WO2022113501A1 - 異常検知システム、異常検知方法およびプログラム - Google Patents

異常検知システム、異常検知方法およびプログラム Download PDF

Info

Publication number
WO2022113501A1
WO2022113501A1 PCT/JP2021/034889 JP2021034889W WO2022113501A1 WO 2022113501 A1 WO2022113501 A1 WO 2022113501A1 JP 2021034889 W JP2021034889 W JP 2021034889W WO 2022113501 A1 WO2022113501 A1 WO 2022113501A1
Authority
WO
WIPO (PCT)
Prior art keywords
score
parameter
value
abnormality detection
operation data
Prior art date
Application number
PCT/JP2021/034889
Other languages
English (en)
French (fr)
Japanese (ja)
Inventor
光太郎 酒見
一幸 若杉
渉 酒井
Original Assignee
三菱重工業株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 三菱重工業株式会社 filed Critical 三菱重工業株式会社
Publication of WO2022113501A1 publication Critical patent/WO2022113501A1/ja

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B23/00—Testing or monitoring of control systems or parts thereof
    • G05B23/02—Electric testing or monitoring

Definitions

  • This disclosure relates to anomaly detection systems, anomaly detection methods and programs. This disclosure claims priority based on Japanese Patent Application No. 2020-196311 filed in Japan on November 26, 2020, the contents of which are incorporated herein by reference.
  • Patent Document 1 operation data of equipment to be monitored is collected in the learning phase, an abnormality detection model is constructed from the operation data, and in the monitoring phase, individual operation data is obtained from the operation data and the abnormality detection model.
  • an anomaly detection system that calculates an anomaly score and determines that an anomaly has occurred when the anomaly score exceeds the threshold value.
  • an abnormality detection method that calculates an abnormality score for one monitoring item such as temperature and pressure included in the operation data and determines the abnormality score by a threshold value, it is possible to detect an abnormality that can be judged by the instantaneous value of the monitoring item. can.
  • the value of the monitoring item may exceed the threshold value even if no abnormality has occurred, and the abnormality of one monitoring item is determined by paying attention to only one abnormality score. If so, the accuracy of abnormality detection may decrease.
  • the present disclosure provides an abnormality detection system, an abnormality detection method and a program capable of solving the above-mentioned problems.
  • the abnormality detection system relates to a data acquisition unit that acquires operation data of the device to be monitored, and the value of the first parameter that is a measured value of the monitoring target included in the operation data.
  • a score calculation unit that calculates a plurality of types of probabilities of observing values using different methods and calculates a score indicating the degree of abnormality for each of the plurality of types of probabilities, a plurality of the scores, and a judgment model.
  • an abnormality detection unit that determines whether or not each of the plurality of scores is abnormal, and detects an abnormality of the apparatus based on the results of the plurality of determinations.
  • the abnormality detection system acquires the operation data of the device to be monitored, and the value of the first parameter, which is the measured value of the monitoring target included in the operation data, is set.
  • a plurality of types of probabilities in which the value is observed are calculated using different methods, a score indicating the degree of abnormality is calculated for each of the plurality of types of probabilities, and the scores are based on the plurality of scores and a judgment model. Therefore, it is determined whether or not each of the plurality of scores is abnormal, and the abnormality of the apparatus is detected based on the results of the plurality of determinations.
  • the program acquires the operation data of the device to be monitored by the computer, and the value is observed with respect to the value of the first parameter which is the measured value of the monitoring target included in the operation data.
  • a plurality of types of probabilities are calculated using different methods, a score indicating the degree of abnormality is calculated for each of the plurality of types of probabilities, and a plurality of scores are calculated based on the plurality of scores and a determination model. It is determined whether or not each of the scores is abnormal, and a process for detecting an abnormality in the apparatus is executed based on the results of the plurality of determinations.
  • abnormality detection system abnormality detection method and program, the accuracy of abnormality detection can be maintained.
  • FIG. 1 is a functional block diagram showing a configuration example of an abnormality detection system according to an embodiment.
  • the abnormality detection system 10 acquires operation data from the device 20 to be monitored and monitors the behavior of the operation data to detect an abnormality in the device 20.
  • the device 20 is, for example, equipment such as a boiler, a compressor, and a turbine of a plant, a machine tool of a production factory, and the like.
  • the abnormality detection system 10 includes a data acquisition unit 11, a score calculation unit 12, a setting reception unit 13, a learning unit 14, an abnormality detection unit 15, a storage unit 16, a report creation unit 17, and an output unit 18. , Equipped with.
  • the data acquisition unit 11 acquires the operation data of the device 20.
  • the operation data is a value calculated based on a measured value or a measured value measured by a sensor provided in the device 20, such as temperature, pressure, flow rate, vibration, current, electric energy, and rotation speed.
  • the data acquisition unit 11 acquires the operation data and the measurement time of the operation data from the device 20.
  • the measured values included in the operation data and the values calculated based on the measured values are described as parameters.
  • the score calculation unit 12 calculates a score indicating the degree of abnormality in the operation data acquired by the data acquisition unit 11.
  • the score calculation unit 12 includes a first score calculation unit 121, a second score calculation unit 122, a third score calculation unit 123, and a fourth score calculation unit 124.
  • the score calculation unit 12 not only calculates a score focusing only on the parameter to be monitored, but also calculates a score in consideration of the relationship with other parameters.
  • the first score calculation unit 121 calculates the first score, which is the score when only the parameter ⁇ is focused on, for one monitored parameter ⁇ .
  • the first score calculation unit 121 calculates the probability density P ( ⁇ ) of the parameter ⁇ , and calculates the first score based on the value.
  • a negative common logarithm of the probability density P ( ⁇ ) of the parameter ⁇ (for example, ⁇ log 10 (P ( ⁇ ))) is calculated as the first score. That is, when a value having a small probability density is measured for the parameter ⁇ , the first score at that time becomes a large value.
  • the first score is 3.0.
  • the second score calculation unit 122 calculates the second score, which is a score considering the relationship between the parameter ⁇ to be monitored and other parameters that reflect the operating state of the device 20.
  • the operating state of the device 20 is an operation mode such as whether the device 20 is operating at the rated output or at a partial load.
  • another parameter that reflects the operating state of the device 20 is, for example, the load of the power generation facility.
  • the other parameters reflecting the operating state of the device 20 are parameter ⁇
  • the value of parameter ⁇ included in the operation data acquired by the data acquisition unit 11 is ⁇ 1
  • the value of parameter ⁇ is ⁇ 1, for example, the second score is calculated.
