Device management system, device failure cause estimation method, and storage medium that stores a program non-transitorily

Abstract

A device management system, a device failure cause estimation method, and a storage medium that stores a program non-transitorily, capable of performing estimation of a failure cause of a device used in combination with a computer with high precision. The device management system includes a log data acquisition unit that acquires logs that are records of actions of software related to control of the device, a cluster information extraction unit that extracts cluster information and inter-cluster migration information from a set of the acquired logs, the cluster information being information indicating contents of each step related to operation of the device, the inter-cluster migration information being information related to migration between one step and another step, an abnormality degree calculation unit that calculates an abnormality degree of each of the extracted inter-cluster migration information, and a failure cause estimation unit that estimates a failure cause of the device based on the abnormality degrees calculated by the abnormality degree calculation unit.

Description

Technical Field

[0001] This invention relates to a device management system, a method and procedure for estimating the causes of device failures. Background Technology

[0002] Maintenance of industrial equipment involves analyzing the causes of malfunctions such as equipment stopping operation or performance degradation. This analysis typically involves operators cross-referencing various data points, including software operation logs, the operating status of mechanical components (sensor readings, motor speed, etc.), and the operating status of the control unit (computer) (CPU usage, memory usage, network traffic, board temperature, etc.).

[0003] However, this method of analyzing diverse information presents problems such as a heavy workload for operators and the analysis results being significantly influenced by individual experience / knowledge.

[0004] In response to such problems, various methods for improving the efficiency of maintenance operations, including automation, have been proposed in recent years. For example, efforts have been made to accumulate data related to the state of the equipment, which helps to automate fault response measures. In particular, in equipment that repeatedly performs fixed and simple actions, it is effective to detect outliers and points of change (so-called outliers) by performing learning on signal data obtained from sensors, and it has been proposed to use this information to estimate the causes of faults and predict faults (e.g., non-patent literature 1, etc.).

[0005] However, in devices such as inspection equipment and processing equipment that combine with control devices (computers) to perform complex actions, it is difficult to obtain sufficient results using existing technologies that rely on simple data. In view of this, in recent years, research has been conducted on using methods such as deep learning to flexibly utilize large amounts of data obtained from multiple sensors (e.g., non-patent literature 2, etc.).

[0006] In addition, the following approach has been proposed: instead of sensor data, utilize text data such as software logs and maintenance records of the control device, and use these as objects to perform learning to estimate the optimal timing for maintenance (e.g., non-patent literature 3, etc.).

[0007] Existing technical documents

[0008] Non-patent literature

[0009] Non-Patent Document 1: Ferreiro, S., Konde, E., Fernandez, S., and Prado, A., 2016. Industry 4.0: predictive intelligent maintenance for production equipment. European Conference of the Prognostics and Health Management Society, no (pp. 1-8). researchgate.net.

[0010] Non-Patent Document 2: Ademujimi, T.T., Brundage, M.P., and Prabhu, V.V., 2017. A Review of Current Machine Learning Techniques Used in Manufacturing Diagnosis. Advances in Production Management Systems. The Path to Intelligent, Collaborative and Sustainable Manufacturing (pp. 407-415). Springer International Publishing.

[0011] Non-Patent Document 3: Patil, R.B., Patil, M.A., Ravi, V., and Naik, S., 2017. Predictive modeling for corrective maintenance of imaging devices from machine logs. Conference proceedings:... Annual International Conference of the IEEE Engineering in Medicine and Biology Society. IEEE Engineering in Medicine and Biology Society. Conference, 2017, 1676-1679. ieeexplore.ieee.org. Summary of the Invention

[0012] Problems to be Solved by the Invention

[0013] However, in order to estimate the causes of failures in relatively complex devices combined with computers, conventional methods that rely solely on sensor data have limitations in addressing adverse situations arising in conjunction with software actions. Furthermore, even methods that perform learning analysis on textual data such as software logs and maintenance records can record and learn from known faults and deterioration states, but they struggle to learn from unknown or unexpected faults and are unable to address such faults.

[0014] The present invention was made in view of the actual situation described above, and its object is to provide a technique that can estimate the cause of failure of a device used in conjunction with a computer with high accuracy.

[0015] Methods for solving problems

[0016] To achieve the above objectives, the present invention employs the following structure: a device management system, characterized in that it comprises: a log data acquisition unit that acquires logs, the logs being records of software actions related to the control of the device; a clustering information extraction unit that extracts clustering information and inter-cluster migration information from the acquired set of logs, the clustering information being information representing the content of each step related to the operation of the device, and the inter-cluster migration information being information related to the migration between one step and another; an anomaly calculation unit that calculates the anomaly degree of each of the extracted inter-cluster migration information; and a fault cause estimation unit that estimates the fault cause of the device based on the anomaly degree calculated by the anomaly calculation unit.

[0017] Based on this structure, for a device that has malfunctioned, the degree of abnormality can be calculated for each minute action related to the operation of the device, and the cause of the malfunction can be estimated based on the degree of abnormality. Therefore, even unknown (or unexpected) causes of malfunction can be estimated as the cause of the malfunction.

[0018] Furthermore, the anomaly calculation unit can also calculate the anomaly degree of each extracted inter-cluster migration information based on the inter-cluster migration information when the device is operating normally. With such a structure, it is possible to calculate the anomaly degree when a fault occurs, without using the learning data when the device malfunctions, but only based on the data when the device is operating normally. Therefore, it can be applied to various objects ranging from simple to complex devices.

