Abnormality determination device, abnormality determination model generation method, and abnormality determination method

Abstract

The abnormality determination device includes a time series signal extraction unit, a normal vector registration unit, an abnormality determination model registration unit, and an abnormality determination unit. In a case where the abnormality determination flag is the first type, the abnormality determination unit calculates distances from the registered normal vectors, extracts a predetermined number of normal vectors as neighboring data in order of the distances from small to large, calculates a distance between a center of gravity vector of the neighboring data and an M-dimensional vector of an object of abnormality determination, and performs abnormality determination of the device based on the distance. In a case where the abnormality determination flag is the second type, the abnormality determination unit calculates a deviation from principal components based on transformation coefficients of the principal components calculated in advance, and performs abnormality determination of the device based on the deviation.

Description

Technical Field

[0001] This invention relates to an anomaly detection device, an anomaly detection model generation method, and an anomaly detection method. Background Technology

[0002] In the rolling process of steelmaking, steel plates are rolled by a pair of work rolls and a support roll. The hydraulic pressing device adjusts the valve opening of the servo valve by moving the valve core of the servo valve through the excitation current, and adjusts the oil volume of the oil column cylinder, thereby controlling the position of the oil column cylinder and the pressing amount of the work rolls, so that the steel plate is rolled to the specified thickness.

[0003] In such a hydraulic pressing device, it is preferable to detect even the slightest abnormality (minor abnormality) such as the valve core becoming difficult to move, before an abnormality occurs where the valve core cannot move and thus cannot press down the work roller. Against this backdrop, a technique for monitoring abnormalities in the hydraulic pressing device has been proposed.

[0004] For example, Patent Document 1 describes a method in which, during normal operation of the equipment, the correlation between a reference value and an actual value of the movement of the servo valve spool is pre-calculated, and anomalies are detected based on the relationship between the reference value and the actual value. Additionally, Patent Document 2 describes a method in which the relationship between the excitation current of the servo valve and the position of the hydraulic cylinder is classified into regions where the relationship is proportional and regions in a saturated state for monitoring.

[0005] Patent Document 1: Japanese Patent No. 2615291

[0006] Patent Document 2: Japanese Patent Application Publication No. 63-172004

[0007] However, the technology described in Patent Document 1 only uses the reference value and actual value of the movement of the servo valve spool to monitor anomalies, so the amount of information used for monitoring cannot be considered sufficient. Furthermore, according to the technology described in Patent Document 2, for the relationship between the servo valve's excitation current and the position of the hydraulic cylinder, appropriate values ​​need to be set for each of the two relationships: proportional relationship and saturation state. However, even under normal conditions, there is an allowable deviation range in the relationship between the two signals, making it difficult to determine the appropriate value definitively. Moreover, in cases such as steelmaking where there are multiple target devices, setting appropriate values ​​for each of the multiple relationships between the signals of each target device increases the workload. Summary of the Invention

[0008] The present invention was made in view of the above-mentioned problems, and its purpose is to provide an anomaly determination device, an anomaly determination model generation method, and an anomaly determination method that can universally and accurately detect anomalies of devices with nonlinear characteristics without having to monitor each device individually.

[0009] To address the aforementioned issues and achieve the objective, the anomaly determination device of the present invention determines anomalies in equipment performing prescribed actions. This anomaly determination device comprises: a time-series signal cutout unit, which, during normal operation of the equipment, cuts out K times from two or more time-series signals representing the operating state of the equipment; a normal vector registration unit, which sets the types of the two or more time-series signals cut out by the time-series signal cutout unit to M types, constructs an M-dimensional vector composed of M types of variables at the same time, and registers the constructed vector as a normal vector; and an anomaly determination model registration unit, which sets an anomaly determination flag to type one when the maximum value of the correlation between the variables is less than a predetermined value, and sets an anomaly determination flag to type two when the maximum value of the correlation between the variables is greater than or equal to the predetermined value, and registers the registered anomaly determination model. A principal component analysis is performed on the normal vector group to calculate the transformation coefficients of the principal components. Each of the calculated transformation coefficients of the principal components is registered as an anomaly detection model. An anomaly detection unit determines the anomaly of the device. When the device is an anomaly detected, the anomaly detection unit constructs an M-dimensional vector from the time series signal cut out in the same way as during normal operation. If the anomaly detection flag is of type 1, the distance to the registered normal vector is calculated. A predetermined number of the normal vectors are extracted as neighboring data in ascending order of distance. The distance between the centroid vector of the neighboring data and the M-dimensional vector of the anomaly detection object is calculated. The anomaly detection of the device is performed based on the distance. If the anomaly detection flag is of type 2, the deviation from the principal components is calculated based on the pre-calculated transformation coefficients of the principal components. The anomaly detection of the device is performed based on the deviation.

[0010] Furthermore, based on the above invention, the anomaly determination device of the present invention further comprises: a time-series signal collection unit, which collects time-series signals representing the operating state of the device and trigger candidate time-series signals that determine the conditions for cutting out the time-series signals representing the operating state from a predetermined monitoring target interval; and a trigger condition determination model generation unit, which, for the time-series signals representing the operating state of the device, pre-determines the start time of the monitoring target interval to be cut out, generates label data that sets the label of the start time to ON and sets the labels of other times to OFF, and generates a trigger condition determination model by machine learning that takes the values ​​of one or more trigger candidate time-series signals at each time as input and the label data at each time as output, and the time-series signal cutting-out unit cuts out the time-series signals based on the trigger condition determination model during normal operation of the device and during anomaly determination.