  • Part 122 calculates the probability that the value of the parameter ⁇ becomes ⁇ 1 under the condition that the value of the parameter ⁇ becomes ⁇ 1, that is, the conditional probability P ( ⁇ 1
  • the negative regular logarithm is calculated as the second score. That is, when a small conditional probability P ( ⁇ 1
  • the number of other parameters that reflect the operating state of the device 20 may be two or more.
  • the third score calculation unit 123 calculates the third score, which is a score considering the relationship between the parameter ⁇ and other parameters having a strong relationship with the parameter ⁇ to be monitored.
  • the parameters that are strongly related are, for example, the temperature data of the operating system of the same equipment and the temperature data of the redundant system. Alternatively, for example, in the case of a power generation facility, if the turbine speed and the temperature of the fuel gas increase as the load increases, these may be parameters that are strongly related.
  • Other parameters that are closely related to the parameter ⁇ can be selected by machine learning, for example, a decision tree. Alternatively, a user with knowledge may set other parameters that are closely related to the parameter ⁇ .
  • the value of the parameter ⁇ included in the operation data acquired by the data acquisition unit 11 is ⁇ 1, and the value of the parameter ⁇ is ⁇ 1, for example, the third score calculation unit.
  • 123 is a condition in which the value of the parameter ⁇ is ⁇ 1, and the probability that the value of the parameter ⁇ is ⁇ 1, that is, the conditional probability P ( ⁇ 1
  • the common logarithm of is calculated as the third score.
  • the fourth score calculation unit 124 calculates the fourth score, which is a score considering the relationship between the parameter ⁇ to be monitored and all the parameters other than the parameter ⁇ . For example, when the combination of the values of all the other parameters included in the operation data acquired by the data acquisition unit 11 is ⁇ 1 and the value of the parameter ⁇ is ⁇ 1, the fourth score calculation unit 124 uses the values of all the other parameters. Under the condition that the combination of is ⁇ 1, the probability that the value of the parameter ⁇ becomes ⁇ 1, that is, the conditional probability P ( ⁇ 1
  • the setting reception unit 13 accepts various settings. For example, the setting receiving unit 13 receives the setting of the parameter ⁇ that reflects the operating state.
  • the setting receiving unit 13 may accept the setting of the parameter ⁇ , which has a strong relationship with the parameter ⁇ , the setting of the threshold value for determining an abnormality, and the like.
  • the setting reception unit 13 accepts the setting of an index defining a state such as a load and a temperature and a redundant facility as the knowledge of a field worker.
  • the learning unit 14 is a determination model for determining whether or not an abnormality has occurred in the device 20 or whether or not there is a sign of an abnormality based on each score calculated by the first score calculation unit 121 to the fourth score calculation unit 124. To create. For example, the learning unit 14 collects operation data when the device 20 has been operating normally in the past, learns the first score of the parameter ⁇ included in the collected operation data, and how the first score is. A determination model 1 indicating whether the value is normal is created. The learning unit 14 learns the second score calculated based on the parameter ⁇ and the parameter ⁇ included in the normal operation data, and determines what value the second score is normal. Create 2. The learning unit 14 also creates the determination model 3 and the determination model 4 for the third score and the fourth score.
  • the learning unit 14 extracts the parameter ⁇ from the operation data including both the normal time and the abnormal time collected when an abnormality occurs in the device 20 in the past, and the first score and the abnormality in the normal time regarding the parameter ⁇ are extracted.
  • a threshold value (determination model 1) for determining what value the first score becomes to cause an abnormality may be calculated.
  • the learning unit 14 learns the second score at the normal time and the second score at the abnormal time calculated based on the operation data of the device 20 including both the normal time and the abnormal time, and the second score is obtained.
  • a determination model 2 for determining what kind of value causes an abnormality may be created.
  • the learning unit 14 may create a determination model 3 for discriminating between normal and abnormal based on the third score, and a determination model 4 for discriminating between normal and abnormal based on the fourth score.
  • the learning unit 14 may further create one or a plurality of abnormality determination models that do not depend on the first score to the fourth score. For example, normal operation data of the device 20 may be collected, and a cluster by the k-nearest neighbor method or a unit space in the MT (Mahalanobis Taguchi) method may be created as a determination model for the parameter ⁇ included in the operation data.
  • a cluster by the k-nearest neighbor method or a unit space in the MT (Mahalanobis Taguchi) method may be created as a determination model for the parameter ⁇ included in the operation data.
  • the abnormality detection unit 15 detects an abnormality in the device 20 based on the score calculated by the score calculation unit 12 (first score to fourth score) and the determination model created by the learning unit 14 (determination models 1 to 4). do.
  • the abnormality detection unit 15 detects an abnormality using a plurality of scores from the first score to the fourth score. For example, when the determination models 1 to 4 are created based on the first score to the fourth score calculated from the normal operation data, the abnormality detection unit 15 determines the value of the first score calculated by the score calculation unit 12. If the difference between the normal first scores shown by the model 1 is equal to or greater than the threshold value, it is determined that the first score of the parameter ⁇ is abnormal.
  • the abnormality detection unit 15 compares the value of the second score with the determination model 2 to determine whether or not the second score is abnormal, and the third score and the fourth score are also subjected to the determination models 3 and 4, respectively. Whether it is normal or not is determined based on this. For example, when the learning unit 14 calculates a threshold value for determining an abnormality for each of the first score to the fourth score, in the abnormality detection unit 15, the value of the first score calculated by the score calculation unit 12 is the learning unit. If the threshold value calculated by 14 is exceeded, it is determined that the first score of the parameter ⁇ is abnormal. Similarly, the abnormality detection unit 15 determines whether or not the second score to the fourth score are abnormal based on the respective threshold values.
  • the abnormality detection unit 15 detects the abnormality of the device 20 based on the determination result of whether or not the abnormality is determined for each score and each score. For example, the abnormality detection unit 15 selects the highest score among the scores determined to be abnormal, and outputs the value indicated by the selected score as the abnormality detection result.
  • the storage unit 16 stores information such as operation data acquired by the data acquisition unit 11, various settings received by the setting reception unit 13, first score to fourth score, determination models 1 to 4, and detection results by the abnormality detection unit 15.
  • the report creation unit 17 creates a report that describes the transition of the operation data in a predetermined period, the transition of the first score to the fourth score, and the like. The report will be described later with reference to FIG.
