Anomaly detection device and method, plant equipment system, feature information generation device and method, recording medium, and program product

Abstract

An anomaly detection device includes: a process data acquisition unit that acquires process data of a process having multiple process characteristics; and an anomaly detection unit that detects an abnormal state of the process based on anomaly degree, wherein the anomaly degree represents the difference between the acquired process data and the normal state of the process characterized by feature information, and the feature information characterizes the characteristics of the normal process data for each process characteristic. The feature information characterizing the normal state of the process is the optimal feature information for each process characteristic, searched by evaluating candidate feature information based on the error between estimated process data and normal process data calculated using candidate feature information, wherein the candidate feature information is generated according to each process characteristic based on multiple normal process data acquired when the process is in a normal state.

Description

Technical Field

[0001] This disclosure relates to an anomaly detection device for detecting anomalies in a process, a factory equipment system equipped with an anomaly detection device, a feature information generation device for generating feature information for anomaly detection, an anomaly detection method, a feature information generation method, and a program. Background Technology

[0002] Previously, a technique for estimating the values ​​of process data acquired during the operation of factory equipment has been proposed. In particular, when operations are based on operator experience or intuition, estimating the values ​​of unmeasured physical quantities or the values ​​of physical quantities acquired under planned operating conditions allows for a more accurate understanding of the process state. This estimation enables improvements to process operations and the detection of process anomalies.

[0003] For example, Patent Document 1 discloses an anomaly detection system that detects anomalies based on vibration waveform data of a target device. In the anomaly detection system of Patent Document 1, in order to determine the cause of the anomaly while detecting the anomalies, non-negative matrix factorization (hereinafter also referred to as "NMF") is used to decompose the vibration spectrum obtained from the observed vibration waveform data into the frequency components of the original signal source, and to extract the feature quantities of the vibration spectrum and detect the anomaly.

[0004] Existing technical documents

[0005] Patent documents

[0006] Patent Document 1: Japanese Patent Application Publication No. 2020-123229 Summary of the Invention

[0007] The problem the invention aims to solve

[0008] Here, in processes with various operating states, process data with different trends can be obtained from various sensors and command signals. In particular, processes in factory equipment (e.g., steel mill equipment, chemical plant equipment, power plant equipment, and energy plant equipment) exhibit the following characteristics: even when operating using the same equipment, the measured values ​​of temperature, pressure, etc., can vary significantly depending on the type of product, raw materials, composition, and changes in demand. In such processes, if the same estimation model is used to estimate the process data, the estimation error can sometimes increase depending on the operating state, and it may also fail to accurately detect anomalies occurring during the process.

[0009] Furthermore, in the steelmaking process data where various operations coexist, it is necessary to appropriately correlate multiple operational states with the data. If the data is subdivided only according to operational states, the estimation model becomes dominated by local data trends, leading to larger estimation errors. On the other hand, if the operational states are ignored and the data is roughly classified, the estimation model becomes dominated by data lacking feature information, also resulting in larger estimation errors. Therefore, in the estimation model of the steelmaking process, it is necessary to optimize the classification of data that appropriately captures the trends and characteristics of operational states. However, in the past, classification has been carried out through trial and error based on human judgment.

[0010] Therefore, this disclosure was made in view of the above-mentioned problems, and the purpose of this disclosure is to provide an anomaly detection device, a plant equipment system, a feature information generation device, an anomaly detection method, a feature information generation method, and a program capable of detecting anomalies occurring in a process having multiple process characteristics with high precision.

[0011] Solution for solving the problem

[0012] To address the aforementioned problems, this disclosure provides an anomaly detection device comprising: a process data acquisition unit that acquires process data of a process having multiple process characteristics; and an anomaly detection unit that detects an abnormal state of the process based on anomaly degree, wherein the anomaly degree represents the difference between the acquired process data and the normal state of the process characterized by feature information, the feature information characterizing the characteristics of the normal process data for each process characteristic, wherein the feature information characterizing the normal state of the process is the optimal feature information for each process characteristic searched by evaluating the error between the estimated process data and the normal process data calculated using the candidate feature information, wherein the candidate feature information is generated according to each process characteristic based on multiple normal process data acquired when the process is in a normal state.

[0013] Alternatively, the anomaly detection unit can use the feature matrix representing the features of the normal process data to factorize the matrix representing the acquired process data, thereby obtaining the coefficient matrix representing the feature information of the process data. The anomaly detection unit then calculates the anomaly degree based on the matrix representing the process data, the feature matrix, and the coefficient matrix.

[0014] Alternatively, the anomaly degree can be defined as the distance between the value of the process data and the hyperplane that characterizes the normal state of the process through feature information, where the feature information characterizes the features of the normal process data for each process characteristic.

[0015] Alternatively, the anomaly detection unit can calculate the deviation of the anomaly degree for each operating condition of the process data.

[0016] Furthermore, according to this disclosure, a factory equipment system is provided, comprising: factory equipment having a process having multiple process characteristics; and the aforementioned anomaly detection device, wherein the anomaly detection device calculates anomaly degree or represents the deviation degree of anomaly degree according to each operating condition of the process data, and controls the factory equipment based on the anomaly degree or deviation degree.

[0017] In addition, to solve the above problems, according to the present disclosure, a feature information generation apparatus is provided, comprising: a feature information generation unit that generates candidate feature information representing the features of the normal process data according to each process characteristic based on multiple normal process data acquired when a process having multiple process characteristics is in a normal state; and a search unit that evaluates the candidate feature information based on the error between the estimated process data calculated using the candidate feature information and the normal process data, thereby searching for the optimal feature information for each process characteristic.

[0018] Alternatively, the search unit can calculate the evaluation threshold based on the quartiles of the error, and evaluate the feature information based on the number of normal process data that exceed the evaluation threshold.

[0019] Alternatively, the search department can select the feature information with the smallest number of normal process data exceeding the evaluation threshold as the best feature information.

[0020] Furthermore, to address the aforementioned problems, this disclosure provides an anomaly detection method, comprising the following steps: a process data acquisition step, acquiring process data of a process having multiple process characteristics; and an anomaly detection step, detecting an abnormal state of the process based on anomaly degree, wherein the anomaly degree represents the difference between the acquired process data and the normal state of the process characterized by feature information, the feature information characterizing the characteristics of the normal process data of each process characteristic, wherein the feature information characterizing the normal state of the process is the optimal feature information for each process characteristic searched by evaluating the error between the estimated process data and the normal process data calculated using the candidate feature information, wherein the candidate feature information is generated according to each process characteristic based on multiple normal process data acquired when the process is in a normal state.