[0011] Furthermore, based on the above-mentioned invention, the anomaly determination device involved in this invention uses a machine learning model that includes a decision tree to determine the triggering condition.

[0012] Furthermore, based on the above invention, the anomaly determination device of the present invention determines whether the equipment needs maintenance based on the number of times the equipment is determined to be abnormal within a specified period.

[0013] To address the aforementioned issues and achieve the objectives, the anomaly determination model generation method of this invention determines anomalies in equipment performing prescribed actions. This method includes: a time series signal cutout step, where, during normal operation of the equipment, K cutouts are performed from two or more time series signals representing the equipment's operational state; a normal vector registration step, where the types of the two or more time series signals cut out in the time series signal cutout step are set to M types, forming an M-dimensional vector composed of M variables at the same time, and the resulting vector is registered as a normal vector; and an anomaly determination model registration step, where if the maximum correlation between the variables is less than a predetermined value, an anomaly determination flag is set to a first type; if the maximum correlation between the variables is greater than or equal to the predetermined value, an anomaly determination flag is set to a second type; when the anomaly determination flag is of the second type, principal component analysis is performed on the registered normal vector group to calculate the transformation coefficients of the principal components, and each of the calculated transformation coefficients of the principal components is registered as an anomaly determination model.

[0014] Furthermore, based on the above invention, the anomaly determination model generation method of the present invention further includes: a time series signal collection step, which collects time series signals representing the operation state of the device and trigger candidate time series signals that determine the conditions for cutting out the time series signals representing the operation state from a predetermined monitoring object interval; and a trigger condition determination model generation step, which, for the time series signals representing the operation state of the device, pre-determines the start time of the monitoring object interval to be cut out, generates label data that makes the label of the start time ON and the labels of other times OFF, and generates a trigger condition determination model by machine learning that takes the values ​​of one or more of the trigger candidate time series signals at each time as input and the label data at each time as output, and the time series signal cutting out step performs the cutting out of the time series signals based on the trigger condition determination model.

[0015] To address the aforementioned issues and achieve the objectives, the anomaly determination method of this invention uses an anomaly determination model generated by the aforementioned anomaly determination model generation method to determine anomalies in equipment performing specified actions. This anomaly determination method includes: a time series signal cutout process, where two or more time series signals representing the operating state of the equipment are cut out; and an anomaly determination process, where anomalies in the equipment are determined. The anomaly determination process performs the following actions: determining whether the anomaly determination flag of the time series signal cut out in the time series signal cutout process is of type one or type two; if the anomaly determination flag is type one, calculating the distance to the registered normal vectors, extracting a specified number of the normal vectors as neighboring data in ascending order of distance, calculating the distance between the centroid vector of the neighboring data and the M-dimensional vector of the object to be determined, and determining anomalies in the equipment based on the distance; if the anomaly determination flag is type two, calculating the deviation from the principal components based on the pre-calculated transformation coefficients of the principal components, and determining anomalies in the equipment based on the deviation.

[0016] Furthermore, based on the above invention, the anomaly determination method involved in this invention uses a trigger condition determination model generated by the above anomaly determination model generation method to cut out the time series signal in the above time series signal cutting-out process.

[0017] According to the present invention, it is possible to detect anomalies of devices with nonlinear characteristics in a universal and highly accurate manner without having to monitor each device individually. Attached Figure Description

[0018] Figure 1 This is a block diagram illustrating the general structure of the anomaly determination model generation apparatus and the anomaly determination apparatus according to embodiments of the present invention.

[0019] Figure 2 This is a flowchart illustrating the process of determining the model generation method based on the triggering conditions involved in the embodiments of the present invention.

[0020] Figure 3 This diagram schematically illustrates the time-series signal cutout process of the trigger condition determination model generation method involved in the embodiments of the present invention.

[0021] Figure 4 This diagram schematically illustrates the time-series signal cutout process of the trigger condition determination model generation method involved in the embodiments of the present invention.

[0022] Figure 5 This diagram schematically illustrates the content of the trigger condition determining model generation process in the trigger condition determining model generation method according to an embodiment of the present invention.

[0023] Figure 6 This is a schematic diagram illustrating the decision tree generated in the trigger condition determination model generation step of the trigger condition determination model generation method according to an embodiment of the present invention.

[0024] Figure 7 This diagram schematically illustrates the state of transforming a pulse signal into a sawtooth wave in the trigger condition determination model generation process of the trigger condition determination method for time series signals according to an embodiment of the present invention.

[0025] Figure 8 This is a schematic diagram illustrating the transformed sawtooth wave in the trigger condition determination model generation process of the trigger condition determination method for time series signals according to an embodiment of the present invention.

[0026] Figure 9 This is a flowchart illustrating the process of generating an anomaly determination model according to an embodiment of the present invention.

[0027] Figure 10 This is a flowchart illustrating the process of the anomaly determination method according to an embodiment of the present invention.

[0028] Figure 11 This is an explanatory diagram illustrating the principle of the anomaly determination process in the anomaly determination method according to the embodiments of the present invention.

[0029] Figure 12 This is an explanatory diagram illustrating the effect of the anomaly determination method involved in the embodiments of the present invention. Detailed Implementation

[0030] The anomaly determination device, anomaly determination model generation method, and anomaly determination method involved in the embodiments of the present invention will be described with reference to the accompanying drawings.