[0019] Alternatively, the inter-cluster migration information may include information related to the frequency of migrations between the multiple steps in the device. The device management system further includes an inter-cluster migration information evaluation unit. This evaluation unit weights the extracted inter-cluster migration information based on the frequency of occurrence, and the anomaly calculation unit uses the weighted information to calculate the anomaly. Thus, by having a unit that performs weighting based on the frequency of migrations between steps, the anomaly can be calculated efficiently and with high accuracy.

[0020] Alternatively, the device management system may also include a hardware information acquisition unit, which acquires hardware information related to the state of the device's hardware, and the inter-cluster migration information evaluation unit further weights the extracted inter-cluster migration information based on the hardware information acquired by the hardware information acquisition unit.

[0021] Here, hardware information refers to various sensor data and information related to the operation and state of the device's hardware obtained from that sensor data. By further weighting the data using hardware information, anomaly rates can be calculated with higher accuracy.

[0022] Alternatively, the fault cause estimation unit may estimate that a fault cause exists in the step of determining the inter-cluster migration information where the anomaly calculated by the anomaly calculation unit satisfies a predetermined condition. Specifically, the predetermined condition can be, for example, a condition exceeding a predetermined threshold. In this case, the threshold can be preset by the user or automatically set by learning from the device's operational performance. This allows for efficient estimation of the device's fault causes.

[0023] Alternatively, the device management system may also include a display unit capable of displaying information representing the anomaly calculated by the anomaly calculation unit and / or the fault cause estimated by the fault cause estimation unit. With this structure, the user can easily confirm the estimated fault cause.

[0024] Alternatively, the device management system may also include a directed graph generation unit, which uses the clustering information as nodes and the inter-cluster migration information as edges to generate a directed graph representing the relationship between each clustering information and the inter-cluster migration information, and the display unit can display the directed graph.

[0025] Based on this structure, users can identify the actions of the software related to the control of the device in a directed graph manner, and can flexibly use this information for the management and maintenance of the device.

[0026] Alternatively, the inter-cluster migration information can be weighted information that has been evaluated with added importance using a prescribed method, and the directed graph generation unit generates a directed graph that allows visual confirmation of the weighting in each of the inter-cluster migration information. Furthermore, the weighting method is not particularly limited; for example, as mentioned above, it can be weighted based on the frequency of inter-cluster migration, corresponding hardware information (sensor data), etc. With this structure, the user can confirm the weighted directed graph, and thus obtain more detailed information from it.

[0027] Alternatively, the directed graph generation unit can generate a directed graph that visually represents the weighting by displaying the weighted values ​​representing the inter-cluster migration information near the edges.

[0028] Alternatively, the directed graph generation unit can generate a visually verifiable directed graph by displaying the edges representing the migration information between the clusters with varying clarity settings. Here, varying the clarity settings means, for example, considering increasing the thickness of the edge lines according to the weights, or increasing the brightness and luminance of the edge lines according to the weights.

[0029] Alternatively, the clustering information may include words extracted from the logs as text information. The directed graph generation unit extracts the words contained in each clustering information in descending order of frequency of occurrence, and generates a directed graph that uses the extracted words as information representing the content of the clustering information. With this structure, users can easily grasp the content of each node in the directed graph based on the words.

[0030] Alternatively, the device management system may also include an extraction log display image generation unit, which extracts logs corresponding to the inter-cluster migration information that meet the specified conditions from the log set, as information representing the content of the inter-cluster migration information that meets the specified conditions, and generates an extraction log display image representing the content of the extracted logs, and the display unit can display the extraction log display image.

[0031] Furthermore, the phrase "meeting the specified conditions" can be defined as situations such as the anomaly degree exceeding a specified value, or the user selecting an edge in the directed graph corresponding to the inter-cluster migration information. Based on this structure, users can quickly confirm the logs corresponding to the inter-cluster migration information.

[0032] Alternatively, the extracted log display image can also pop up near the edge representing the inter-cluster migration information corresponding to the extracted log shown in the extracted log display image. If displayed in this way, the relationship between the popped-up extracted log display image and the edge representing the corresponding inter-cluster migration information can be easily understood. Furthermore, the display location of the extracted log display image is not particularly limited, and a specific display area can be set regardless of the aforementioned pop-up display.

[0033] In addition, the present invention can also be applied as a method for estimating the cause of device failure. This method includes the following steps: a log data acquisition step, acquiring logs that are historical information about the actions of software related to the control of the device; a clustering information extraction step, extracting clustering information and inter-cluster migration information from the acquired log set, wherein the clustering information represents information about the content of each step of the processing performed by the device, and the inter-cluster migration information is information related to the migration between multiple steps in the device; an anomaly calculation step, calculating the anomaly degree of each extracted inter-cluster migration information; and a failure cause estimation step, estimating the cause of the device failure based on the anomaly degree calculated in the anomaly calculation step.

[0034] In addition, the present invention can also be understood as a program for causing a computer to perform the above-described method, and a computer-readable recording medium that non-temporarily records such a program.

[0035] Furthermore, the above-mentioned structures and processes can be combined with each other to constitute the present invention as long as they do not create technical contradictions.

[0036] Invention Effects

[0037] According to the present invention, a technique is provided that can estimate the cause of failure of a device used in conjunction with an information processing device with high accuracy. Attached Figure Description

[0038] [ Figure 1 ] Figure 1 This is a schematic diagram showing an outline of the device management system of Embodiment 1.

[0039] [ Figure 2 ] Figure 2 This is an illustrative diagram showing an example of a software log.

[0040] [ Figure 3 ] Figure 3 This is a flowchart illustrating the process executed by the device management system of Embodiment 1.

[0041] [ Figure 4 ] Figure 4 This is a flowchart illustrating a subroutine of the processing in the device management system of Embodiment 1.