  • the output unit 18 outputs a graph showing the transition of the first score to the fourth score calculated by the score calculation unit 12, the abnormality detection result by the abnormality detection unit 15, and the like to the display device.
  • the output unit 18 displays the report created by the report creation unit 17 on the display device or outputs the report to an electronic file.
  • the first score is the probability density calculated by focusing on a single parameter ⁇ . For example, if the parameter ⁇ fluctuates as shown in FIG. 2A, the first score also fluctuates. By monitoring the fluctuation of the first score, the fluctuation of the parameter ⁇ can be grasped. For example, if the first score when the value of the parameter ⁇ is Q1 exceeds the threshold value, the abnormality detection unit 15 determines that the first score is abnormal.
  • FIG. 2B shows an example of the transition of the parameter ⁇ to be monitored and the parameter ⁇ indicating the operating state.
  • the second score indicates the fluctuation of the parameter ⁇ in the operating state at that time. For example, it is assumed that the behaviors of the parameter ⁇ and the parameter ⁇ have a positive correlation during normal operation. In FIG. 2B, the same position on the time axis of the parameters ⁇ and ⁇ indicates the same time. As shown in Q2, even though the parameter ⁇ is constant (the operating state is constant), if only the value of the parameter ⁇ decreases, the second score also fluctuates. By monitoring the fluctuation of the second score, it can be determined whether or not the fluctuation of the parameter ⁇ is abnormal in the current operating state.
  • the case where only the first score fluctuates the case where only the second score fluctuates, and the case where both the first score and the second score fluctuate with respect to the parameter ⁇ .
  • the value of the parameter ⁇ fluctuates due to the change in the operating state, and if the change in the operating state is taken into consideration, it is conceivable that the fluctuation of the parameter ⁇ is within the normal range.
  • the first score is a value indicating a simple variation of the parameter ⁇
  • the second score is a value indicating a variation of the parameter ⁇ in consideration of the operating state.
  • FIG. 2C shows an example of the transition of the parameter ⁇ and the parameters ⁇ 1 and ⁇ 2 that are strongly related.
  • the magnitude of the value of each parameter is shown in the vertical direction of FIG. 2C, and the transition of time is shown in the horizontal direction.
  • the third score indicates the variation of the parameter ⁇ with respect to the strongly related parameters ⁇ 1 and ⁇ 2. For example, it is assumed that the behaviors of the parameters ⁇ and the parameters ⁇ 1 and ⁇ 2 have a positive correlation during normal operation. Even though the parameters ⁇ 1 and ⁇ 2 are decreasing as shown in Q3, if only the value of the parameter ⁇ is increased, the third score also fluctuates.
  • the third score By monitoring the fluctuation of the third score, whether the fluctuation of the parameter ⁇ is abnormal compared to the other parameters ⁇ 1 and ⁇ 2 (or whether the fluctuation of the parameters ⁇ 1 and ⁇ 2 is abnormal compared to the parameter ⁇ ). Can be determined. Further, by monitoring in combination with the first score and the second score, the accuracy of abnormality detection can be improved. For example, if the third score does not increase even if the first score increases, it may mean that the parameters with strong relationship fluctuate at the same time for some reason, and that the fluctuation is not a rare event. As a result, it is possible to suppress false detection that occurs when only the first score is monitored. By understanding the calculation method of the third score, the user can understand the meaning of the behavior indicated by the third score.
  • the 3rd score does not increase and the 2nd score increases, it causes fluctuations in the parameter group with strong relationship, and an event that does not occur in the current driving state has occurred, and the 3rd score increases. Since it does not, it can be inferred that the event may be an event that occurs frequently (in other operating conditions), and so on.
  • Figure 2D shows an example of changes in all parameters.
  • the magnitude of the value of each parameter is shown in the vertical direction of FIG. 2D, and the transition of time is shown in the horizontal direction.
  • the fourth score shows the variation of the parameter ⁇ in the state indicated by all the parameters ⁇ 1 to ⁇ 3. For example, if only the parameter ⁇ shows a special behavior with respect to the behavior of all the other parameters, the fourth score also fluctuates. By monitoring the fluctuation of the fourth score, it can be determined whether or not the fluctuation of the parameter ⁇ is abnormal as compared with all the other parameters ⁇ 1 to ⁇ 3. Further, by monitoring in combination with the first score to the third score, the accuracy of abnormality detection can be improved.
  • a value obtained by subjecting a sensor measurement value or the like to statistical processing may be presented to the user as a score, but a user who is unfamiliar with statistical processing recognizes that the value is abnormal. Even if it can be done, it is difficult to understand its meaning.
  • the first score to the fourth score of the present embodiment by grasping the calculation method of each score in advance, it is possible to understand what the value of each score means. , It is possible to estimate what kind of event is occurring in the device 20. For example, the first score indicates how rare a value is observed among the values indicated by the parameter. The second score indicates how rare a value was observed in the operating condition.
  • the third score indicates how unusual a value was observed in a state indicated by a group of highly related parameters that behave in tuned manner.
  • the fourth score indicates how rare a value was observed under the condition indicated by all parameters. The user can understand the meaning of each score and use it for understanding and coping with the event when an abnormality is detected. By monitoring each score, the user can determine whether the behavior of the parameter ⁇ to be monitored is suddenly changed, deteriorated, deviated, or vibrated.
  • Sudden change means that the value of the parameter ⁇ to be monitored changes suddenly in time.
  • Deterioration means that the value of the parameter ⁇ changes with time, such as gradually decreasing or increasing.
  • Dissociation means that the value of the parameter ⁇ deviates from the values of other similar parameters. Vibration is a change such that the frequency component of the fluctuation of the parameter ⁇ suddenly becomes faster. Skilled observers often monitor the behavior of the parameter ⁇ and detect anomalies based on these four indicators.
  • the single circle mark indicates that the score can also be detected
  • the triangular mark indicates that the score can also be detected.
  • Sudden changes can be detected by monitoring the 1st score, but sudden changes can also be detected by the 2nd to 4th scores. For example, when the abnormality detection unit 15 determines that the first score is abnormal, the user determines that a sudden change has occurred in the parameter determined to be abnormal.
  • the second score is the most suitable, but deterioration can also be detected by monitoring the first score. For example, when the abnormality detection unit 15 determines that the second score is abnormal, the user determines that the parameter determined to be abnormal has deteriorated.
  • the divergence can be detected by monitoring the third score. For example, when the abnormality detection unit 15 determines that the third score is abnormal, the user determines that there is a discrepancy in the parameters determined to be abnormal.
