measure is calculated at the time of learning. When the anomaly measure is equal to or less than the maximum value of the anomaly measure calculated in the processing target section, the provisional anomaly measure is set as the anomaly measure when the provisional anomaly measure is equal to or less than the threshold value. Anomaly detection method.
7. The abnormality detection method according to claim 5 or 6.
   In the clustering, clusters are added one by one so that the initial arrangement of the cluster center positions is low in similarity with each other, and the similarity with each other is higher than the specified reference similarity, or the specified maximum number is used. An anomaly detection method characterized by stopping the addition when the number exceeds the limit.
8. The abnormality detection method according to claim 5 or 6.
   In the clustering, the learning period is divided into a plurality of sections in advance, and clustering is performed so that the sections of the feature vectors belonging to one cluster are the same.
   For the selection of the cluster, one is selected from the cluster in a section different from the newly extracted feature vector at the time of learning, and one from the cluster at the time of abnormality detection according to the newly extracted feature vector.
   The anomaly measurement method is an anomaly detection method characterized in that a reference vector is created using all feature vectors belonging to the selected cluster.
9. A program that causes the CPU to execute the abnormality detection method according to any one of claims 5 to 8.

Images