[0042] [ Figure 5 ] Figure 5 This is an illustration of the separate processing of software logs.

[0043] [ Figure 6 ] Figure 6 This is an illustration of the log lines that are clustered.

[0044] [ Figure 7 ] Figure 7 This is an explanatory diagram illustrating the log clustering sequence generated in the device management system of Implementation 1.

[0045] [ Figure 8 ] Figure 8 Figure (A) is the first figure illustrating the directed graph generated by the device management system of Embodiment 1. Figure 8 Figure (B) is the second diagram illustrating the directed graph generated by the device management system of Embodiment 1.

[0046] [ Figure 9 ] Figure 9 This is a diagram illustrating an example of a directed graph generated by the device management system according to the first embodiment.

[0047] [ Figure 10 ] Figure 10 (A) is a diagram showing an example of a directed graph displayed on the screen in a variation of Embodiment 1. Figure 10 (B) is a diagram representing another example of a directed graph displayed on the screen in a variation of embodiment 1.

[0048] [ Figure 11 ] Figure 11 This is a schematic diagram showing an outline of the device management system of another variation of Embodiment 1.

[0049] [ Figure 12 ] Figure 12 This is a diagram illustrating an example of a screen displayed in a device management system, which is another variation of Embodiment 1.

[0050] [ Figure 13 ] Figure 13 This is a schematic diagram showing an outline of the device management system of Embodiment 2.

[0051] [ Figure 14 ] Figure 14 This is a flowchart illustrating the process performed by the device management system of Embodiment 2.

[0052] [ Figure 15 ] Figure 15This is a flowchart illustrating a subroutine of the processing in the device management system of Embodiment 2.

[0053] [ Figure 16 ] Figure 16 This is an explanatory graph showing the relationship between sensor data and change scores.

[0054] [ Figure 17 ] Figure 17 This is an explanatory diagram showing an example of a log clustering sequence mapped with change scores generated by the device management system of Implementation 2.

[0055] Label Explanation

[0056] 1, 2, 3: Device management system; 100, 200, 300: Information processing terminal; 120: Appearance inspection device; 121: Camera; 122: X-table; 123: Y-table; 124: Conveyor; O: Object to be inspected. Detailed Implementation

[0057] Hereinafter, embodiments of the present invention will be described based on the accompanying drawings. However, unless otherwise specified, the dimensions, materials, shapes, and relative arrangements of the constituent elements described in the following examples are not intended to limit the scope of the present invention to these aspects.

[0058] <Application Examples>

[0059] (Structure of an application example)

[0060] The present invention can be applied, for example, as a management system for an appearance inspection apparatus that inspects an object by processing an image obtained by capturing the object by an imaging unit. Figure 1 This is a schematic diagram illustrating the device management system 1 of this application example.

[0061] The device management system 1 includes an information processing terminal 100 and an appearance inspection device 120. The information processing terminal 100 can be integrated with the appearance inspection device 120, or it can be a separate device communicatively connected to the appearance inspection device 120, such as a general-purpose computer. Furthermore, the information processing terminal 100 can be a single computer or multiple computers working together. The appearance inspection device 120 is, for example, a device that automatically inspects the object to be inspected by photographing and processing images of the object, such as a component mounting substrate.

[0062] The information processing terminal 100 includes functional units such as a log data acquisition unit 101, a clustering information extraction unit 102, an inter-cluster migration information evaluation unit 103, a directed graph generation unit 104, a baseline data generation unit 105, an anomaly calculation unit 106, a fault cause estimation unit 107, a display unit 108, and a storage unit 109. Furthermore, although not shown, it may also include various input units such as a mouse and keyboard, and communication units.

[0063] The visual inspection apparatus 120 is configured to include a conveyor 124 for transporting the object to be inspected O to the shooting position, a camera 121 for shooting the object to be inspected O, an X-stage 122 for moving the camera 121 horizontally, and a Y-stage 123. Additionally, although not shown, the visual inspection apparatus 120 includes an image processing unit for processing the captured images, an inspection processing unit for performing inspections based on the images, and an output processing unit for outputting the inspection results.

[0064] (Methods for estimating the cause of a fault)

[0065] In this application example, the device management system 1 prepares baseline data in advance by learning (modeling) data from the normal operation of multiple appearance inspection devices 120. In the event of a failure of the appearance inspection device 120, the cause of the failure is estimated based on the baseline data.

[0066] Specifically, firstly, the log data acquisition unit 101 acquires software logs (hereinafter, also simply referred to as logs) related to the control of the normal operation of the appearance inspection device 120. The logs are as follows... Figure 2 The text information is configured as shown. The clustering information extraction unit 102 processes the text information to extract clustering information representing the content of each step related to the operation of the appearance inspection device 120. Furthermore, information related to the transition between one step and other steps involved in the operation of the appearance inspection device 120, i.e., inter-cluster transition information, is extracted.

[0067] Furthermore, the directed graph generation unit 104 generates a directed graph representing the relationships between the extracted cluster information and inter-cluster migration information. This process is repeated multiple times with the amount of data required to generate the benchmark data, resulting in multiple directed graphs. Then, the benchmark data generation unit 105 transforms the multiple directed graphs into a matrix representation, calculates the mean / variance for each element of the matrix, and saves it as benchmark data.