  • Vibration can be detected by the 4th score. For example, if the cycle of the parameter ⁇ fluctuates while all the parameters vibrate at a constant cycle, the fourth score fluctuates. By utilizing this property, vibration can be detected by the fourth score. Vibration can also be detected by the second score. For example, when the abnormality detecting unit 15 determines that the fourth score is abnormal, the user determines that vibration has occurred for the parameter determined to be abnormal.
  • the output unit 18 outputs a graph showing the transition of the first score to the fourth score from a few minutes ago to the present for the parameter ⁇ to the display device, and the user confirms the fluctuation of each score and suddenly. Deformation, deterioration, deviation, and vibration may be determined.
  • the abnormality detecting unit 15 may be provided with a standard for determining sudden change, deterioration, deviation, and vibration, and the abnormality detecting unit 15 may be made to determine. For example, in the case of a sudden change, a threshold value for the amount of fluctuation of the first score is defined for each parameter to be monitored, and if there is a fluctuation exceeding this threshold value within a predetermined time, the abnormality detection unit 15 states that the sudden change has occurred. judge.
  • FIG. 4 shows an example of a report created by the report creation unit 17.
  • the report 100 is, for example, a monthly periodic report, in which the measured values of each parameter measured in the immediately preceding month and the values of the first score to the fourth score are described every month.
  • the report 100 includes an area 101 for displaying data relationships, an area 102 for displaying high score rankings, an area 103 for displaying trends for one month, and an area 104 for displaying long-term trends.
  • the relationship between the parameters is displayed in the area 101.
  • the column of measurement points indicates the type of parameter. All the parameters in the column of measurement points may be parameters to be monitored, or some may be parameters to be monitored.
  • the equipment status column the parameters indicating the operating status are marked with a circle.
  • the correlation column the same alphabet is displayed for the strongly related parameters.
  • Para1 to Para3 are described as measurement points, the relationship between Para1 and Para2 is strong (“A” in the correlation column), and Para3 is a parameter indicating the operating state (circle in the equipment status column). Mark).
  • the probability density of Para1 is the first score
  • Para3) is the second score
  • Para2) is the third score.
  • the user can confirm the parameter indicating the operating state with respect to the second score, and can confirm the parameter having a strong relationship with respect to the third score.
  • the area 102 about 20 of the 1st to 4th scores observed for each parameter in the order of the largest value are displayed.
  • the rank is displayed in the No column, the time when the score was observed is displayed in the time column, the score value is displayed in the score column, and the monitored parameter is displayed in the monitored item column.
  • the type is displayed, and in the score type column, whether the score is the first score to the fourth score is displayed.
  • the largest value was the first score value “X1” of Para1 observed in “Y / M / D hh: m1”, and the second largest value was “”.
  • the second score value of Para2 observed in "Y / M / D hh: m2" is "X2”
  • the third largest value is the second score of Para2 observed in "Y / M / D hh: m3”.
  • the value of 1 score is "X3”.
  • Area 103 shows the changes in the measured values of each parameter and the values of the first score to the fourth score for one month.
  • the region 104 shows the transition of the measured value of each parameter and the value of the first score to the fourth score over a long period of time (for example, the past 5 years).
  • the user can confirm the trend of the first score to the fourth score calculated for each parameter by referring to the areas 103 and 104.
  • the short-term evaluation is necessary to understand, for example, the failure or abnormality currently occurring in the device 20 based on the occurrence situation of the abnormality in a short period based on the present.
  • the medium- to long-term evaluation predicts deterioration or failure of the device 20 based on the tendency of abnormalities and abnormal signs detected from the past to the present (occurrence status such as frequency and magnitude of score). You will need it to do so.
  • the user can perform a medium- to long-term evaluation of the apparatus 20 by referring to the areas 103 and 104. Abnormalities in the device 20 often show some signs before they lead to a sudden failure. By utilizing the report 100, signs of abnormality can be confirmed. It can be used to predict abnormalities that may occur in the future in chronological order.
  • the user can confirm the first score to the fourth score and the measured value by the following procedure using the report 100, from the conventional equipment operation centered on post-maintenance to preventive maintenance equipment management. It is possible to put in place a mechanism to support.
  • the user refers to the area 101 and confirms the relationship and combination of each parameter before referring to the specific score value. This makes it possible to grasp the meaning of the first score to the fourth score.
  • the user refers to the areas 102 to 104, and confirms the place and time when the values of the first score to the fourth score are high.
  • (3-1) The first score is increasing. Focus only on the target parameter, and check whether the measured value of that parameter has changed suddenly, or whether the value is in a range that is not normally possible.
  • (3-2) The second score is increasing. Focus on the target parameter or operating condition parameter. Check if one or both of them have abnormal values.
  • the operating state parameter is a parameter in which the equipment state of the area 101 is marked with a circle.
  • the strongly related parameters are shown in the correlation column of region 101. For example, in the case of the example of FIG. 4, when the third score of Para1 increases, it is necessary to pay attention to Para2 as well.
  • the report creation unit 17 creates a report 100 once a month, for example, and the output unit 18 outputs the report 100 as an electronic file or the like. Based on the output report 100, the user can perform a medium- to long-term evaluation regarding the abnormality of the equipment 20 by the above procedure. Based on the report 100, the user can evaluate the state of the equipment 20 from the viewpoint of the four indicators described with reference to FIG.
  • FIG. 5 is a flowchart showing an example of the abnormality detection model creation process according to the embodiment.
  • the setting receiving unit 13 receives various settings (step S11). For example, the user inputs to the abnormality detection system 10 the setting of the parameter to be monitored, the setting of the parameter indicating the operating state, and the setting of the parameter having a strong relationship.
  • the setting receiving unit 13 receives these settings, writes them in the storage unit 16, and saves them.
  • Parameters with strong relationships are parameters that have been analyzed in advance by machine learning or the like to have strong relationships.
  • the data acquisition unit 11 collects operation data measured while the device 20 is operating in a normal operating state (step S12). Since the operation data to be collected is the learning data of the abnormality determination model, it is preferable to collect as much operation data as possible while operating under various conditions. For the evaluation of the second score, it is preferable to collect the operation data in all the operating states of the device 20.