[0031] (Anomaly detection device)

[0032] An anomaly detection device is a device used in production equipment in factories and experimental equipment in research institutes to determine (diagnose) anomalies in monitored equipment (hereinafter sometimes simply referred to as "equipment"). Examples of monitored equipment include equipment used in ironmaking processes, production equipment used in manufacturing processes for petroleum-related products and chemicals, and experimental equipment in research institutions.

[0033] The anomaly detection device 1 is implemented, for example, by a general-purpose information processing device such as a personal computer or workstation. Figure 1 As shown, the anomaly detection device 1 includes an input unit 10, an output unit 20, an arithmetic unit 30, and a storage unit 40.

[0034] The input unit 10 is a data input unit for the arithmetic unit 30, and may be implemented by, for example, a data collection device, a keyboard, or an indicator device. The output unit 20 is a data output unit for the data processed by the arithmetic unit 30, and may be implemented by, for example, a display device such as a liquid crystal display.

[0035] The arithmetic unit 30 is implemented, for example, by a processor consisting of a CPU (Central Processing Unit) and a memory (main storage unit) consisting of RAM (Random Access Memory) and ROM (Read Only Memory). The arithmetic unit 30 loads a program into the working area of ​​the main storage unit and executes it. By controlling the execution of the program, it controls the various components, thereby achieving a function consistent with the intended purpose.

[0036] Furthermore, through the execution of the aforementioned program, the arithmetic unit 30 functions as a time series signal collection unit (time series signal collection unit) 31, a time series signal cutout unit (time series signal cutout unit) 32, and a normal vector registration unit (normal vector registration unit) 33. Additionally, the arithmetic unit 30 also functions as a trigger condition determination model generation unit (trigger condition determination model generation unit) 34, an anomaly determination model registration unit (anomaly determination model registration unit) 35, and an anomaly determination unit (anomaly determination unit) 36. Further details of each unit are described below (see [reference]). Figure 2 and Figure 9 Additionally, in Figure 1 The example shown is an example of implementing the functions of each part through a single arithmetic unit 30 (≈ a computer), but the functions of each part can also be implemented through multiple arithmetic units.

[0037] The storage unit 40 is a unit that stores the calculation results of the arithmetic unit 30, and is implemented, for example, by a hard disk device. The storage unit 40 stores a trigger condition determination model 41, a normal DB 42, and an anomaly determination model 43. In addition to the above models, the storage unit 40 also stores, as needed, data processed by the arithmetic unit 30 (e.g., monitored object signals, trigger candidate signals, trigger conditions, etc.).

[0038] The trigger condition determination model 41 is a learning model used when determining the trigger condition. As will be described later, the trigger condition determination model 41 is pre-generated by the trigger condition determination model generation unit 34 and stored in the storage unit 40.

[0039] Here, "triggering condition" refers to the conditions used to cut out the time series signal in the anomaly determination method described later, when registering the normal vector (normal data) in normal DB42, when registering the anomaly determination model 43, and when performing anomaly determination.

[0040] Specifically, the trigger condition refers to the timing condition for cutting out an interval (hereinafter referred to as the "monitored object interval") from the time-series signal representing the device's operating state (hereinafter also referred to as the "device state time-series signal") that becomes the object of anomaly determination. This trigger condition, for example, represents the start time and width of the cut-out from the aforementioned time-series signal. Furthermore, the time-series signal that determines the condition (trigger condition) for cutting out the device operating time-series signal from the aforementioned monitored object interval is called the "trigger candidate signal".

[0041] The time-series signals of equipment actions vary depending on the type of equipment being monitored. For example, when the monitored equipment is a "motor," the motor's current, speed, etc., are used as the time-series signals of equipment actions. In the anomaly detection device 1, at least one equipment status time-series signal and its corresponding trigger candidate signal are always collected. The trigger candidate signal is a time-series signal associated with the monitored equipment, representing a time-series signal detected simultaneously with the equipment action time-series signal.

[0042] Typically, a monitored device begins to operate when one or more conditions are met. A trigger candidate signal refers to this condition, such as an On or Off signal. If the trigger condition is known beforehand, selecting the monitoring range is relatively easy. However, in situations where multiple devices operate in multiple and complex ways, it is sometimes difficult to easily determine the trigger condition. Alternatively, there may be cases where the trigger candidate signal directly indicating the trigger condition is not necessarily imported into the database, and only indirect forms of the signal exist.

[0043] Therefore, a set of signals specifying the conditions for equipment operation is selected as candidate trigger signals. Rules for initiating operations are extracted from the history of these signals using machine learning or similar methods to determine the conditions for cutting out the monitored object's interval. Furthermore, the candidate trigger signals are preferably signals that are not directly related to anomalies in the object's process, equipment, etc.; various command values ​​and ON / OFF signals indicating specific events are considered candidates. However, the monitored object's signal itself can also be included in the candidate trigger signals.

[0044] Additionally, the monitored area refers to the interval cut out from the device operation time series signal for anomaly detection. When cutting out the monitored area from the device operation time series signal, the start time of the cutout (hereinafter referred to as the "cutout start time") and the width of the cutout are specified. In this case, the cutout start time is specified by the value of a trigger candidate signal collected simultaneously with the device operation time series signal. Furthermore, the width of the cutout varies depending on the type of monitored device. For example, if the monitored device is a "motor," the interval of motor acceleration can be specified as the width of the cutout. Alternatively, if it is a product manufacturing process, the width can also be the width of the interval from the start to the end of manufacturing.

[0045] Normal DB42 is the database used by the anomaly determination device 1 when performing anomaly determination. Normal DB42 accumulates data on the normal operating state of the device during past operations (hereinafter referred to as "normal vector"). This normal vector consists of an M-dimensional vector, which is composed of M variables corresponding to the types of time series signals cut out by the time series signal cutout unit 32.