[0068] Then, in the event of a malfunction in the visual inspection device 120, logs related to the control at the time of the malfunction are obtained, and a directed graph is generated using the same processing as when the reference data was generated, transforming it into a matrix representation. Next, the anomaly calculation unit 106 compares each element of the matrix data obtained at the time of the malfunction with each element of the matrix of the reference data, calculating an anomaly degree for each element, representing the magnitude of the deviation from the reference data. Then, the malfunction cause estimation unit 107 determines that the step (or transition between steps) corresponding to an element with an anomaly degree above a predetermined threshold is highly likely to be the cause of the malfunction, and estimates that step as the cause of the malfunction.

[0069] As described above, the device management system 1 in this application example can generate reference data based solely on data from normal operation, compare the data at the time of a fault with the reference data, and thereby estimate the cause of the fault. Thus, even unknown causes of faults can be estimated with high accuracy.

[0070] <Implementation Method 1>

[0071] Next, based on Figures 1 to 9 The embodiments of the present invention will be described in more detail below. First, the functional units of the information processing terminal 100 of the device management system 1 of this embodiment will be described.

[0072] (Functions of the information processing terminal)

[0073] The log data acquisition unit 101 acquires the operation records, i.e., logs, of the software related to the control of the appearance inspection device 120. The clustering information extraction unit 102 extracts clustering information and inter-cluster migration information from the acquired log set. The clustering information represents the content of each step related to the operation of the appearance inspection device 120, and the inter-cluster migration information is information related to the migration between one step and another. This will be described in detail later.

[0074] In addition, the above-mentioned inter-cluster migration information includes information related to the frequency of migration between multiple steps in the appearance inspection device 120. The inter-cluster migration information evaluation unit 103 uses at least the frequency of occurrence information to weight each extracted inter-cluster migration information.

[0075] Furthermore, the directed graph generation unit 104 uses the extracted clustering information as nodes and the inter-cluster migration information as edges to generate a directed graph representing the relationship between each cluster and the inter-cluster migration information. The benchmark data generation unit 105 generates benchmark data as a benchmark for fault cause estimation. Specifically, multiple directed graphs obtained by sampling log data during normal operation of the appearance inspection device 120 are replaced with a matrix representation, and the mean / variance of each element of the matrix is ​​calculated and stored in the storage unit 109 as benchmark data.

[0076] The anomaly calculation unit 106 transforms the directed graph generated from the log data at the time of the fault into a matrix representation, and compares each element of the matrix with the aforementioned baseline data, thereby calculating the anomaly degree for each element, representing the magnitude of the deviation from the baseline data. Each element of the matrix corresponds to the inter-cluster migration information extracted from the logs, therefore, the anomaly degree of each element of the matrix becomes the anomaly degree of the corresponding inter-cluster migration information.

[0077] The fault cause estimation unit 107 believes that the step shown in the software log corresponding to the inter-cluster migration information with an anomaly degree of more than the specified threshold is highly likely to be the cause of the fault, and estimates the step as the cause of the fault.

[0078] Display unit 108 is an image display device such as a liquid crystal display, displaying various information including the directed graph, estimated fault causes, and anomalies in inter-cluster migration information. Storage unit 109 may include main storage units such as read-only memory (ROM) and random access memory (RAM) and auxiliary storage units such as EPROM, hard disk drive (HDD), and removable media.

[0079] In the auxiliary storage section, in addition to the operating system (OS) and various programs, various information such as the aforementioned baseline data, the operating performance of the managed devices, and maintenance records can be stored. Furthermore, by loading the programs stored in the auxiliary storage section into the operating area of ​​the main storage section and executing them, the various structural units can be controlled through program execution, thus achieving the aforementioned intended functions. Moreover, some or all of the functional units can also be implemented using hardware circuits such as ASICs or FPGAs.

[0080] (Fault cause estimation and handling process)

[0081] Next, the process of malfunction cause estimation processing of the appearance inspection device 120 in the device management system 1 of this embodiment will be described. Figure 3 This is a flowchart illustrating an example of fault cause estimation and processing in device management system 1. For example... Figure 3As shown, in the device management system 1, reference data is first generated based on the data obtained from the appearance inspection device 120 during normal operation (S101).

[0082] Here, refer to Figure 4 The details of the baseline data generation and processing in step S101 are explained below. Figure 4 This is a flowchart illustrating the process of the subroutine for generating and processing the reference data in this embodiment. For example... Figure 4 As shown, firstly, the log data acquisition unit 101 acquires the log data during normal operation (S201). Next, the clustering information extraction unit 102 processes the log information by separating it based on prescribed rules (S202). Figure 5 The diagram illustrates the separate processing of such log information. For example... Figure 5 As shown, the log data consists of time data representing each line and a message string. The clustering information extraction unit 102 decomposes the log into time data and message strings for each line. Here, the message strings are further processed by removing numbers and symbols and decomposing them into word units.

[0083] Next, the clustering information extraction unit 102 uses, for example, the TF-IDF method to vectorize the word sets of each line of the log. TF-IDF is a well-known method, so detailed explanation is omitted. TF-IDF is a method that calculates the importance of words based on two metrics: TF (Term Frequency) and IDF (Inverse Document Frequency).

[0084] like Figure 6 As shown, the clustering information extraction unit 102 also uses, for example, the K-means method to cluster the vector set of all rows into, for example, 200 clusters (S203). Figure 6 This is an explanatory diagram illustrating the log lines after clustering. Furthermore, the K-means method is a well-known clustering method, therefore a detailed explanation is omitted.

[0085] Next, as Figure 7 As shown, the clustering information extraction unit 102 generates a log clustering sequence with consecutive cluster numbers based on the time when each log line is output. In this way, by arranging the cluster numbers in a time sequence, information related to migration between clusters can be obtained. That is, clustering information representing the content of each step related to the operation of the appearance inspection device 120, obtained from the text messages (words) of the log in this manner, as well as inter-cluster migration information, which is information related to migration between one cluster (step) and another cluster, can be extracted. In this embodiment, the processing of steps S202 and S203 corresponds to the clustering information extraction step.