  • the data acquisition unit 11 writes the collected operation data in the storage unit 16 and stores it.
  • the score calculation unit 12 calculates the first score to the fourth score (step S13).
  • the first score calculation unit 121 reads out the data of the parameter set as the monitoring target from the operation data collected as the learning data stored in the storage unit 16, and calculates the probability density for the parameter at each time. For example, if 10,000 measured values are collected for the parameter ⁇ , the probability density (first score) in the 10,000 measured values is calculated for each of the 10,000 measured values.
  • the first score calculation unit 121 writes the calculated first score in the storage unit 16 and stores it.
  • the second score calculation unit 122 reads out the combination of the parameter data set as the monitoring target and the parameter data set as indicating the operating state from the collected operating data, and reads the operating state.
  • the data of the monitored parameter is classified according to the operating state indicated by the value of the indicated parameter, and the probability (second score) that the value is observed in the same classification is calculated for each classified data.
  • the second score calculation unit 122 writes the calculated second score in the storage unit 16 and stores it.
  • the third score calculation unit 123 reads out a combination of the data of the monitored parameter and the data of the parameter having a strong relationship from the collected operation data, and the condition is that the value of the parameter having a strong relationship is observed.
  • the probability that the value of the monitored parameter is observed (third score) is calculated, and the third score is written in the storage unit 16 and stored.
  • the fourth score calculation unit 124 observes the values of the monitored parameters, provided that the combination of the values of all the other parameters measured at the same time is observed for each of the values of the monitored parameters.
  • the probability (fourth score) is calculated, and the fourth score is written in the storage unit 16 and stored.
  • the learning unit 14 creates the determination models 1 to 4 (step S14). For example, the learning unit 14 creates the determination model 1 based on the first score calculated in step S13. For example, the learning unit 14 may use the average value of the first score as the determination model 1, create the determination model 1 in which the range of the minimum value and the maximum value of the first score is regarded as normal, or the first. The cluster created by clustering the scores by the k-nearest neighbor method may be used as the determination model 1. The learning unit 14 also creates a determination model 2, a determination model 3, and a determination model 4 showing the normal range of each score for the second score, the third score, and the fourth score, respectively. The learning unit 14 writes and stores the created determination models 1 to 4 in the storage unit 16.
  • the learning unit 14 may calculate a threshold value for discriminating between normal and abnormal.
  • the data acquisition unit 11 acquires the operation data measured when the device 20 is operating in a normal state and the operation data measured when an abnormality occurs, and stores the operation data in the storage unit 16.
  • the score calculation unit 12 calculates the first score to the fourth score for the measured values of the parameters to be monitored included in the collected operation data, and stores them in the storage unit 16.
  • the learning unit 14 determines whether the score is the first score to the fourth score calculated based on the parameters measured at the normal time of the device 20. , Or, label information indicating whether the score is the first score to the fourth score calculated based on the parameters measured at the time of abnormality is attached.
  • the learning unit 14 creates a determination model 1 for determining the presence or absence of an abnormality based on the value of the first score by a predetermined method using the first score to which the label information is added as learning data.
  • the learning unit 14 creates the determination model 1 by using an SVM (Support Vector Machine), a decision tree, or the like.
  • the learning unit 14 creates the determination models 2 to 4 by the same method.
  • the operation data is converted into the probability density and the conditional probability to create the judgment models 1 to 4.
  • abnormality detection can be performed based on the first score to the fourth score.
  • anomaly detection can be performed using ensemble learning.
  • the learning unit 14 may create a determination model different from the determination models 1 to 4 by using, for example, the parameter values as learning data instead of the first score to the fourth score for ensemble learning.
  • FIG. 6 is a flowchart showing an example of the abnormality detection process according to the embodiment.
  • the created determination models 1 to 4 and the threshold value for abnormality determination are registered in advance in the storage unit 16.
  • a threshold value 1 for determining the first score of the parameter ⁇ to be monitored a threshold value 2 for determining the second score
  • a threshold value 3 for determining the third score a threshold value for determining the fourth score. It is assumed that 4 is registered in the storage unit 16.
  • the data acquisition unit 11 acquires the latest operation data from the device 20 (step S21).
  • the data acquisition unit 11 outputs the latest operation data to the score calculation unit 12.
  • the score calculation unit 12 calculates the first score to the fourth score for the latest operation data (step S22). Since the operation data collected in the learning phase is accumulated in the storage unit 16, for example, the score calculation unit 12 uses the accumulated operation data and the latest operation data to score the first to fourth scores. Is calculated.
  • the score calculation unit 12 outputs the first score to the fourth score to the abnormality detection unit 15.
  • the abnormality detection unit 15 determines an abnormality based on the determination models 1 to 4 (step S23).
  • the abnormality detection unit 15 determines whether or not the first score is abnormal based on the first score and the determination model 1. For example, when the determination model 1 is created as the average value of the first scores in the normal state, the abnormality detection unit 15 sets the first score based on the latest operation data and the average value of the first scores (determination model 1). If the difference between the two exceeds the threshold value 1, the latest first score may be determined to be abnormal. For example, when the determination model 1 is created by the maximum value and the minimum value of the first score at the normal time, the abnormality detection unit 15 determines the range in which the first score based on the latest operation data is indicated by the maximum value and the minimum value. If it deviates from the threshold value of 1 or more, it may be determined that the latest first score is abnormal.
  • the abnormality detection unit 15 is the latest if the distance between the first score based on the latest operation data and the center of gravity of the cluster is a threshold value of 1 or more.
  • the first score may be determined to be abnormal.
  • the abnormality detection unit 15 determines whether or not the second score to the fourth score based on the latest operation data are abnormal in the same manner.
  • the abnormality detection unit 15 inputs the value of the first score based on the latest operation data into the judgment model 1.
  • the determination model 1 determines whether it is normal or abnormal, and outputs the determination result.