[0046] The anomaly detection model 43 is a learned model used in the anomaly detection method described later for anomaly detection. As will be described later, this anomaly detection model 43 is pre-generated by the anomaly detection model registration unit 35 and stored in the storage unit 40. Furthermore, details regarding the anomaly detection model 43 will be described later.

[0047] (Triggering conditions determine the model generation method)

[0048] Reference Figures 2-8 The method for generating the trigger condition determination model 41 according to the embodiment will be described. The trigger condition determination model generation method sequentially performs a time series signal collection step (step S1), a time series signal extraction step (steps S2 to S5), and a trigger condition determination model generation step (steps S6 and S7). In addition, in the trigger condition determination model generation method, as described later, the time series signal extraction step and the trigger condition determination model generation step are repeatedly performed as needed.

[0049] <Time Series Signal Acquisition Process>

[0050] In the time series signal acquisition process, the time series signal acquisition unit 31 collects a signal group consisting of a device status time series signal and a trigger candidate signal (step S1). Furthermore, while the case where the time series signal acquisition unit 31 collects multiple time series signals has been described here, the time series signal acquisition unit 31 may also collect only one time series signal.

[0051] <Time Series Signal Cutout Process>

[0052] In the time series signal cut-out process, the time series signal cut-out unit 32, based on a predetermined reference, cuts out the monitoring target range of the equipment operation time series signal from the signal group collected in the time series signal collection process. The details of the time series signal cut-out process are explained below.

[0053] like Figure 3 As shown, the time-series signal cutout unit 32 first performs a coarse cutout of the signal group (step S2). For example, in equipment that performs repetitive operations, such as a coil rolling mill, the equipment status time-series signal and trigger candidate signal are continuously acquired without interruption for continuously flowing coils. Therefore, in step S2, for example, a coarse cutout of the signal group is performed to divide the equipment status time-series signal and trigger candidate signal for each coil. Furthermore, the coarse cutout of the signal group can be performed at a preset time according to the type of equipment being monitored, or, as shown in the figure, a coarse cutout signal can be selected from multiple trigger candidate signals and performed at the rising time of the coarse cutout signal.

[0054] In addition, Figure 3 In the figure, reference numeral Sg represents the signal group before coarse cut-out, reference numeral Ss represents the device status time series signal before coarse cut-out, reference numeral St represents the trigger candidate signal before coarse cut-out, and reference numerals Sg1, Sg2, and Sg3 represent the signal group after coarse cut-out. Additionally, in this figure, reference numerals Ss1, Ss2, and Ss3 represent the device status time series signal after coarse cut-out, and reference numerals St1, St2, and St3 represent the trigger candidate signals after coarse cut-out.

[0055] Next, as Figure 4 As shown in (a), the time series signal cutout unit 32 selects a device status time series signal (Ss1 in this figure) from the multiple device status time series signals roughly cut out in step S2. Then, it cuts out the monitoring target interval Sm1 of the selected device status time series signal Ss1 (step S3). The cutting-out condition for the monitoring target interval Sm1 in step S3 is determined based on the device characteristics of the monitored device. For example, if the monitored device is a "motor" and the device status time series signal Ss1 is "motor current value", and it is determined whether the rise of the motor current value during motor acceleration is normal, the interval of motor acceleration is set as the monitoring target interval Sm1, as shown in the figure. That is, the start time of cutting out the monitoring target interval Sm1 is specified as the time when the motor starts to accelerate, and the width of the cutout is specified as the interval from the start of motor acceleration to the end of acceleration.

[0056] Next, the time series signal cutout unit 32 calculates the correlation coefficient between the waveform of the monitored object interval Sm1 cut out in step S3 and the waveforms of other device status time series signals Ss2 and Ss3 (step S4). Next, as... Figure 4 As shown in (b), the time series signal cutout unit 32 searches for the interval with the largest correlation coefficient with the waveform contained in the monitoring target interval Sm1 cut out in step S3 for other device status time series signals Ss2 and Ss3. Thus, the monitoring target intervals Sm2 and Sm3 of the device status time series signals Ss2 and Ss3 are cut out respectively (step S5).

[0057] Thus, in steps S4 and S5, waveforms similar to those in the monitoring interval Sm1 cut out in step S3 are searched from the waveforms contained in the device status time series signals at other times roughly cut out in step S2. Furthermore, in addition to comparing the correlation coefficients mentioned above, similar waveforms can also be searched using the Euclidean distance between the data of each time series signal.

[0058] <Triggering conditions determine the model generation process>

[0059] In the trigger condition determination model generation process, for each signal group (multiple device status time series signals), the start time of the monitoring object interval to be cut out is determined in advance. Then, label data is generated that makes the label of the start time ON and the labels of other times OFF. A learning model is generated by machine learning that takes the values ​​of one or more candidate trigger signals at each time as input and the label data at each time as output.