[0021] In addition, to solve the above problems, according to this disclosure, a feature information generation method is provided, including the following steps: a feature information generation step, which generates candidate feature information representing the features of normal process data according to each process characteristic based on multiple normal process data obtained when a process with multiple process characteristics is in a normal state; and a search step, which evaluates the candidate feature information based on the error between the estimated process data calculated using the candidate feature information and the normal process data, thereby searching for the best feature information for each process characteristic.

[0022] Furthermore, to address the aforementioned problems, according to this disclosure, a program is provided for enabling a computer to function as an anomaly detection device. The anomaly detection device comprises: a process data acquisition unit that acquires process data of a process having multiple process characteristics; and an anomaly detection unit that detects an abnormal state of the process based on an anomaly degree, wherein the anomaly degree represents the difference between the acquired process data and the normal state of the process characterized by feature information, the feature information characterizing the characteristics of the normal process data for each process characteristic, wherein the feature information characterizing the normal state of the process is the optimal feature information for each process characteristic searched by evaluating the error between the estimated process data and the normal process data calculated using the candidate feature information, and wherein the candidate feature information is generated according to each process characteristic based on multiple normal process data acquired when the process is in a normal state.

[0023] In addition, to solve the above problems, according to this disclosure, a program is provided for enabling a computer to function as a feature information generation device. The feature information generation device includes: a feature information generation unit that generates candidate feature information representing features of normal process data according to each process characteristic based on multiple normal process data acquired when a process having multiple process characteristics is in a normal state; and a search unit that evaluates the candidate feature information based on the error between the estimated process data calculated using the candidate feature information and the normal process data, thereby searching for the optimal feature information for each process characteristic.

[0024] The effects of the invention

[0025] As explained above, according to this disclosure, in a process having multiple process characteristics, abnormal states of the process are detected based on the degree of anomaly, which represents the difference between the normal state of the process characterized by feature information of each process characteristic and the process data. Therefore, anomalies occurring in the process can be detected with high precision. Attached Figure Description

[0026] Figure 1 It is a conceptual diagram showing the normal state of a process characterized by the best feature information obtained by each process characteristic.

[0027] Figure 2 This is a block diagram illustrating an example of the structure of the anomaly detection system involved in this disclosure.

[0028] Figure 3 This is a flowchart illustrating an outline of the feature information generation method involved in this disclosure.

[0029] Figure 4 This is a flowchart illustrating an example of a feature information generation method using NMF.

[0030] Figure 5 This is an explanatory diagram showing the past data matrix Y.

[0031] Figure 6 This is an explanatory diagram showing the relationship between the matrix product of the past data matrix Y and the coefficient matrix Φ with the operation state matrix X.

[0032] Figure 7 This is an illustrative diagram showing the relationship between the calculated Euclidean norm of the estimation error and the Euclidean norm of the estimation error, based on multiple normal process data used in generating candidate feature information.

[0033] Figure 8 This is a flowchart illustrating an outline of the anomaly detection method involved in this disclosure.

[0034] Figure 9 This is a flowchart illustrating an example of an anomaly detection method using NMF.

[0035] Figure 10 This is a conceptual diagram that uses vectors to represent the degree of deviation.

[0036] Figure 11 This is a numerical example used to illustrate the feature information generation method involved in this disclosure, showing an example of making the past data matrix Y approximate as the matrix product of the coefficient matrix Φ and the matrix X.

[0037] Figure 12 It is shown Figure 11 A chart of candidate feature information in the numerical examples.

[0038] Figure 13 This means that in Figure 11 The numerical example illustrates the calculation of the evaluation threshold.

[0039] Figure 14 This means that in Figure 11 The diagram illustrates the calculation of anomaly in the numerical example.

[0040] Figure 15 This is a block diagram illustrating an example of the hardware structure of an information processing apparatus that functions as a feature information generation device or anomaly detection device as disclosed herein. Detailed Implementation

[0041] The preferred embodiments of this disclosure will now be described in detail with reference to the accompanying drawings. Furthermore, in this specification and the drawings, constituent elements having substantially the same functional structure are omitted from repeated description by using the same reference numerals.

[0042] [1. System Structure]

[0043] The anomaly detection system disclosed herein is used to detect anomalies occurring during a process based on process data acquired from the process. The process in this disclosure is a process with multiple process characteristics. Process data refers to data obtained during process operation, such as equipment operating conditions, type of equipment, and measured values ​​using sensors. Process characteristics refer to the trends in the process data acquired during the process. For example, in processes like those in steel plant equipment, even when operating with the same equipment, the values ​​of process data can vary significantly depending on the process and the type of equipment used. For instance, in the mold-casting process of continuous casting equipment, the manner in which solidification anomalies occur in the solidified shell differs depending on the electromagnetic stirring conditions and the type of protective slag (powder). Such a process is referred to as a process with multiple process characteristics.

[0044] In the anomaly detection system disclosed herein, feature information characterizing the features of normal process data acquired when the process is in a normal state is generated as an indicator for detecting process anomalies. The feature information serving as the indicator is generated using normal process data acquired in past operations. For a given process characteristic, the optimal feature information characterizing the features of normal process data that should be obtainable within that process characteristic is generated and used as the feature information serving as the indicator.

[0045] An anomaly detection system, for example, acquires process data during the monitoring of whether anomalies have occurred in a process. The system detects abnormal states in the process based on the degree of anomaly of the process at the time the process data was acquired. Here, the degree of anomaly represents the extent to which the acquired process data deviates from the normal state of the process as characterized by generated feature information; it represents the difference between the process data and the normal state represented by feature information. The anomaly detection system determines the degree to which the process deviates from its normal state at the time the process data was acquired based on feature information corresponding to the process characteristics at the time of acquisition, thereby detecting process anomalies. In this way, in processes with multiple process characteristics, using feature information corresponding to the process characteristics of the acquired process data to detect process anomalies improves the accuracy of anomaly detection.

[0046] Figure 1 A conceptual diagram showing the normal state of a process characterized by the best feature information obtained by each process characteristic. Figure 1The conceptual diagram illustrates the normal state of a process with three process characteristics. Normal process data ND is divided into clusters c1, c2, and c3 based on each process characteristic. The anomaly detection system calculates the characteristic information representing the dominant features of the normal process data for each cluster c1, c2, and c3, obtaining a space representing the normal state of the process as a whole (normal space). The characteristic information of each cluster c1, c2, and c3 is defined by the direction vectors a1, a2, and a3 of the normal space. If the process data lies within the normal space spanned by direction vectors a1, a2, and a3, the process can be considered to be in a normal state. In other words, when the process data deviates from the normal space, the process is more likely to be in an abnormal state.