[0086] Next, the directed graph generation unit 104 generates a directed graph with each cluster information as nodes and inter-cluster migration information as edges (S204). At this time, the cluster number of the corresponding cluster can be displayed on each node.

[0087] Next, the inter-cluster migration information evaluation unit 103 performs weighted summation of each edge of the directed graph based on the migration frequency between nodes (i.e., between corresponding clusters) in the directed graph (S205). Figure 8 The diagram illustrates the weighting performed in S205. Figure 8 (A) is a graph that arranges the cluster numbers of the clusters corresponding to each log line from left to right in chronological order, based on the time of the output log line. Figure 8 (B) represents a graph that reflects a weighted directed graph. Figure 8 The directed graph (B) records numerical values ​​near the edges, indicating the frequency of that edge (i.e., migration between clusters). See reference... Figure 8 In (A), there were 2 migrations from cluster number 2 to cluster number 2, 2 migrations from cluster number 2 to cluster number 0, 3 migrations from cluster number 0 to cluster number 6, 1 migration from cluster number 6 to cluster number 0, and 1 migration from cluster number 6 to cluster number 2. Furthermore, in Figure 8 In the directed graph of (B), the number of migrations is displayed near the edge, and the thickness of the edge is displayed as thicker according to the frequency of migration.

[0088] Thus, by performing steps S201 to S205, the series of processing steps for a normally functioning log data is completed. Figure 9 This represents an example of a directed graph generated at the end of a series of processes on log data during normal operation.

[0089] Next, the reference data generation unit 105 performs a process (S206) to determine whether the required number (e.g., 100 pieces) of weighted directed graphs as described above has been obtained for generating reference data. If the required number of directed graph data has not been obtained, the process returns to step S201, obtains new log data for normal operation, and repeats the subsequent processing.

[0090] On the other hand, if it is determined in step S206 that a predetermined amount of directed graph data has been obtained, the process proceeds to step S207, where the reference data generation unit 105 performs a process to transform all the obtained directed graphs into a matrix representation. Specifically, as shown in equation (1) below, the transformation is performed to use the weights of the edges that migrate from one node to another in the directed graph as the edge weight matrix W of each element of the matrix. As in the example above, when the number of clusters is set to 200, the edge weight matrix W becomes a 200×200 matrix.

[0091]

[0092] Here, W is an element of the matrix. 00 W represents the weight of the edge (i.e., inter-cluster migration information) that migrates from node 0 (hereinafter referred to as node 0) to node 0, where cluster number 0 is shown. n0 W represents the weight of the edge that migrates from node n to node 0. ij This represents the weight of the edge that migrates from node i to node j.

[0093] After completing the process of transforming all directed graphs into the matrix representation, the reference data generation unit 105 calculates the average and variance of each element of the matrix (S208). For example, when using data from normal operation with a quantity of 100 units, as a result of matrix data integrating the quantity of 100 units, an average weight matrix representing the average of the 100 units and a variance weight matrix representing the variance of the 100 units are calculated as reference data (S209). Furthermore, hereafter, each element of the average weight matrix is ​​referred to as W representing the quantity of 100 units. ij The average μ ij Regarding the elements of the variance weight matrix, denoted as W representing the quantity of 100 items. ij σ of the variance ij .

[0094] Thus, if the processing in step S209 is completed, the series of subroutines in the baseline data generation process (S101) ends. Returning to the description... Figure 3 The flowchart for fault cause estimation processing shows that if the processing of step S101 is completed, the reference data generation unit 105 saves the generated reference data in the storage unit 109 (S102).

[0095] Next, when a malfunction occurs in the visual inspection device 120, the log data acquisition unit 101 acquires the log data at the time of the malfunction (S103). Then, it extracts clustering information from the log data at the time of the malfunction, generates a weighted directed graph based on this, and obtains a series of processes for the data after matrix transformation of the directed graph (S104). The specific processing performed in step S104 is the same as the processing performed in steps S202 to S205 and step S207 described above. Therefore, the description is omitted here.

[0096] Next, the anomaly calculation unit 106 calculates the anomaly degree 'a' of each matrix element at the time of the fault by comparing the matrix data obtained in step S104 at the time of the fault with the reference data. ij (S105). Specifically, the anomaly degree is calculated based on the following equation (2).

[0097]

[0098] Then, the fault cause estimation unit 107 estimates the matrix elements of the anomaly degree that meet the specified conditions (e.g., exceeding a threshold, etc.) as the cause of the fault (S106). Then, for example, in the estimated matrix element W... ij In the case of a fault, due to matrix element W ij Having clustering information for node i and clustering information for node j, this clustering information (or, the corresponding log lines) is displayed on display unit 108 as information representing the estimated cause of the fault (S107).

[0099] As described above, the series of processes for fault cause estimation is now complete. Furthermore, steps S101 and S102 do not need to be performed every time fault cause estimation is performed; the fault cause estimation process can begin from step S103 after the baseline data has been generated and saved once. Alternatively, steps S101 and S102 can be performed as needed, updating the baseline data as required.

[0100] According to the device management system 1 described above, baseline data is generated based solely on data from normal operation. By comparing the data from when a fault occurs with the baseline data, the anomaly degree of elements representing each step can be calculated, and the cause of the fault can be estimated. Therefore, even unknown causes of faults can be estimated with high accuracy. Furthermore, by weighting based on the frequency of migration between clusters, anomaly degrees can be appropriately calculated for items of high importance.