[0060] In the process of determining the model generation by triggering conditions, the first step is as follows: Figure 5As shown, the trigger condition determination model generation unit 34 processes each signal group as follows: Specifically, it assigns the "trigger ON" label to the values ​​of the device status time series signals Ss1, Ss2, and Ss3 corresponding to the start times p1, p2, and p3 of the cut-out monitoring object intervals Sm1, Sm2, and Sm3, as well as the values ​​of the trigger candidate signals St1, St2, and St3. Furthermore, it assigns the "trigger OFF" label to the values ​​of the device status time series signals Ss1, Ss2, and Ss3 corresponding to times other than the start times of the cut-out monitoring object intervals Sm1, Sm2, and Sm3, as well as the values ​​of the trigger candidate signals St1, St2, and St3 (step S6). Hereinafter, the values ​​of the device status time series signals Ss1, Ss2, and Ss3, as well as the values ​​of the trigger candidate signals St1, St2, and St3, will be referred to as the "value of the signal group". Additionally, the "Trigger ON" label indicates that the value of the signal group assigned to this label is the cut-out start time, while the "Trigger OFF" label indicates that the value of the signal group assigned to this label is not the cut-out start time.

[0061] Next, the trigger condition determination model generation unit 34 takes the values ​​of signal groups labeled "trigger ON" and signal groups labeled "trigger OFF" as input, and uses the "trigger ON" and "trigger OFF" labels as output for machine learning. Thus, as... Figure 6 As shown, a decision tree is generated (step S7).

[0062] Specifically, a decision tree can be generated by using labels that set the objective variable to "trigger ON" and "trigger OFF," and using the values ​​of each candidate trigger signal corresponding to each time point of "trigger ON" and "trigger OFF" as learning data for the explanatory variable. Alternatively, "trigger ON" can be set to "1" and "trigger OFF" to "0," and processed as a function. Furthermore, various machine learning models other than decision trees can be used. Therefore, the learning model generated in step S7 is not limited to a decision tree; for example, it could be a random forest or a neural network. Again, "trigger ON" can be set to "1" and "trigger OFF" to "0," and processed as a function.

[0063] Here, in the trigger condition determination model generation process, when the trigger candidate signal included in the signal group is a 1-pulse signal, such as Figure 7 As shown in the figure below, the trigger candidate signal is transformed into a sawtooth wave before machine learning is performed. Furthermore, the "1-pulse signal," as shown in the upper part of the figure, represents a signal in the ON-OFF signal where only one scan of the rising or falling edge of the signal is ON.

[0064] like Figure 7As shown in the diagram above, a pulse 1 signal is a signal that is ON for only a short time. Therefore, in the time series signal cutout process, when searching for regions with high waveform similarity, the pulse 1 signal should also be ON at the "trigger ON" moment. However, the "trigger ON" moment sometimes shifts before or after the moment the pulse 1 signal is ON. On the other hand, as shown in the diagram, by converting the pulse 1 signal into a sawtooth wave, the adverse effects caused by the ON / OFF delay of the pulse 1 signal can be eliminated.

[0065] The slope of the transformed sawtooth wave is determined, for example, based on the time from when the 1-pulse signal is ON until a few seconds later when the signal is to be checked, and is set to a slope that does not overlap with the rising edge of the next signal. Additionally, when transforming a 1-pulse signal into a sawtooth wave, such as... Figure 7 As shown in section A, it is preferable to have a margin (e.g., about 5 scans), which is a margin relative to the case where the monitored target area is cut off before the 1 pulse signal is ON due to the deviation of the cut-off start point.

[0066] In addition, such as Figure 8 As shown, the shape of the sawtooth wave is defined by parameters tf and tb, but preferably, the relationship between these parameters tf and tb is tb < tf. Furthermore, in the sawtooth wave, as shown in the figure, if the value z of the transformed signal is within the range shown in B, it is determined that ON is triggered.

[0067] In the trigger condition determination model generation process, if errors occur during machine learning, such as the inability to generate trigger conditions correctly or the discrimination accuracy failing to reach the specified value, the process returns to the aforementioned time series signal cutout process, shifting the previously cut-out monitoring object interval. Then, after a new monitoring object interval for the device status time series signal is cut out, the trigger condition determination model generation process is repeated. That is, after re-cutting out the monitoring object interval for the device status time series signal, the decision tree is constructed again. Then, if trigger conditions can be generated correctly during machine learning, the trigger condition determination model generation process ends; otherwise, it returns to the time series signal cutout process, and both the time series signal cutout process and the trigger condition determination model generation process are repeated.

[0068] like Figure 4As shown, the trigger condition determination model generation method in this embodiment is a method for learning the state of the trigger candidate signal at the beginning time of the initially specified monitoring target interval (monitoring target interval Sm1) in the time series signal cut-out process. Therefore, for example, if the state of the trigger candidate signal at the beginning time of the initially specified monitoring target interval lacks characteristics, learning cannot be performed smoothly. Therefore, as described above, if an error occurs in the trigger condition determination model generation process, by shifting the initially specified monitoring target interval in the time series signal cut-out process forward or backward and re-specifying the monitoring target interval, the undesirable situation during learning can be eliminated.

[0069] (Anomaly Detection Model Generation Method)

[0070] Reference Figure 9 The anomaly detection model generation method involved in the implementation method will be described. The anomaly detection model generation method sequentially performs a time series signal collection step (step S11), a time series signal extraction step (step S12), a normal vector registration step (step S13), and an anomaly detection model registration step (step S14).

[0071] <Time Series Signal Acquisition Process>

[0072] In the time series signal acquisition process, the time series signal acquisition unit 31 collects a signal group consisting of a device status time series signal and a trigger candidate signal (step S11). Furthermore, this explanation describes the case where the time series signal acquisition unit 31 collects multiple device status time series signals, but the device status time series signal collected by the time series signal acquisition unit 31 may also be a single signal.