[0047] The anomaly detection system disclosed herein calculates anomaly degree d, which represents the degree to which the process data PD, the object of judgment, deviates from the hyperplane representing the boundary of the normal space by means of the minimum distance between the process data PD and the normal space. A larger anomaly degree d indicates that the process data PD deviates more from the normal space, and the greater the abnormal state of the process. Thus, in the anomaly detection system disclosed herein, feature information is used to represent a minimum-dimensional polyhedron for reasonably explaining the relationships between process data when the process is normal, thereby detecting process anomalies.

[0048] Below, based on Figure 2 The structure of the anomaly detection system 1 involved in this disclosure will be described. Figure 2 This is a block diagram illustrating an example of the structure of the anomaly detection system 1 involved in this disclosure. Figure 2 As shown, the anomaly detection system 1 disclosed herein includes a feature information generation device 100, an anomaly detection device 200, and a feature information storage unit 300.

[0049] [1-1. Feature Information Generation Device]

[0050] The feature information generation device 100 generates feature information that characterizes the features of normal process data acquired from process 10 when process 10, which has multiple process characteristics, is in a normal state. For example... Figure 2 As shown, the feature information generation device 100 includes a feature information generation unit 110 and a search unit 120.

[0051] (Feature Information Generation Department)

[0052] The feature information generation unit 110 generates candidate feature information representing the characteristics of normal process data based on multiple normal process data for each process characteristic. The feature information generation unit 110 obtains normal process data from the process data storage unit 30, which stores process data acquired in past operations. The feature information generation unit 110 also obtains candidate normal process data for generating feature information from the process data storage unit 30. The feature information generation unit 110 can obtain multiple process data acquired within a specified period, or it can obtain a specified number of process data.

[0053] The feature information generation unit 110 disclosed herein uses non-negative matrix factorization (NMF) to obtain feature information from the acquired normal process data. NMF is an algorithm that decomposes a non-negative matrix into the product of two non-negative matrices. The feature information generation unit 110 uses NMF to decompose the normal process data into non-negative matrices, thereby obtaining a matrix (hereinafter also called a "feature matrix") representing the feature information of each process characteristic. A detailed description of the feature information generation process will be provided later. The feature information generation unit 110 outputs candidate feature information of each acquired process characteristic to the search unit 120.

[0054] (Search Department)

[0055] The search unit 120 evaluates candidate feature information based on the error between the estimated process data calculated using candidate feature information and normal process data, thereby searching for the optimal feature information for each process characteristic. The search performed by the search unit 120 involves evaluating multiple candidate feature information and determining the optimal feature information. The optimal feature information sought represents the mainstream characteristics of the normal process data. That is, the search unit 120 searches for feature information that represents characteristics such that the process data obtained when the process is in a normal state conforms to this characteristic as much as possible. The search unit 120 evaluates the candidate feature information for each process characteristic in a comprehensive manner. That is, the search unit 120 evaluates multiple combinations of candidate feature information for each process characteristic and ultimately searches for the optimal feature information for each process characteristic. Thus, the optimal feature information for each process characteristic as a whole is determined.

[0056] The estimated process data is calculated based on candidate features obtained from normal process data, and is therefore considered to represent the normal process data. Thus, the error between the estimated process data and the normal process data indicates the degree to which the features represented by the candidate features used in calculating the estimated process data deviate from the features of the actual normal process data. The larger the error, the more the features represented by the candidate features deviate from the features of the normal process data.

[0057] The search unit 120, based on the error between the estimated process data and normal process data, sets an evaluation index and uses this evaluation threshold to evaluate candidate feature information. The evaluation threshold can be calculated, for example, based on the quartiles of the error between the estimated process data and normal process data. A quartile is the value at which data is divided into four equal parts when arranged in ascending order of value; from the smallest value, they are called the first quartile, the second quartile (i.e., the median), and the third quartile. The first quartile is the value at the 25th percentile of the whole, and the third quartile is the value at the 75th percentile. Quartiles are values ​​set based on the median, and are therefore useful for setting thresholds based on the mainstream features of the process data. Furthermore, quartiles are useful for understanding the deviation of data values ​​and are less susceptible to outliers. Therefore, the search unit 120 uses the quartiles of the error to set an evaluation threshold for distinguishing between normal process data and process data that deviates from normal process data.

[0058] For example, the search unit 120 may set the difference between the third quartile and the median, and the sum of the third quartiles, as the evaluation threshold. This evaluation threshold is a value that can be conceived as distinguishing most normal process data from normal process data. In other words, the fewer the number of normal process data whose errors exceed the evaluation threshold compared to the estimated process data calculated using candidate feature information, the more accurately the evaluation threshold can evaluate whether the process data is normal process data. The search unit 120 uses such an evaluation threshold to evaluate candidate feature information, thereby searching for candidate feature information with the smallest number of normal process data exceeding the evaluation threshold, and selecting this as the optimal feature information.

[0059] The search unit 120 records the best feature information of each process characteristic in the feature information storage unit 300.

[0060] [1-2. Anomaly Detection Device]

[0061] The anomaly detection device 200 uses the characteristic information of process 10 to detect abnormal states of process 10 based on process data that is the object of judgment. For example... Figure 2 As shown, the anomaly detection device 200 includes a process data acquisition unit 210 and an anomaly detection unit 220.

[0062] (Process Data Acquisition Department)

[0063] The process data acquisition unit 210 acquires process data that is the object of judgment. For example, the process data acquisition unit 210 may acquire process data obtained from sensors or other equipment during the operation of process 10 and set it as the process data to be judged, or it may acquire process data input from the terminal 500 and set it as the process data to be judged. The process data acquisition unit 210 outputs the acquired process data that is the object of judgment to the anomaly detection unit 220.

[0064] (Anomaly Detection Department)

[0065] The anomaly detection unit 220 detects abnormal states of process 10 based on anomaly degree, where the anomaly degree represents the difference between the acquired process data (the object of judgment) and the normal state of process 10 characterized by feature information, which represents the characteristics of the normal process data for each process characteristic. The anomaly degree is represented by the distance between the value of the process data (the object of judgment) and the hyperplane representing the normal state of process 10 using feature information, which also represents the characteristics of the normal process data for each process characteristic. A higher anomaly degree indicates that process 10 deviates more from its normal state when the process data (the object of judgment) is acquired, and the higher the probability of an anomaly occurring.