  • the abnormality detection unit 15 determines that the latest first score is abnormal.
  • the abnormality detection unit 15 also determines whether or not the second score to the fourth score based on the latest operation data are abnormal by the same method based on the determination models 2 to 4, respectively.
  • the abnormality detection unit 15 determines whether or not the latest operation data is abnormal by using the determination model created in the learning phase.
  • the abnormality detection unit 15 analyzes the determination result based on each score (step S24). Specifically, the abnormality detection unit 15 selects the score having the maximum score value among the scores determined to be abnormal. For example, the value of the first score is "5", the value of the second score is "10", the value of the third score is "0.5”, the value of the fourth score is "0.5", and the first score. When the second score is determined to be abnormal, the abnormality detection unit 15 selects the second score as the score indicating the abnormality occurring in the device 20 most simply.
  • the abnormality detection unit 15 calculates the degree of abnormality indicated by the operation data by a predetermined method.
  • the calculated degree of abnormality is a value comparable to the first score to the fourth score.
  • the abnormality detection unit 15 selects the maximum value from the first score to the fourth score and the degree of abnormality calculated for ensemble learning.
  • the abnormality detection unit 15 outputs the information of the first score to the fourth score, the determination result of each score, the determination time, and the score indicating the highest value to the output unit 18, and writes and stores the information in the storage unit 16. This information is used when the report creation unit 17 creates the report 100.
  • the output unit 18 outputs the abnormality detection result to the display device or the like (step S25).
  • the output unit 18 indicates the values of the first score to the fourth score, the determination result (whether or not it is abnormal) and the determination time for each score, and the maximum value selected by the abnormality detection unit 15 from the abnormality detection unit 15. Get score information and display them.
  • the abnormality detection unit 15 may create and display a graph showing the transition of the values of the first score to the fourth score from before a predetermined period.
  • the user can confirm the occurrence of sudden change, deterioration, deviation, and vibration by paying attention to the score indicating the maximum value selected by the abnormality detection unit 15, and can detect the abnormality of the device 20.
  • the output unit 18 displays the maximum value selected by the abnormality detection unit 15 from the first score to the fourth score.
  • the best result can be transmitted to the user from the judgment results (judgment results for each of the first score to the fourth score) by a plurality of methods, and the accuracy of abnormality detection can be improved.
  • the user can confirm a plurality of scores, prevent false detection, and from the content that each score means, the cause of the abnormality occurring in the device 20 and the like.
  • the content can be estimated.
  • the process of detecting an abnormality by the abnormality detecting unit 15 has been described as an example, but the apparatus 20 does not merely detect the abnormality, but also based on the values of the first score to the fourth score.
  • Condition monitoring may be performed.
  • the abnormality detection system 10 detects the operating state of each of the plurality of scores based on the plurality of scores (first score to the fourth score, or the first score to the third score) and the determination model.
  • a state determination unit that determines the state of the device 20 based on the results of the plurality of operating states may be further provided.
  • the abnormality detection unit 15 may include the above-mentioned state determination unit.
  • an index indicating a state associated with one or a plurality of values or a tendency of the value among the first score to the fourth score is defined in advance (for example, state A, state B, ..., Or , Good, usually not abnormal, but prone to XX, etc.), the state determination unit is a process of determining which of the indexes indicating a predefined state is based on the first score to the fourth score. I do. Further, the state determination unit may determine the state of the device 20 based on the index indicating the determined one or more states. The output unit 18 may output an index indicating the state determined by the state determination unit or the state determined by the state determination unit in real time.
  • abnormality detection is performed using not only one score but also scores calculated from a plurality of viewpoints.
  • the degree of abnormality can be evaluated after adjusting the index so that it becomes a certain condition, so that false detection can be prevented and the accuracy of abnormality detection can be improved.
  • there are methods for evaluating the degree of anomaly based on data distribution such as MT method, k-nearest neighbor method, and LOF, which are general unsupervised anomaly detection methods, and methods that only present indicators that contribute to them.
  • the first score to the fourth score are values based on various probabilities that the parameter to be monitored is observed. It is possible to grasp the content of the probability that is the background of each score. That is, according to the present embodiment, it is possible to improve the explanation to the user about the meaning of each score. By grasping the meaning of the score, it is possible to identify the abnormal part, deal with the abnormality, and improve the quality and accuracy of the monitoring work by the user. According to Report 100, long-term trends of the first score to the fourth score can be confirmed. This enables medium- to long-term evaluation of the device 20, and the evaluation results can be utilized for preventive maintenance. According to the present embodiment, it is possible to perform condition monitoring using not only one score but also scores calculated from a plurality of viewpoints.
  • FIG. 7 is a diagram showing an example of the hardware configuration of the prediction system according to the embodiment.
  • the computer 900 includes a CPU 901, a main storage device 902, an auxiliary storage device 903, an input / output interface 904, and a communication interface 905.
  • the above-mentioned abnormality detection system 10 is mounted on the computer 900.
  • Each of the above-mentioned functions is stored in the auxiliary storage device 903 in the form of a program.
  • the CPU 901 reads a program from the auxiliary storage device 903, expands it to the main storage device 902, and executes the above processing according to the program.
  • the CPU 901 reserves a storage area in the main storage device 902 according to the program.
  • the CPU 901 secures a storage area for storing the data being processed in the auxiliary storage device 903 according to the program.
  • Each function is recorded by recording a program for realizing all or a part of the functions of the abnormality detection system 10 on a computer-readable recording medium, and having the computer system read and execute the program recorded on the recording medium. Processing by the unit may be performed.
  • the term "computer system” as used herein includes hardware such as an OS and peripheral devices.
  • the "computer system” shall include the homepage providing environment (or display environment) if the WWW system is used.
  • the "computer-readable recording medium” refers to a portable medium such as a CD, DVD, or USB, or a storage device such as a hard disk built in a computer system.