[0073] <Time Series Signal Cutout Process>

[0074] In the time series signal cutout process, the time series signal cutout unit 32 cuts out the monitoring target interval of the equipment status time series signal during normal operation from the signal group collected in the time series signal collection process (step S12). In the time series signal cutout process, when the equipment is operating normally, the time series signal cutout unit 32 performs K cutouts of the monitoring target interval from two or more equipment status time series signals based on the trigger condition determination model 41. That is, the time series signal cutout unit 32 inputs the equipment status time series signal during normal operation and the trigger candidate signal into the decision tree, determines the trigger condition according to the branch conditions of the decision tree, and cuts out the monitoring target interval based on the determined trigger condition.

[0075] <Normal Vector Registration Process>

[0076] In the normal vector registration process, the normal vector registration unit 33 sets the types of two or more time series signals cut out in the time series signal cutting-out process to M types, and forms an M-dimensional vector composed of M types of variables at the same time. Then, the formed vector is registered as a normal vector in the normal DB42 of the storage unit 40 (step S13).

[0077] <Anomaly Detection Model Registration Process>

[0078] In the anomaly detection model registration process, anomaly detection model 43 is registered (step S14). Specifically, in this process, for normal vectors registered in the normal DB42, if the maximum correlation between variables is less than a predetermined value, the anomaly detection flag is set to Type I. Conversely, if the maximum correlation between the variables is greater than or equal to the predetermined value, the anomaly detection flag is set to Type II. Then, if the anomaly detection flag is Type II, principal component analysis is performed on the normal vector group registered in the normal DB42, the transformation coefficients of the principal components are calculated, and each of the calculated transformation coefficients of the principal components is registered as anomaly detection model 43 in the storage unit 40. Therefore, multiple anomaly detection models are classified into Type I or Type II, and this classification is recorded in the anomaly detection flag of each anomaly detection model. Here, the anomaly detection model created by performing principal component analysis can exemplify Q-statistics, T2 statistics, etc.

[0079] (Anomaly Detection Method)

[0080] Reference Figure 10 The anomaly determination method involved in the implementation method will be described. The anomaly determination method sequentially performs a time series signal collection step (step S21) and an anomaly determination step (steps S22 to S29).

[0081] <Time Series Signal Acquisition Process>

[0082] In the time series signal acquisition process, the time series signal acquisition unit 31 collects a signal group consisting of a device status time series signal and a trigger candidate signal (step S21). Furthermore, this explanation describes the case where the time series signal acquisition unit 31 collects multiple device status time series signals, but the device status time series signal collected by the time series signal acquisition unit 31 may also be a single signal.

[0083] <Abnormality detection process>

[0084] In the anomaly determination process, either the normal vector or the anomaly determination model 43 is used to determine the anomaly of the equipment based on the equipment status time series signal used for anomaly determination.

[0085] In the anomaly determination process, firstly, the time series signal cutout unit 32 cuts out the monitoring target interval of the equipment status time series signal for anomaly determination based on the signal group collected in the time series signal collection process (step S22). At this time, the time series signal cutout unit 32 cuts out the monitoring target interval from two or more equipment status time series signals based on the trigger condition determination model 41. That is, the time series signal cutout unit 32 inputs the equipment status time series signal and the trigger candidate signal into the decision tree, determines the trigger condition according to the branch conditions of the decision tree, and cuts out the monitoring target interval based on the determined trigger condition.

[0086] More specifically, the time series signal cutout unit 32 inputs the values ​​of the candidate trigger signals at each moment into the trigger condition determination model 41. Then, for one or more device status time series signals, L data points are cut out within a predetermined period starting from the moment when the output of the trigger condition determination model 41 becomes ON, thereby cutting out the device status time series signals for anomaly determination.

[0087] Next, the anomaly determination unit 36 ​​constructs an M-dimensional vector composed of M signals at the same time for the device status time series signal cut out by the time series signal cutout unit 32 for anomaly determination (step S23).

[0088] Next, the anomaly determination unit 36 ​​determines whether the anomaly determination flag is of type two for the M-dimensional vector constructed in step S23 (step S24). If the anomaly determination flag is determined to be of type two ("yes" in step S24), the anomaly determination unit 36 ​​calculates the deviation from the principal components based on the transformation coefficients of the principal components of the pre-calculated normal vector group (step S25). Then, the anomaly determination unit 36 ​​performs anomaly determination of the device based on the deviation calculated in step S25 (step S26), completing this process.

[0089] Furthermore, in step S24, if the anomaly determination flag is determined to be of type two ("No" in step S24), the anomaly determination unit 36 ​​determines that the anomaly determination flag is of type one. Then, the distance between the anomaly determination object vector (M-dimensional vector) and the normal vectors registered in the normal DB42 is calculated, and a predetermined number of normal vectors are extracted as neighbor data in ascending order of this distance (step S27). Here, when the anomaly determination model is generated and registered, it is possible to predetermine which anomaly determination flag each signal corresponds to for each signal, and make a determination based on this.

[0090] Next, the anomaly determination unit 36 ​​calculates the distance between the centroid vector of the neighboring data extracted in step S20 and the anomaly determination object vector (step S28). Then, based on the distance calculated in step S28, the anomaly determination unit 36 ​​performs anomaly determination of the device (step S29), completing this process. This determination is made because: since the computational cost of the first type is high, it is preferable to first determine whether it is the second type, and only use the first type if the nonlinear characteristics in the second type affect the determination accuracy.

[0091] Here, in the anomaly determination process, the anomaly determination unit 36 ​​preferably determines whether the equipment needs maintenance based on the number of times the equipment is determined to be abnormal within a specified period. The number of anomalies that require equipment maintenance can be determined through experiments or experience.