[0066] For example, when feature information is acquired using NMF, the anomaly detection unit 220 can factorize the matrix representing the process data to be judged using the feature matrix representing the feature information to obtain a coefficient matrix representing the feature information of the process data. These matrices are then used to calculate the error between the process data to be judged and the feature information, i.e., the anomaly degree. By using NMF, the anomaly degree can be automatically determined based on the feature information corresponding to the process characteristics of the process data to be judged, which are among the multiple process characteristics possessed by process 10. Furthermore, the anomaly detection unit 220 can also calculate the deviation degree representing the anomaly degree for each operating condition of the process data. A detailed explanation of the calculation and processing of the anomaly degree and deviation degree will be provided later.

[0067] The anomaly detection unit 220 may output the calculated anomaly degree to the terminal 500, for example. Alternatively, the anomaly detection unit 220 may output the deviation degree and the anomaly degree together to the terminal 500 if the deviation degree is calculated.

[0068] Additionally, the anomaly detection unit 220 can also determine whether the calculated anomaly level exceeds the evaluation threshold to perform anomaly detection in process 10. When the anomaly level exceeds the evaluation threshold, an anomaly may have occurred in process 10. In this case, the anomaly detection unit 220 can also notify the terminal 500 that an anomaly may have occurred in process 10.

[0069] Furthermore, terminal 500 is an information processing device for allowing users to input information and presenting information to them. Terminal 500 may also be, for example, a personal computer, a tablet computer, etc. Users can use terminal 500 to confirm the values ​​estimated by anomaly detection device 200, and if an anomaly exists in process 10, they can take measures to improve it.

[0070] The above describes a structural example of the anomaly detection system 1 disclosed herein. Furthermore, in Figure 2 The present invention illustrates an example in which the feature information generation apparatus 100, the anomaly detection apparatus 200, and the feature information storage unit 300 are configured with different devices, but this disclosure is not limited to this example. For example, at least two of the feature information generation apparatus 100, the anomaly detection apparatus 200, and the feature information storage unit 300 may be configured with a single device. For example, the anomaly detection apparatus 200 may also include the feature information generation unit 110 and the search unit 120 of the feature information generation apparatus 100 as a processing unit for generating feature information of the normal state of the characterization process. Alternatively, the feature information generation apparatus 100 may be configured with two or more devices, and the anomaly detection apparatus 200 may be configured with two or more devices.

[0071] Furthermore, programs can be created to implement the functions of the feature information generation unit 110 and search unit 120 of the feature information generation device 100, and the process data acquisition unit 210 and anomaly detection unit 220 of the anomaly detection device 200, and installed on a computer or the like. The computer executes the installed programs via its CPU (Central Processing Unit) to implement the functions of the feature information generation device 100 and the anomaly detection device 200. Additionally, a computer-readable recording medium storing such a program can be provided. Examples of recording media include disks, optical disks, magneto-optical disks, and flash memory. Alternatively, the program can be transmitted via, for example, a network without using a recording medium.

[0072] [2. Anomaly Detection in the Process]

[0073] In the anomaly detection system 1, the feature information generation device 100 executes a feature information generation method in which feature information characterizing the features of normal process data acquired from the normal process 10 is generated. The anomaly detection device 200 executes an anomaly detection method in which anomalies in the process 10 are detected using the feature information of the process 10 and based on the process data as the object of judgment. Both the feature information generation method and the anomaly detection method can be implemented by a computer executing a program including the steps described below. The feature information generation method and the anomaly detection method disclosed herein will now be described.

[0074] [2-1. Feature Information Generation Methods]

[0075] (2-1-1. Summary)

[0076] Figure 3 This is a flowchart illustrating a summary of the feature information generation method disclosed herein. In the feature information generation method disclosed herein, such as... Figure 3 As shown, firstly, the feature information generation unit 110 generates candidate feature information representing the features of the normal process data based on multiple normal process data for each process characteristic (S11: feature information generation step). Next, the search unit 120 evaluates the candidate feature information based on the error between the estimated process data and the normal process data calculated using the candidate feature information generated in step S11, thereby searching for the optimal feature information for each process characteristic (S13: search step).

[0077] More specifically, in the feature information generation method disclosed herein, as an example, nonnegative matrix factorization (NMF) is used to generate feature information. NMF is an algorithm that decomposes a nonnegative matrix into the product of two nonnegative matrices. By using NMF to decompose the normal process data used to generate feature information into nonnegative matrices, feature information of multiple process characteristics can be automatically obtained. Below, an example of a feature information generation method using NMF is described in detail.

[0078] (2-1-2. The NMF feature information generation method was adopted)

[0079] Figure 4 This is a flowchart illustrating an example of a feature information generation method using NMF. Furthermore, when using NMF, such as... Figure 5 As shown, matrix Y represents the past process data recorded in the process data storage unit 30. Matrix Y is a T-row, M-column matrix (Y∈R) of data items where the rows represent time and the columns represent past process data. (T，M) The values ​​of the data items in each row of matrix Y represent the values ​​of the process data acquired at each time point, corresponding to each time point. Hereinafter, matrix Y will also be referred to as the "past data matrix Y". Furthermore, the process data at each time point in the past data matrix Y does not need to be arranged in a time series. Additionally, the process data in the past data matrix Y can be acquired at equal intervals or at non-equal intervals. Moreover, the process data in the past data matrix Y can be continuous or discontinuous.

[0080] (S101: Initial value setting)

[0081] In the feature information generation method using NMF, such as Figure 4As shown, firstly, the feature information generation unit 110 sets the initial values ​​of the number of classifications N, the coefficient matrix Φ, and the operation state matrix X of the process data (S101).

[0082] The number of classes, N, is the number of classes used to classify process data. The initial and upper limits of the number of classes, N, can be set arbitrarily. For example, the initial value of N can be set to N0=2, and the upper limit can be set to N0=2. max =10.

[0083] like Figure 6 As shown, the coefficient matrix Φ and the operational state matrix X are nonnegative matrices generated by decomposing the past data matrix Y using NMF. The coefficient matrix Φ is a T-row, N-column matrix (Φ∈R) where the rows represent time and the columns represent the classification (i.e., classes) of the process data. (T，N) The coefficient matrix Φ is also called the characteristic matrix. The operation state matrix X is an N-row, M-column matrix (Φ∈R) that shows the categories of process data in rows and the data items of process data in columns. (N，M) The operation state matrix X is also called the characteristic matrix. The initial values ​​of the coefficient matrix Φ and the operation state matrix X can also be set randomly, for example.