  • the above program may be for realizing a part of the above-mentioned functions, and may be further realized for realizing the above-mentioned functions in combination with a program already recorded in the computer system.
  • the abnormality detection system 10 may be composed of a plurality of computers 900.
  • the abnormality detection system 10 has a data acquisition unit 11 that acquires operation data of a device to be monitored, and a value of a first parameter that is a measurement value of the monitoring target included in the operation data.
  • a score calculation unit 12 that calculates a plurality of types of probabilities that the value is observed by using different methods, and calculates a score indicating the degree of abnormality for each of the plurality of types of probabilities, and a plurality of the scores. It is provided with an abnormality detection unit 15 that determines whether or not each of the plurality of scores is abnormal based on the determination model, and detects the abnormality of the apparatus based on the results of the plurality of determinations.
  • the plurality of scores are values based on the plurality of types of probabilities in which the monitored parameter is observed, the user can understand the meaning of each score by grasping the calculation contents of the plurality of types of probabilities. .. That is, the explanation of the score can be improved.
  • the abnormality detection system 10 according to the second aspect is the abnormality detection system 10 according to (1), and the probability related to one of the plurality of scores is included in the operation data. This is the probability that the value of the first parameter included in the operating data will be observed in the operating state indicated by the second parameter, which is a measured value related to the operating state of. As a result, the probability that the value of the first parameter is observed in the current operating state is calculated, and for example, when a value with a low probability is observed, it is determined that an abnormal value is observed in the current operating state. be able to. By monitoring the second score based on the probability, it is possible to determine "deterioration" among the behaviors indicated by the parameters.
  • the abnormality detection system 10 is the abnormality detection system 10 of (1) to (2), and the probability related to one of the plurality of scores is the first parameter.
  • the value of the third parameter included in the operation data is observed for the third parameter which is a predetermined measured value having a strong relationship with the operation data
  • the value of the first parameter included in the operation data is observed. It is the probability that it will be done.
  • the probability that the value of the first parameter is observed with respect to the value of another parameter with a strong relationship is calculated. For example, when a value with a low probability is observed, the first parameter or the relationship is determined. It can be determined that an abnormal value was observed with a strong parameter.
  • By monitoring the third score based on the probability, it is possible to determine "dissociation" among the behaviors indicated by the parameters.
  • the abnormality detection system 10 is the abnormality detection system 10 of (1) to (3), and the probability related to one of the plurality of scores is the first parameter. Probability that the value of the first parameter included in the operation data is observed when the value of the fourth parameter included in the operation data is observed for the fourth parameter which is a plurality of other measured values excluding. Is. As a result, the probability that the value of the first parameter is observed with respect to the value of the other parameter is calculated. For example, when a value with a low probability is observed, an abnormal value in the first parameter or another parameter is calculated. Can be determined to have been observed. By monitoring the fourth score based on the probability, it is possible to determine "vibration" among the behaviors indicated by the parameters.
  • the abnormality detection system 10 is the abnormality detection system 10 of (1) to (4), and the probability related to one of the plurality of scores is based on the operation data.
  • the probability density at which the value of the first parameter included is observed.
  • the probability that the value of the first parameter will be observed this time is calculated among the values that the first parameter can take. For example, when a value with a low probability is observed, an abnormal value for the first parameter is calculated. Can be determined to have been observed.
  • By monitoring the first score based on the probability it is possible to determine "sudden change" among the behaviors indicated by the parameters.
  • the abnormality detection system 10 is the abnormality detection system 10 of (1) to (5), and the abnormality detection unit 15 has the highest score among the plurality of scores. Detect anomalies based on. As a result, the score that most clearly represents the abnormality can be notified to the user, which can be useful for determining the abnormality.
  • the abnormality detection system 10 is the abnormality detection system 10 of (1) to (6), further including an output unit 18 for outputting an abnormality detected by the abnormality detection unit 15. ..
  • the abnormality detection system 10 is the abnormality detection system 10 of (1) to (7), based on the operation data when the device 20 is in a normal operating state.
  • a determination model creating unit (learning unit 14) that creates the determination models 1 to 4 indicating the range in which the score is normal is further provided for each of the plurality of types of the scores calculated by the score calculation unit 12. As a result, it is possible to evaluate whether or not the score calculated by the score calculation unit is abnormal.
  • the abnormality detection system 10 is the abnormality detection system 10 of (1) to (8), and is a report creation unit that creates a report including a graph showing the transition of a plurality of types of the scores. 17 is further provided. By confirming the transition of the score, it is possible to evaluate the change over time for the abnormality of the device 20. By setting the range of the transition shown in the graph to, for example, one year or more, the medium- to long-term evaluation of the apparatus 20 can be performed.
  • the abnormality detection system acquires the operation data of the device to be monitored, and the value of the first parameter, which is the measured value of the monitoring target included in the operation data, is said to be the same.
  • Multiple types of probabilities of observing values are calculated using different methods, and for each of the multiple types of probabilities, a score indicating the degree of abnormality is calculated, based on the plurality of scores and a determination model. , It is determined whether or not each of the plurality of scores is abnormal, and the abnormality of the apparatus is detected based on the results of the plurality of determinations.
  • the program according to the eleventh aspect acquires the operation data of the device to be monitored by the computer, and observes the value of the first parameter which is the measured value of the monitoring target included in the operation data.
  • a plurality of types of probabilities are calculated using different methods, a score indicating the degree of abnormality is calculated for each of the plurality of types of probabilities, and a plurality of scores are calculated based on the plurality of scores and a determination model. It is determined whether or not each of the scores is abnormal, and a process for detecting an abnormality in the apparatus is executed based on the results of the plurality of determinations.
  • abnormality detection system abnormality detection method and program, the accuracy of abnormality detection can be maintained.