[0092] Reference Figure 11 The principle of the anomaly determination step in the anomaly determination method according to the embodiment will be explained. The anomaly determination unit 36 ​​first plots the normal vector (normal data) accumulated by the normal DB42 in a variable space where each signal constituting the normal vector is a variable (variables 1 to 3 in this diagram). Furthermore, the anomaly determination unit 36 ​​plots the anomaly determination object vector (monitored object data) in the same variable space. If the anomaly determination object vector deviates significantly from the distribution of the normal vector within this variable space, the anomaly determination object vector is determined to be abnormal.

[0093] In the anomaly detection method according to the implementation method, a predetermined number of normal vectors located near the anomaly detection object vector are extracted as neighboring data, representing the deviation of the anomaly detection object vector from the distribution of normal vectors. Then, the distance d0 between the centroid vector of the extracted predetermined number of neighboring data and the anomaly detection object vector is calculated. As the aforementioned neighboring data, based on the distance d0 from the anomaly detection object vector... Figure 11 Extract a specified number of normal vectors from the circle whose radius is shown by the dashed line in the middle, in ascending order.

[0094] like Figure 11 As shown, when the deviation of the anomaly detection object vector from the distribution of normal vectors is large, the distance d0 between the centroid vector of the neighboring data and the anomaly detection object vector increases. Conversely, when the deviation of the anomaly detection object vector from the distribution of normal vectors is small, the distance d0 between the anomaly detection object vector and the centroid vector of the neighboring data becomes extremely small. Therefore, when the distance d0 between the anomaly detection object vector and the centroid of the neighboring data is large, the anomaly detection unit 36 ​​determines that the anomaly detection object vector is anomaly.

[0095] The anomaly determination device 1 and anomaly determination method described above can detect anomalies of devices with nonlinear characteristics universally and with high precision without having to monitor each device individually.

[0096] That is, in the anomaly determination device 1 and the anomaly determination method, for a device whose anomaly determination flag is of type 1, a group of data at the same timing is extracted from each of the time series data of multiple specified signals obtained from the device. Then, each of the specified signals is plotted in a variable space as a variable, and the deviation of the anomaly determination object vector during operation from the distribution of the normal vector during normal operation is determined by using the distance between the anomaly determination object vector and the centroid vector of the neighboring data.

[0097] Therefore, even if the state of the device is changed by, for example Figure 12 Even with highly correlated variables exhibiting nonlinearity, the system can perform high-precision anomaly detection without omissions or over-detection.

[0098] Furthermore, in the anomaly determination device 1 and the anomaly determination method, for devices whose anomaly determination flag is of type 2, for example, a high-precision anomaly determination can be performed with a computational load of the level of arithmetic operations using a PCL (Programmable Logic Controller).

[0099] Furthermore, the anomaly determination device 1 and anomaly determination method according to the embodiments have the following effects: By generating and using a trigger condition determination model 41 that learns the conditions under which the device state time series signal and the trigger candidate signal become trigger ON, the trigger conditions for cutting out the monitoring target interval from the device state time series signal can be automatically determined. In addition, since the trigger conditions for cutting out the starting target interval of the device state time series signal can be automatically determined according to the anomaly determination device 1 and anomaly determination method according to the embodiments, manual research and determination of trigger conditions are not required. Therefore, the preparation required for device anomaly determination can be simplified.

[0100] The above description, through methods and embodiments for implementing the invention, has specifically illustrated the anomaly detection device, anomaly detection model generation method, and anomaly detection method involved in the present invention. However, the scope of the present invention is not limited to these descriptions and must be broadly interpreted based on the claims. Furthermore, various modifications and alterations made based on these descriptions are naturally included within the scope of the present invention.

[0101] Explanation of reference numerals in the attached figures

[0102] 1... Anomaly detection device; 10... Input unit; 20... Output unit; 30... Arithmetic unit; 31... Time series signal collection unit; 32... Time series signal output unit; 33... Normal vector registration unit; 34... Trigger condition determination model generation unit; 35... Anomaly detection model registration unit; 36... Anomaly detection unit; 40... Storage unit; 41... Trigger condition determination model; 42... Normal database; 43... Anomaly detection model.

Claims

1. An anomaly determination device is used to determine anomalies in equipment performing a prescribed action, wherein, have: The time series signal cutout unit cuts out K times from two or more time series signals representing the operating state of the device during normal operation. The normal vector registration unit sets the types of two or more time series signals cut out by the time series signal cutting unit as M types, and forms an M-dimensional vector composed of M types of variables at the same time. The vector formed is registered as a normal vector. The anomaly detection model registration unit sets the anomaly detection flag to type 1 when the maximum value of the correlation between the variables is less than a specified value, and sets the anomaly detection flag to type 2 when the maximum value of the correlation between the variables is greater than the specified value. When the anomaly detection flag is type 2, principal component analysis is performed on the registered normal vector group to calculate the transformation coefficients of the principal components, and each of the calculated transformation coefficients of the principal components is registered as an anomaly detection model. as well as The anomaly determination unit determines the anomaly of the device. The anomaly detection unit performs the following actions: When determining the anomaly of the device, an M-dimensional vector is constructed from the time-series signals that are cut out in the same way as during normal operation. When the anomaly determination flag is type one, the distance to the registered normal vector is calculated, and a predetermined number of these normal vectors are extracted as neighbor data in ascending order of distance. The distance between the centroid vector of these neighbor data and the M-dimensional vector of the anomaly determination object is calculated, and the anomaly determination of the device is made based on the distance. When the anomaly determination flag is type two, the deviation from the principal components is calculated based on the pre-calculated transformation coefficients of the principal components, and the anomaly determination of the device is based on the deviation. The anomaly detection device also includes: A time-series signal collection unit collects time-series signals representing the operational state of the device and trigger candidate time-series signals, wherein the trigger candidate time-series signals determine the conditions for cutting out time-series signals representing the operational state from a predetermined monitoring target interval; and The trigger condition determination model generation unit, for the time series signal representing the operating state of the device, pre-determines the start time of the monitoring object interval to be cut out, generates label data that sets the label of the start time to ON and sets the labels of other times to OFF, and generates a trigger condition determination model through machine learning that takes the values ​​of one or more of the trigger candidate time series signals at each time as input and the label data at each time as output. The time series signal cutout unit cuts out the time series signal based on the trigger condition determination model when the device is operating normally or when an anomaly is determined.