[0084] Additionally, as an initial setting, the feature information generation unit 110 sets an upper limit value for the number of trials L. For example, it can also be set to an upper limit value L for the number of trials. max =100. Furthermore, the number of trials L is set to start from 1.

[0085] (S103: Generation of feature information)

[0086] Next, when the feature information generation unit 110 acquires past process data recorded in the process data storage unit 30, it uses NMF to approximate the past data matrix Y representing the past process data as the matrix product of the coefficient matrix Φ and the operation state matrix X (Y≈Φ·X) (S103). Here, the past process data is set as the normal process data acquired when the process is in a normal state.

[0087] The coefficient matrix Φ is generally composed of, for example, Figure 6 The diagram shows a sparse matrix structure. Each row of the coefficient matrix Φ is set as a matrix element Φ. j When (j=1,…,T), the feature information generation unit 110 modifies the value of the data item with the matrix element Φ. j Scalar product is used to establish associations for classification (clustering). In this case, the matrix element Φ... j This represents the contribution of each process characteristic at each time point. That is, the matrix element Φ jEach column of the matrix represents a class corresponding to a process characteristic. Furthermore, the operation state matrix X shows the characteristics of time-invariant process data values ​​that are independent of time. The operation state matrix X can be considered as feature information characterizing the characteristics of normal process data obtained from process 10. Each row of the operation state matrix X shows a direction vector representing the feature information of normal process data with the same process characteristics. The feature information characterizing each process characteristic of process 10 is, for example,... Figure 1 The direction vectors a1, a2, and a3 shown indicate the proportional relationship of normal process data in each process characteristic.

[0088] Furthermore, the matrix elements Φ of the coefficient matrix Φ obtained using NMF j In this matrix, each column represents a class corresponding to a process characteristic; therefore, it can be said that process data belongs to the class of the column with the maximum value. Thus, it can be seen that in the matrix elements Φ of the coefficient matrix Φ... j The data at each moment is displayed as belonging to a class, thus enabling the automatic determination of each process characteristic.

[0089] When past normal process data is represented by the matrix product of the coefficient matrix Φ and the operation state matrix X, the feature information generation unit 110 outputs the coefficient matrix Φ and the operation state matrix X to the search unit 120. At this time, the operation state matrix X output from the feature information generation unit 110 to the search unit 120 is a candidate for feature information.

[0090] (S105-S121: Optimal search for feature information)

[0091] Next, the search unit 120 evaluates the candidate feature information input from the feature information generation unit 110 to search for the best feature information. The search unit 120 evaluates the candidate feature information based on the error between the estimated process data calculated using the candidate feature information and the normal process data.

[0092] Specifically, firstly, the search unit 120 calculates the error between the estimated process data calculated using the feature information and the normal process data, and calculates the Euclidean norm value for each row of the matrix (S105). The error between the estimated process data and the normal process data is represented by the difference (Y-Φ·X) between the matrix products of the past data matrix Y and the coefficient matrix Φ and the operation state matrix X. The search unit 120 calculates the Euclidean norm value for each row of the matrix representing this error. The Euclidean norm value represents the magnitude of the vector data shown in each row; the larger the value, the larger the value of the vector data shown in each row.

[0093] The search unit 120 calculates an evaluation threshold (S107) based on the calculated Euclidean norm value to determine whether the candidate feature information appropriately represents the mainstream characteristics of the normal process data. In this example, the search unit 120 calculates the evaluation threshold based on the quartiles of the estimated error between the process data and the normal process data. As mentioned above, the quartiles are values ​​set based on the median, and therefore are useful for setting thresholds based on the mainstream characteristics of the process data. For example, the search unit 120 calculates the difference between the third quartile and the median, and the sum of the third quartiles, as the evaluation threshold. This evaluation threshold refers to a value that can be envisioned as distinguishing most of the normal process data from the normal process data.

[0094] Then, the search unit 120 uses the evaluation threshold calculated in step S107 to evaluate the candidates for feature information. Specifically, the search unit 120 calculates the number of Euclidean norm values ​​calculated in step S105 that exceed the evaluation threshold (hereinafter also referred to as "the number of records exceeding the threshold") (S109), and evaluates the candidates for feature information based on the number of records exceeding the threshold (S111).

[0095] exist Figure 7 The diagram illustrates the relationship between the calculated Euclidean norm of the estimation error and the Euclidean norm of the estimation error for multiple normal process data used in generating candidate feature information. Figure 7 In the example, among a subset of normal process data, there are records where the Euclidean norm of the estimation error exceeds the evaluation threshold. The evaluation threshold is the value that distinguishes most of the normal process data from the normal process data. Therefore, if the candidate feature information correctly represents the characteristics of the normal process data, the Euclidean norm of the estimation error will be below the evaluation threshold for all records.

[0096] In other words, records where the Euclidean norm of the estimation error exceeds the evaluation threshold signify deviations from the characteristics of the candidate feature information representing normal process data. That is, records exceeding the threshold are normal process data that, despite being normal process data, are judged to deviate from normal process data according to the evaluation threshold. Records exceeding the threshold can also be described as process data that has been overprobeed as being acquired during a process anomaly, based on the evaluation threshold. Therefore, it can be evaluated that the fewer records exceeding the threshold, the more accurately the candidate feature information used in the calculation of the evaluation threshold represents the characteristics of normal process data.

[0097] Therefore, in step S111, the search unit 120 determines whether the minimum value has been updated for the number of records exceeding the threshold, thereby evaluating whether the candidate feature information to be evaluated this time better represents the mainstream characteristics of normal process data compared with the previously evaluated feature information. If the minimum value has been updated for the number of records exceeding the threshold (S111: "Yes"), the search unit 120 maintains the number of classifications N, the operation state matrix X, and the evaluation threshold for the current process data (S113). On the other hand, if the minimum value has not been updated for the number of records exceeding the threshold (S111: "No"), the search unit 120 proceeds to step S115.

[0098] When the search unit 120 finishes processing up to step S113, it determines whether the number of trials L has reached the upper limit value L of the number of trials. max (S115). The number of trials L has not reached the upper limit of the number of trials L. max If the condition is not met (S115: "No"), the search unit 120 changes the coefficient matrix Φ and the operation state matrix X (S117), and increments the trial count L by 1 (S119). After that, the processing steps S103 to S115 are repeated.