[0101] (Variation Example 1)

[0102] Furthermore, in the above embodiment 1, it was explained that clustering information, which represents information indicating the estimated cause of the fault, is displayed on the display unit 108, but various types of information can be displayed on the display unit 108. Figure 10 It is a directed graph that represents an example of information displayed on the display unit 108. Figure 10 (A) shows a typical directed graph displaying the cluster numbers corresponding to each node. Figure 10 (B) is a diagram showing a variation of a directed graph. The directed graph generation unit 104 can also extract the words contained in the clustering information corresponding to each node in descending order of frequency of occurrence, and generate a directed graph using the extracted words as information representing the content of the clusters corresponding to each node (see reference). Figure 10 (B) is displayed on the display unit 108. Thus, the user can easily grasp the content of each node in the directed graph based on the words.

[0103] (Variation Example 2)

[0104] Figure 11 This is a schematic diagram showing the general structure of the device management system 2, another variation of Embodiment 1. Furthermore, hereafter, structures and processes identical to those described in the above embodiments will be labeled with the same reference numerals, and repeated descriptions will be omitted. Figure 11 As shown, the device management system 2 of this modified example differs from the device management system 1 of Embodiment 1 only in that it has a log display image generation unit 201 in the information processing terminal 200; otherwise, they are the same.

[0105] The log extraction display image generation unit 201 extracts logs corresponding to edges that meet the specified conditions from the log set, and generates an extracted log display image representing the content of the extracted logs, which is displayed on the display unit 108 as information representing the content of the edge (inter-cluster migration information) that meets the specified conditions. Figure 12 This indicates a display screen that pops up near an edge of a directed graph, showing the status of an image related to the content of that edge.

[0106] Furthermore, the phrase "meeting the specified conditions" can be defined as situations where the anomaly degree exceeds a specified value, or where the user selects an edge in the directed graph corresponding to the inter-cluster migration information via mouse operation. Additionally, the extracted log display image is not limited to the vicinity of the edges in the directed graph; it can be displayed in any manner, or it can be a user interface with a dedicated display area on the screen. With this modified structure, the user can quickly identify the logs corresponding to the inter-cluster migration information.

[0107] <Implementation Method 2>

[0108] Next, based on Figures 13 to 17 Other embodiments of the present invention will be described. Figure 13 This is a schematic diagram showing the general structure of the device management system 3 in this embodiment. (Example) Figure 13 As shown, the device management system 3 of this embodiment differs from the device management system 1 in that it includes a sensor data acquisition unit 301 in the information processing terminal 300. Furthermore, the inter-cluster migration information evaluation unit 303 of this embodiment differs from the inter-cluster migration information evaluation unit 103 of Embodiment 1 in that it performs a portion of the processing described later. Otherwise, it is the same as the device management system 1 of Embodiment 1.

[0109] The sensor data acquisition unit 301 acquires sensor data used to detect information related to the status of the hardware (e.g., conveyor 124, camera 121, X-stage 122, Y-stage 123, output device, etc.) of the appearance inspection apparatus 120. The sensor data is numerical data that records the time-series status of the hardware, acquired from various sensors, motors, position control systems, and other devices included in the appearance inspection apparatus 120. Whether the sensor data is recorded in text or binary format depends on the specifications of the device, but it can be in any format as long as the correspondence between time and numerical values ​​can be obtained. Furthermore, in this embodiment, various sensors and the sensor data acquisition unit 301 are equivalent to a hardware information acquisition unit.

[0110] In the automatic inspection process of the appearance inspection device 120, the processing of one inspection object generally consists of six steps. Specifically, the steps are: loading the inspection object O, photographing the inspection object O, image processing, good / bad determination, outputting the inspection result, and unloading the inspection object O. Moreover, the hardware actions vary for each step, and the length and number of repetitions of each step are also not fixed. Therefore, the sensor data recording the state of the hardware also varies significantly depending on the object. In other words, it is not easy to estimate the cause of device failure by learning from the hardware actions (represented by its sensor data).

[0111] Next, the process of malfunction cause estimation processing of the appearance inspection device 120 in the device management system 3 of this embodiment will be described. Figure 14 This is a flowchart illustrating an example of fault cause estimation and processing in device management system 3. For example... Figure 14 As shown, the overall process is largely the same as that in the case of Implementation Method 1.

[0112] In the device management system 3 of this embodiment, reference data is first generated based on data obtained from the appearance inspection device 120 during normal operation (S301). Here, based on... Figure 15 The subroutine of step S301 is explained. Figure 15 This is a flowchart illustrating the process of the subroutine for generating and processing the baseline data in this embodiment.

[0113] like Figure 15 As shown, the subroutine for generating the baseline data in this embodiment is also largely the same as in Embodiment 1, performing the same processing as in Embodiment 1 from step S201 to step S205. That is, obtaining the log data during normal operation (S201), performing the process of separating the log information (S202), clustering the separated log information (S203), generating a directed graph using the clustered data (S204), and performing weighted edge calculation based on the frequency of migration between clusters (S205).

[0114] In this embodiment, as a next step, the sensor data acquisition unit 301 acquires sensor data during normal operation of the appearance inspection device 120 (S401). Next, the inter-cluster migration information evaluation unit 303 performs further weighting processing on the edges of the directed graph based on the sensor data output in step S401 (S402).

[0115] Specifically, the inter-cluster migration information evaluation unit 303 uses the Change-Finder algorithm to transform the sensor data (time series numerical data) acquired from the hardware into data (change score) representing the magnitude of the change at each moment in the time series. Figure 16 This is an explanatory graph illustrating the relationship between sensor data and change scores. Furthermore, the Change-Finder algorithm is a well-known method, therefore detailed explanations are omitted.