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Testing And Monitoring For Control Systems (AREA)
PCT/JP2021/034889 2020-11-26 2021-09-22 異常検知システム、異常検知方法およびプログラム WO2022113501A1 (ja)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2020-196311 2020-11-26
JP2020196311A JP7580257B2 (ja) 2020-11-26 2020-11-26 異常検知システム、異常検知方法およびプログラム

Publications (1)

Publication Number Publication Date
WO2022113501A1 true WO2022113501A1 (ja) 2022-06-02

Family

ID=81755510

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2021/034889 WO2022113501A1 (ja) 2020-11-26 2021-09-22 異常検知システム、異常検知方法およびプログラム

Country Status (2)

Country Link
JP (1) JP7580257B2 (enrdf_load_stackoverflow)
WO (1) WO2022113501A1 (enrdf_load_stackoverflow)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115577813A (zh) * 2022-12-07 2023-01-06 常州金坛金能电力有限公司 一种变电站管理系统及方法
CN117909692A (zh) * 2024-03-18 2024-04-19 山东海纳智能装备科技股份有限公司 一种双盘式电机轴承运行数据智能分析方法

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP7411724B2 (ja) * 2022-05-19 2024-01-11 株式会社日立製作所 システム分析装置及びシステム分析方法

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2019096014A (ja) * 2017-11-22 2019-06-20 富士通株式会社 判定装置，判定プログラム，判定方法
WO2020194534A1 (ja) * 2019-03-26 2020-10-01 東芝三菱電機産業システム株式会社 異常判定支援装置

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2019096014A (ja) * 2017-11-22 2019-06-20 富士通株式会社 判定装置，判定プログラム，判定方法
WO2020194534A1 (ja) * 2019-03-26 2020-10-01 東芝三菱電機産業システム株式会社 異常判定支援装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115577813A (zh) * 2022-12-07 2023-01-06 常州金坛金能电力有限公司 一种变电站管理系统及方法
CN115577813B (zh) * 2022-12-07 2023-05-23 常州金坛金能电力有限公司 一种变电站管理系统及方法
CN117909692A (zh) * 2024-03-18 2024-04-19 山东海纳智能装备科技股份有限公司 一种双盘式电机轴承运行数据智能分析方法
CN117909692B (zh) * 2024-03-18 2024-05-31 山东海纳智能装备科技股份有限公司 一种双盘式电机轴承运行数据智能分析方法

Also Published As

Publication number Publication date
JP2022084435A (ja) 2022-06-07
JP7580257B2 (ja) 2024-11-11

Similar Documents

Publication Publication Date Title
WO2022113501A1 (ja) 異常検知システム、異常検知方法およびプログラム
US10719577B2 (en) System analyzing device, system analyzing method and storage medium
JP4832609B1 (ja) 異常予兆診断装置および異常予兆診断方法
KR101955305B1 (ko) 희소 코딩 방법론을 활용한 가스 터빈 센서 고장 검출
JP6076571B1 (ja) 情報処理装置、情報処理システム、情報処理方法及びプログラム
US7398184B1 (en) Analyzing equipment performance and optimizing operating costs
JPWO2019142331A1 (ja) 障害予測システムおよび障害予測方法
WO2010032701A1 (ja) 運用管理装置、運用管理方法、および運用管理プログラム
US20080167842A1 (en) Method and system for detecting, analyzing and subsequently recognizing abnormal events
EP3674827B1 (en) Monitoring target selecting device, monitoring target selecting method and program
JP6482817B2 (ja) プラント監視支援システム及びプラント監視支援方法
JP6708203B2 (ja) 情報処理装置、情報処理方法、及び、プログラム
JP6523815B2 (ja) プラント診断装置及びプラント診断方法
JP2013008098A (ja) 異常予兆診断結果の表示方法
CN112286771B (zh) 一种针对全域资源监控的告警方法
EP3287960B1 (en) Computer system and method to process alarm signals
CN118653970A (zh) 一种风电机组运行状态预警阈值的修正方法及系统
CN110337640B (zh) 用于问题警报聚合和识别次优行为的方法、系统和介质
US11543808B2 (en) Sensor attribution for anomaly detection
JP2014153736A (ja) 障害予兆検出方法、プログラムおよび装置
JP2010276339A (ja) センサ診断方法およびセンサ診断装置
WO2021229815A1 (ja) 情報処理装置、評価方法、および評価プログラム
JP2021043764A (ja) 情報提示装置、情報提示方法、および情報提示システム
Marshall Jr et al. Supporting Condition-Based Maintenance for Rotary Systems Under Multiple Fault Scenarios
JP2011258261A (ja) 劣化度判定装置及びコンピュータプログラム及び劣化度判定方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21897479

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21897479

Country of ref document: EP

Kind code of ref document: A1