[0099] On the other hand, when the number of trials L becomes the upper limit value of the number of trials L max In the case of (S115: "Yes"), the search unit 120 determines whether the number of categories N of the process data has reached the upper limit value N of the number of categories. max (S121). The number of categories N in the process data has not reached the upper limit value N. max If the condition is not met (S121: "No"), the search unit 120 changes the coefficient matrix Φ and the operation state matrix X (S123), resets the number of trials L to 1, and increments the number of classifications N by 1 (S125). Then, the processing steps S103 to S121 are repeated.

[0100] Then, the number of categories N in the process data becomes the upper limit value N of the number of categories. max In the case of (S121: "Yes"), the search unit 120 stores the currently held operation state matrix X, number of categories N, and evaluation threshold as the optimal operation state matrix X, number of categories N, and evaluation threshold in the feature information storage unit 300 (S127). The optimal operation state matrix X is the best feature information searched from the candidate feature information.

[0101] The above describes an example of the feature information generation method using NMF (Non-Negative Matrix Modeling) disclosed herein. According to this disclosure, by employing NMF to decompose the normal process data used to generate feature information into a non-negative matrix, feature information representing multiple process characteristics can be automatically obtained. Furthermore, in large-scale systems, the types of process data obtained during process operation, such as equipment operating conditions, equipment type, and measured values ​​from sensors, are numerous, and the operating state matrix X represented by these process data may not be uniquely determined. In such large-scale systems, it is meaningful to obtain the optimal operating state matrix X through searching, as described in the feature information generation method of this disclosure.

[0102] [2-2. Anomaly Detection Methods]

[0103] (2-2-1. Summary)

[0104] Figure 8 This is a flowchart illustrating an outline of the anomaly detection method disclosed herein. In the anomaly detection method disclosed herein, such as... Figure 8 As shown, firstly, the process data acquisition unit 210 acquires process data that is the object of judgment (S21: process data acquisition step). Next, the anomaly detection unit 220 detects the abnormal state of process 10 based on the anomaly degree (S23: anomaly detection step), wherein the anomaly degree represents the difference between the acquired process data that is the object of judgment and the normal state of process 10 characterized by feature information, which characterizes the features of the normal process data of each process characteristic.

[0105] Here, the characteristic information of the normal state of the characterization process can be obtained through the above... Figure 3 The feature information generation method shown is used to obtain the feature information. That is, the feature information representing the normal state of the process (the feature information representing the features of the normal process data of each process characteristic mentioned above) is the optimal feature information for each process characteristic searched by using the candidate feature information to evaluate the error between the estimated process data and the normal process data. The candidate feature information is generated according to each process characteristic based on multiple normal process data obtained when the process is in a normal state.

[0106] More specifically, in the anomaly detection method disclosed herein, as an example, the distance between the hyperplane representing the normal state of process 10, obtained through nonnegative matrix factorization (NMF), and the value of the obtained process data is calculated as the anomaly degree. By employing NMF, the anomaly degree can be automatically determined based on the feature information corresponding to the process characteristics of the process data being judged, among the multiple process characteristics possessed by process 10. An example of an anomaly detection method employing NMF will be described in detail below.

[0107] (2-2-2. The NMF anomaly detection method was adopted)

[0108] Figure 9 This is an example of a flowchart illustrating an anomaly detection method using NMF.

[0109] (S200: Process Data Acquisition)

[0110] First, the process data acquisition unit 210 acquires process data (S200) that is used to determine the degree of abnormality in order to detect abnormalities in process 10. The process data acquisition unit 210 may acquire process data obtained during the operation of process 10 and set it as the process data to be determined, or it may acquire process data input from the terminal 500 and set it as the process data to be determined. The process data acquisition unit 210 outputs the acquired process data to be determined to the abnormality detection unit 220.

[0111] (S210-S250: Anomaly Detection and Handling)

[0112] The anomaly detection unit 220 calculates the anomaly degree based on the acquired process data that is the object of judgment, thereby detecting the abnormal state of process 10.

[0113] First, the anomaly detection unit 220 obtains the feature information of the process 10 from the feature information storage unit 300 (S210). Specifically, for the process 10, the anomaly detection unit 220 obtains the optimal operation state matrix X, the number of categories N, and the evaluation threshold generated by the feature information generation device 100 from the feature information storage unit 300.

[0114] Next, the anomaly detection unit 220 uses NMF (Non-Functional Multiplication) to calculate the coefficient matrix φ (S220) based on the classification number N and operation state matrix X obtained in step S210, and the process data matrix y, which shows the process data as the judgment object obtained in step S200. Here, the process data matrix y is a 1-row, M-column matrix (y∈R) arranged with the values ​​of the data items. (1，M) The coefficient matrix φ is composed of matrix elements Φ that make up the coefficient matrix Φ.j Any matrix element in (j=1,…,T) corresponds to a 1xN matrix (φ∈R). (1，N) ).

[0115] The coefficient matrix φ is determined by the input process data matrix y and the operation state matrix X. Once the coefficient matrix φ is determined, the anomaly detection unit 220 can determine the class to which the process data being estimated belongs based on the column with the maximum value. By determining the class to which the process data being estimated belongs, its process characteristics can be determined. The anomaly detection unit 220 calculates the coefficient matrix φ, representing the characteristic information of the process data, by approximating the process data matrix y as the matrix product of the coefficient matrix φ and the operation state matrix X, which serves as the characteristic matrix (y≈φ·X).

[0116] Furthermore, since NMF is used in this example, the coefficient matrix φ needs to be a non-negative matrix. To ensure that the coefficient matrix φ is non-negative, instead of multiplying both sides of the matrix product of the coefficient matrix φ and the operational state matrix X (y≈φ·X) by the pseudo-inverse of the operational state matrix X from the right, a method is used to approximate the process data matrix y as the matrix product of the coefficient matrix φ and the operational state matrix X.

[0117] Next, the anomaly detection unit 220 calculates the absolute value of the reconstruction error (|y-φ·X|) as the anomaly degree (S230). The anomaly degree, represented by the reconstruction error, shows the distance between the hyperplane (φ·X) characterizing the normal state of process 10 and the value of the process data (y) as the judgment object. Then, the anomaly detection unit 220 determines whether the calculated anomaly degree exceeds the evaluation threshold obtained in step S210 (S240). If the anomaly degree is below the evaluation threshold (S240: "No"), the anomaly detection unit 220 determines that the process data as the judgment object is normal process data and no anomaly has occurred in process 10, thereby ending the process. Figure 9 The processing shown.

[0118] On the other hand, if the anomaly level exceeds the evaluation threshold (S240: "Yes"), the anomaly detection unit 220 evaluates the process data to be judged as not being normal process data, and thus determines that an anomaly may have occurred in process 10. At this time, the anomaly detection unit 220 notifies the terminal 500 that an anomaly may have occurred in process 10 (S250).