[0116] At this time, as Figure 16 As shown, the numerical range of the sensor data that forms the basis of the variation score varies depending on the hardware, etc., and therefore the variation score also reflects this difference, resulting in a bias in the numerical range. Therefore, all variation scores are standardized between 0 and 1.

[0117] Next, the inter-cluster migration information evaluation unit 303 maps the change scores to the log clustering sequence generated by the clustering information extraction unit 102 (refer to...). Figure 7 ), and establish a correspondence for which cluster the score changes most when migrating between clusters. Figure 17 This represents an example of a log clustering sequence that maps change scores.

[0118] Then, the inter-cluster migration information evaluation unit 303 weights each edge of the directed graph based on hardware information by reflecting the magnitude of the change scores of each edge (inter-cluster migration) of the directed graph.

[0119] Thus, when the processing in step S402 ends, the process proceeds to step S206. However, the subsequent processing involved in the subroutine of the reference data generation process (S301) is the same as that described in embodiment 1, so the description here is omitted.

[0120] Return to the instructions Figure 14 The flowchart illustrates the fault cause estimation process. If the processing in step S301 is completed, the reference data generation unit 105 saves the generated reference data in the storage unit 109 (S102). Then, when a fault occurs in the visual inspection device 120, the log data acquisition unit 101 acquires the log data at the time of the fault (S103), and the sensor data acquisition unit 301 acquires sensor data indicating the hardware status at the time of the fault (S302).

[0121] Then, in the information processing terminal 300, clustering information is extracted from the log data at the time of the fault, a weighted directed graph is generated based on the clustering information, and the directed graph is further weighted based on sensor data to obtain a series of processing steps (S303) of the data after matrix transformation of the directed graph. Furthermore, the specific processing performed in step S303 is the same as the processing performed in steps S202 to S205, S402, and S207 in the subroutine of step S301 described above. Therefore, further explanation is omitted.

[0122] Furthermore, the processing after step S105 in this embodiment is the same as that in embodiment 1, so the description here is omitted.

[0123] According to the device management system 3 of this embodiment, sensor data representing the hardware state of the appearance inspection device 120 can be used to further weight the edges (i.e., inter-cluster migration information) of the directed graph. In a directed graph that is weighted only by the frequency of inter-cluster migration, important inter-cluster migration information (although low in frequency) corresponding to the switching of steps and changes in hardware state in the appearance inspection device 120 may be undervalued. In this regard, the device management system 3 of this embodiment detects important change points in the sensor data and further weights the edges accordingly, thus suppressing the undervaluation of important inter-cluster migration information and obtaining a more accurate estimation result of the cause of failure.

[0124] <Other>

[0125] The above embodiments are merely illustrative of the present invention, and the present invention is not limited to the specific embodiments described above. Various modifications and combinations can be made within the scope of its technical concept. For example, in the above embodiments, a management system for an appearance inspection device was described, but the devices managed by the device management system are not limited to this. As described above, instead of using abnormal data when a fault occurs, reference data learned solely from data during normal operation is used to estimate the cause of the fault. Therefore, the present invention can be applied using only data that can be collected on the actual operating line of the device, and thus can be applied to various devices.

[0126] Furthermore, as data from normal operation, the object being processed by the device (the object being inspected or processed) is not limited to a single item. Reference data can be generated by combining data collected from processing multiple objects. In this case, data such as when the object was changed at what time is not required; reference data can be generated solely from software logs and sensor data.

[0127] Furthermore, while the above embodiments are described as systems that include devices for managing objects, the information processing terminal in the above embodiments can also be understood as the management system of the present invention. That is, the present invention can also be understood as a device management terminal consisting of an information processing terminal separately configured from the device for managing objects.

[0128] <Postscript 1>

[0129] A management system (1, 2, 3) for a device, characterized in that it comprises:

[0130] Log data acquisition unit (101) acquires logs, which are records of software actions related to the control of the device;

[0131] Clustering information extraction unit (102) extracts clustering information and inter-cluster migration information from the obtained set of logs. The clustering information is information representing the content of each step related to the operation of the device, and the inter-cluster migration information is information related to the migration between one step and another step.

[0132] Anomaly calculation unit (106) calculates the anomaly degree of the extracted inter-cluster migration information; and

[0133] The fault cause estimation unit (107) estimates the fault cause of the device based on the anomaly calculated by the anomaly calculation unit.

[0134] <Appendix 2>

[0135] A method for estimating the cause of device failure, comprising the following steps:

[0136] Log data acquisition steps (S201, S103): Acquire logs, which are the action history information of software related to the control of the device;

[0137] The clustering information extraction steps (S202, S203) extract clustering information and inter-cluster migration information from the obtained set of logs. The clustering information is information representing the content of each step of the processing performed by the device, and the inter-cluster migration information is information related to the migration between multiple steps in the device.

[0138] Anomaly calculation step (S105): Calculate the anomaly degree of the extracted inter-cluster migration information; and

[0139] The fault cause estimation step (S106) estimates the fault cause of the device based on the anomaly calculated by the anomaly calculation unit.

Claims

1. A device management system, which is a device management system, characterized in that it comprises: A log data acquisition unit acquires logs, which are records of software actions related to the control of the device. The clustering information extraction unit extracts clustering information and inter-cluster migration information from the obtained set of logs. The clustering information is information representing the content of each step related to the operation of the device, and the inter-cluster migration information is information related to the migration between one step and another step, including at least information related to the frequency of migration between multiple steps in the device. The inter-cluster migration information evaluation unit performs weighted summation of the extracted inter-cluster migration information based on the occurrence frequency. An anomaly calculation unit uses the weighted information to calculate the anomaly degree of the extracted inter-cluster migration information. as well as The fault cause estimation unit estimates the fault cause of the device based on the anomaly calculated by the anomaly calculation unit.