2. The anomaly determination device according to claim 1, wherein, The triggering condition determines the model, which is a machine learning model that includes a decision tree.

3. The anomaly detection device according to claim 1 or 2, wherein, The anomaly determination unit determines whether the device needs maintenance based on the number of times the device is determined to be abnormal within a specified period.

4. An anomaly determination model generation method is a method for determining anomalies in equipment performing specified actions, wherein... include: The time series signal cutout process involves cutting out K times from two or more time series signals representing the operating state of the equipment during normal operation. In the normal vector registration process, the types of two or more time series signals cut out in the time series signal cutting-out process are set as M types, forming an M-dimensional vector composed of M types of variables at the same time, and the vector formed is registered as a normal vector. In the anomaly detection model registration process, if the maximum value of the correlation between the variables is less than a specified value, the anomaly detection flag is set to Type I; if the maximum value of the correlation between the variables is greater than the specified value, the anomaly detection flag is set to Type II; if the anomaly detection flag is Type II, principal component analysis is performed on the registered normal vector group, the transformation coefficients of the principal components are calculated, and each of the calculated transformation coefficients of the principal components is registered as an anomaly detection model. The time-series signal acquisition process collects time-series signals representing the operational state of the device and trigger candidate time-series signals, wherein the trigger candidate time-series signals determine the conditions for cutting out the time-series signals representing the operational state from a predetermined monitoring target interval; and The trigger condition determination model generation process involves, for the time series signal representing the operating state of the device, pre-determining the start time of the monitoring object interval to be cut out, generating label data that sets the label at the start time to ON and sets the labels at other times to OFF, and generating a trigger condition determination model through machine learning that takes the values ​​of at least one of the trigger candidate time series signals at each time as input and the label data at each time as output. The time series signal cutout process is based on the trigger condition determination model to cut out the time series signal.

5. An anomaly determination method, which uses an anomaly determination model generated by the anomaly determination model generation method described in claim 4 to determine anomalies in equipment performing specified actions, wherein... include: The time-series signal cutout process involves cutting out signals from two or more time-series signals representing the operating state of the device. and The anomaly detection process determines the anomaly of the equipment. The anomaly detection process performs the following actions: Determine whether the anomaly flag of the time series signal cut out during the time series signal cutting-out process is type one or type two. When the anomaly determination flag is type one, the distance to the registered normal vector is calculated, and a predetermined number of these normal vectors are extracted as neighbor data in ascending order of distance. The distance between the centroid vector of these neighbor data and the M-dimensional vector of the anomaly determination object is calculated, and the anomaly determination of the device is made based on the distance. When the anomaly determination flag is of type two, the deviation from the principal component is calculated based on the pre-calculated transformation coefficients of the principal component, and the anomaly determination of the device is made based on the deviation.

6. The anomaly determination method according to claim 5, wherein, The time series signal cutout process uses a trigger condition determination model generated by the anomaly determination model generation method described in claim 4 to cut out the time series signal.

7. An anomaly determination device is a device for determining anomalies in equipment performing a prescribed action, wherein... have: A time-series signal extraction unit extracts time-series signals from time-series signals representing the operating state of the device using two or more types of variables; and The anomaly detection unit, for the time series signals cut out by the time series signal extraction unit, sets the anomaly detection flag to type one if the maximum correlation between the variables is less than a predetermined value, and sets the anomaly detection flag to type two if the maximum correlation between the variables is greater than or equal to the predetermined value, thus forming an M-dimensional vector composed of the M variables at the same time from the M types of time series signals. When the anomaly determination flag is of type one, during normal operation of the device, the time series signal extraction unit extracts a time series signal representing the device's operating state as a normal vector. The distance to multiple registered normal vectors is calculated, and a predetermined number of these normal vectors are extracted as neighbor data in ascending order of distance. The distance between the centroid vector of these neighbor data and the M-dimensional vector of the anomaly determination object is calculated, and anomaly determination of the device is performed based on these distances. When the anomaly determination flag is type two, principal component analysis is performed on the registered normal vector group, and the deviation from the principal components is calculated based on the transformation coefficients of the registered principal components. Based on the deviation, the anomaly determination of the device is made. The time series signal extraction unit extracts the time series signal based on a trigger condition determination model generated through machine learning. The trigger condition determination model is generated by taking the time series signal representing the operation state of the device, pre-determining the start time of the monitoring object interval to be cut out, generating tag data that makes the tag at the start time ON and the tags at other times OFF, taking the values ​​of one or more trigger candidate time series signals at each time as input and the tag data at each time as output.

Images