[0119] At this time, the anomaly detection unit 220 can also notify the terminal 500 of the deviation degree, which represents the anomaly degree for each operating condition of the process data, along with the anomaly degree. The deviation degree can also be represented, for example, by the reconstruction error (y-φ·X). The reconstruction error is obtained by representing the anomaly degree as a component for each data item, thus enabling the identification of the operating conditions in the process data that are the main cause of the increased anomaly degree.

[0120] Alternatively, the deviation can also be represented, for example, by a vector from the center of gravity of the normal process data to the process data being judged. In this case, the center of gravity of the normal process data is defined as the center of gravity of the normal process data that has the same process characteristics as the process data being judged. Figure 10 The diagram shows a concept map where deviation is represented by vectors. For example... Figure 10 As shown, when the process data PD, which is the object of judgment, has the same process characteristics as the normal process data ND of cluster c3, the anomaly detection unit 220 sets the mean of the normal process data ND of cluster c3 as the centroid G, and calculates the vector from the centroid G to the process data PD as the deviation degree. Alternatively, the magnitude of this vector can be set as the anomaly degree d.

[0121] The above describes one example of an anomaly detection method using NMF as described in this disclosure.

[0122] [2-3. Numerical Examples]

[0123] To illustrate the feature information generation method and anomaly detection method disclosed herein, a simple example is used. In this example, two operational conditions (y1, y2) are used as data items in a process data matrix. First, based on... Figure 4 The feature information generation method shown employs NMF to obtain the optimal feature information representing the normal state of the process from past normal process data. Here, the normal process data shown in Table 1 below is used to obtain the optimal feature information.

[0124] [Table 1]

[0125]

[0126] To obtain the optimal feature information, firstly, the normal process data in Table 1 above is represented by a past data matrix Y. In this example, the past data matrix Y is a T-row, M-column matrix (Y∈R) where the rows show the inherent numbers corresponding to the time when the process data was obtained (T=7) and the columns show the operating conditions (y1, y2) (M=2). (T，M) Then, the past data matrix Y is approximated as the matrix product of the coefficient matrix Φ and the operational state matrix X (Y≈Φ·X). For example, when the number of categories N=2 and NMF is used to approximate the input data matrix Y as the matrix product of the coefficient matrix Φ and the operational state matrix X (Y≈Φ·X), it is possible to achieve the following: Figure 11 As shown. Here, Figure 11 The coefficient matrix Φ and the operation state matrix X shown are obtained using... Figure 4 The optimal feature information is obtained by the feature information generation method.

[0127] Each row of the operational state matrix X, which serves as the feature matrix, represents the direction vector of characteristic information for normal process data with the same process characteristics. That is, as... Figure 12 As shown, the following cases are illustrated: data for No. 1 and No. 2 are taken from the line L1 of the direction vector (2,1), while data for No. 3 to No. 7 are taken from the line L2 of the direction vector (3,1). Furthermore, the matrix elements Φ of the coefficient matrix Φ obtained using NMF... j In this matrix, each column represents a class corresponding to a process characteristic; therefore, it can be said that process data belongs to the class of the column with the maximum value. Thus, it can be seen that in the matrix element Φ of the coefficient matrix Φ... j The system can display the class to which the process data belongs at each moment, thereby automatically determining the characteristics of each process.

[0128] In the feature information generation method disclosed herein, the past data matrix Y is approximated by the matrix product (Y≈Φ·X) of various coefficient matrices Φ and operation state matrix X to generate candidate feature information and search for the best feature information. For example Figure 12 As shown, among the candidate feature information, there are feature information composed of the direction vectors of line C1 and line C2, and feature information composed of the direction vectors of line D1 and line D2, etc. From these various feature information representing normal process data, we search for feature information that appropriately represents the mainstream characteristics of the normal process data to select the optimal feature information.

[0129] In addition, in order to calculate the evaluation threshold of the best feature information found, for example Figure 13 As shown, the difference (Y - Φ·X) between the matrix products of the past data matrix Y and the coefficient matrix Φ and the operational state matrix X is taken, and the Euclidean norm value is calculated for each row. Then, for example, the quartiles of each Euclidean norm value are used to calculate the evaluation threshold. Figure 13 As shown, the Euclidean norm values ​​for data No. 1 to No. 7 are 0.0, 1.0, 1.4, 2.0, 2.0, 2.3, and 3.0, respectively, with a median of 2.0. For example, if the difference between the third quartile and the median, plus the sum of the third quartile values, is set as the evaluation threshold, then the evaluation threshold is 2.3 + 0.3 = 2.6. Furthermore, in this example, the number of records with Euclidean norm values ​​exceeding the evaluation threshold is 1.

[0130] Then, based on the obtained optimal feature information, based on Figure 9The anomaly detection method shown calculates the anomaly degree of the process at a specific time point based on process data acquired at that time. For example, suppose process data is acquired with operating conditions y1=180 and y2=95. In this case, when using a 1xM process data matrix y (showing the acquired process data) and an operating state matrix X (obtained as the best feature information) to calculate the coefficient matrix φ, as shown... Figure 14 As shown, we obtain a coefficient matrix φ with 1 row and 2 columns, where φ1=90 and φ2=0.

[0131] Next, the reconstruction error (y - φ·X) is calculated, and its absolute value (|y - φ·X|) is used as the outlier. The reconstruction error is obtained by representing the outlier as a component for each data item, also known as the deviation. For example, in Figure 14 As shown in the example, the reconstruction error (deviation) is 0 for operating condition y1, indicating no deviation from the normal state, but it is 5 for operating condition y2, indicating a deviation from the normal state. In this case, the absolute value of the reconstruction error is 5.

[0132] In addition, it can also be done through Figure 10 The deviation is represented by the vector of process data from the centroid of the normal process data as the judgment object. In this case, the process data matrix y has the same process characteristics as No.1 and No.2, so the deviation can be calculated by setting the average vector (180 90.25) of No.1 and No.2 as the centroid G. At this time, the deviation is (04.75) (=(180 95)-(180 90.25)).

[0133] Thus, by using the feature information generation method and anomaly detection method disclosed herein, and employing NMF to decompose the normal process data used to generate feature information into a non-negative matrix, feature information of multiple process characteristics can be automatically obtained. Furthermore, based on the feature information corresponding to the process characteristics at the time the process data was acquired, the degree to which the process deviated from its normal state at the time the process data was acquired can be determined, thereby detecting process anomalies. Therefore, without clustering the process data based on process characteristics, anomalies can be detected using the feature information corresponding to the process characteristics of the acquired process data, enabling high-precision anomaly detection.