2. The device management system according to claim 1, characterized in that, The anomaly calculation unit calculates the anomaly degree of each extracted inter-cluster migration information based on the inter-cluster migration information when the device is normal.

3. The device management system according to claim 1, characterized in that, The device management system also includes a hardware information acquisition unit, which acquires hardware information related to the state of the device's hardware. The inter-cluster migration information evaluation unit further performs weighted summation of the extracted inter-cluster migration information based on the hardware information obtained by the hardware information acquisition unit.

4. The device management system according to claim 1, characterized in that, The fault cause estimation unit estimates that a fault cause exists in the step determined by the inter-cluster migration information where the anomaly calculated by the anomaly calculation unit satisfies the specified conditions.

5. A device management system, which is a device management system, characterized in that it comprises: A log data acquisition unit acquires logs, which are records of software actions related to the control of the device. The clustering information extraction unit extracts clustering information and inter-cluster migration information from the obtained set of logs. The clustering information is information representing the content of each step related to the operation of the device, and the inter-cluster migration information is information related to the migration between one step and another. Anomaly calculation unit, which calculates the anomaly degree of the extracted inter-cluster migration information; The fault cause estimation unit estimates the fault cause of the device based on the anomaly calculated by the anomaly calculation unit; The display unit is capable of displaying information representing the anomaly calculated by the anomaly calculation unit and / or the fault cause estimated by the fault cause estimation unit; A directed graph generation unit uses the clustering information as nodes and the inter-cluster migration information as edges to generate a directed graph representing the relationship between each clustering information and the inter-cluster migration information. as well as The log extraction and display image generation unit extracts logs from the log set that correspond to the inter-cluster migration information that meets predetermined conditions, using these logs as information representing the content of the inter-cluster migration information that meets the predetermined conditions, and generates an extracted log display image representing the content of the extracted logs. The display unit is capable of displaying the directed graph and the extracted log display image.

6. The device management system according to claim 5, characterized in that, The anomaly calculation unit calculates the anomaly degree of each extracted inter-cluster migration information based on the inter-cluster migration information when the device is normal.

7. The device management system according to claim 5, characterized in that, The fault cause estimation unit estimates that a fault cause exists in the step determined by the inter-cluster migration information where the anomaly calculated by the anomaly calculation unit satisfies the specified conditions.

8. The device management system according to claim 5, characterized in that, The inter-cluster migration information is weighted information that has been evaluated with added importance using a prescribed method. The directed graph generation unit generates a weighted directed graph that can visually confirm the migration information between the clusters.

9. The device management system according to claim 8, characterized in that, The directed graph generation unit generates a directed graph that visually represents the weighting by displaying the weighted values ​​representing the inter-cluster migration information near the edges.

10. The device management system according to claim 8, characterized in that, The directed graph generation unit generates a weighted directed graph that can be visually confirmed by displaying the edges representing the migration information between the various clusters with different clarity settings.

11. The device management system according to claim 5, characterized in that, The clustering information includes words that serve as text information extracted from the logs. The directed graph generation unit extracts the words contained in each cluster information in descending order of frequency of occurrence, and generates the directed graph that uses the extracted words as information representing the content of the cluster information.

12. The device management system according to claim 5, characterized in that, The extracted log display image pops up near the edge representing the inter-cluster migration information corresponding to the extracted log shown in the extracted log display image.

13. A method for estimating the cause of device failure, comprising the following steps: The log data acquisition step involves acquiring logs, which are the action history information of the software related to the control of the device; The clustering information extraction step extracts clustering information and inter-cluster migration information from the obtained set of logs. The clustering information is information representing the content of each step of the processing performed by the device, and the inter-cluster migration information is information related to the migration between multiple steps in the device, including at least information related to the frequency of migration between multiple steps in the device. The inter-cluster migration information evaluation step weights the extracted inter-cluster migration information based on the occurrence frequency. The anomaly calculation step involves using the weighted information to calculate the anomaly degree of the extracted inter-cluster migration information. as well as The fault cause estimation step estimates the fault cause of the device based on the anomaly calculated in the anomaly calculation step.

14. A method for estimating the cause of device failure, comprising the following steps: The log data acquisition step involves acquiring logs, which are records of software actions related to the control of the device. The clustering information extraction step extracts clustering information and inter-cluster migration information from the obtained set of logs. The clustering information represents the content of each step related to the operation of the device, and the inter-cluster migration information is information related to the migration between one step and another. Anomaly calculation step: Calculate the anomaly degree of the extracted inter-cluster migration information; The fault cause estimation step estimates the fault cause of the device based on the anomaly calculated in the anomaly calculation step; The directed graph generation step involves using the clustering information as nodes and the inter-cluster migration information as edges to generate a directed graph representing the relationship between each clustering information and the inter-cluster migration information. The step of extracting a log display image involves extracting logs from the log set that correspond to the inter-cluster migration information that meets the specified conditions, using these logs as information representing the content of the inter-cluster migration information that meets the specified conditions, and generating an extracted log display image that represents the content of the extracted logs. as well as The display step shows information representing the anomaly calculated in the anomaly calculation step and / or the fault cause estimated in the fault cause estimation step. In the display step, the directed graph and the extracted log display image are displayed.

15. A program product for causing a computer to perform the steps of the method of claim 13 or 14.

Images