[0134] [3. Hardware Structure]

[0135] based on Figure 15 The hardware structure of the feature information generation device 100 and the anomaly detection device 200 involved in this disclosure will be described. Figure 15 This is a block diagram illustrating an example of the hardware structure of an information processing device 900 that functions as a feature information generation device 100 or an anomaly detection device 200 as disclosed herein.

[0136] The information processing device 900 includes one or more hardware processors such as a CPU 901, one or more memories such as RAM (Random Access Memory) 905 and ROM (Read Only Memory) 903, and performs various operations by executing one or more programs stored in the memories through the one or more hardware processors. In addition, the information processing device 900 includes a bus 907, input I / F 909, output I / F 911, a storage device 913, a driver 915, a connection port 917, and a communication device 919.

[0137] For example, the CPU 901 functions as both an arithmetic processing unit and a control unit. The CPU 901 controls all or part of the operations within the information processing unit 900 according to various programs recorded in the ROM 903, RAM 905, storage device 913, or removable recording medium 925. The ROM 903 stores the programs or arithmetic parameters used by the CPU 901. The RAM 905 temporarily stores the programs used by the CPU 901, or parameters that change appropriately during program execution. They are interconnected via a bus 907, which is composed of internal buses such as the CPU bus. The bus 907 is connected to external buses such as the PCI (Peripheral Component Interconnect / Interface) bus and PCI Express (registered trademark) via a bridge.

[0138] In addition to being implemented through the CPU 901, the computing and control devices can also be implemented through a PLC (Programmable Logic Controller) or dedicated hardware such as an ASIC (Application Specific Integrated Circuit).

[0139] Input I / F 909 is, for example, an interface that accepts input from input devices 921, such as mice, keyboards, touch panels, buttons, switches, and joysticks, which are operation units for user operation. Input I / F 909 is configured, for example, to generate input signals based on information input by the user using input device 921 and output them to CPU 901, etc. Input device 921 may also be, for example, a remote control device utilizing infrared or other radio waves, or an external device 927 such as a PDA that supports the operation of information processing device 900. The user of information processing device 900 can operate input device 921 to input various data or instruct processing actions to information processing device 900.

[0140] Output I / F 911 is an interface that outputs the input information to an output device 923 capable of notifying the user visually or audibly. The output device 923 may be, for example, a CRT display, a liquid crystal display, a plasma display, an EL display, or a lamp. Alternatively, the output device 923 may be a sound output device such as a speaker or headphones, a printer, a mobile communication terminal, or a fax machine. Output I / F 911 instructs the output device 923 to output, for example, the processing results obtained through various processes performed by the information processing device 900. Specifically, output I / F 911 instructs a display device to display the processing results of the information processing device 900 in the form of text or images. Additionally, output I / F 911 instructs a sound output device to convert audio signals, such as sound data received with a playback instruction, into analog signals and output them.

[0141] Storage device 913 is one of the storage units of information processing device 900 and is a device for data storage. Storage device 913 is a non-transitory tangible computer-readable recording medium. Storage device 913 may be composed of, for example, magnetic storage devices such as HDD (Hard Disk Drive), semiconductor storage devices such as SSD (Solid State Drive), optical storage devices, or magneto-optical storage devices. Storage device 913 stores programs executed by CPU 901, various data generated by executing programs, and various data acquired from external sources.

[0142] The driver 915 is a reader / writer for recording media, either built into or externally connected to the information processing device 900. The driver 915 reads information recorded on the installed removable recording medium 925 and outputs this information to the RAM 905. Additionally, the driver 915 can also write information to the installed removable recording medium 925. The removable recording medium 925 can be, for example, a magnetic disk, optical disk, magneto-optical disk, or semiconductor memory. Specifically, the removable recording medium 925 can also be a CD medium, DVD medium, Blu-ray disc, compact flash memory (CF), flash memory, SD memory card (Secure Digital Memory Card), etc. Furthermore, the removable recording medium 925 can also be, for example, an IC card (Integrated Circuit Card) or an electronic device equipped with a contactless IC chip.

[0143] Connection port 917 is a port used to directly connect devices to information processing device 900. Connection port 917 can be, for example, a USB (Universal Serial Bus) port, an eSATA (external Serial Advanced Technology Attachment) port, or a SAS (Serial Attached SCSI (Small Computer System Interface)) port. Information processing device 900 can directly obtain various data from external device 927 connected to connection port 917, or provide various data to external device 927. For example, alarm notification devices such as rotating lights used to notify alarm information can also be connected via connection port 917. Additionally, NAS (Network Attached Storage) can also be connected as external device 927 for use as a storage device.

[0144] The communication device 919 is, for example, a communication interface composed of communication equipment for connecting to the communication network 929. The communication device 919 may be a communication card for wired or wireless LAN (Local Area Network), Bluetooth (registered trademark), or WUSB (Wireless USB). Alternatively, the communication device 919 may be a router for optical communication, a router for ADSL (Asymmetric Digital Subscriber Line), or various communication modems. The communication device 919 can, for example, send and receive signals with the Internet and other communication devices according to protocols such as TCP / IP. For example, a computer used to operate the information processing device 900 can be connected via the communication device 919. Furthermore, the communication network 929 connected to the communication device 919 is composed of a network connected via wired or wireless means. For example, the communication network 929 may be the Internet, a home LAN, infrared communication, radio wave communication, or satellite communication.

[0145] The above illustrates an example of the hardware structure of the information processing apparatus 900. The aforementioned components can be constructed using general-purpose components or using hardware specifically designed for the functions of each component. The hardware structure of the information processing apparatus 900 can be appropriately modified depending on the technological level at the time of implementing this disclosure.

[0146] The preferred embodiments of this disclosure have been described in detail above with reference to the accompanying drawings, but this disclosure is not limited to these examples. Anyone skilled in the art to which this disclosure pertains will readily recognize that various modifications or alterations can be conceived within the scope of the technical concept set forth in the claims, and will understand that such modifications or alterations naturally fall within the technical scope of this disclosure as well.

[0147] For example, the anomaly detection device may not be installed in an anomaly detection system that detects anomalies occurring during a process, but rather in a factory equipment system with factory equipment having processes and multiple process characteristics. The factory equipment system includes, for example, factory equipment in steel mills, chemical plants, power plants, and energy plants, which have various operating conditions. The processes of the factory equipment are controlled by a control device equipped with a processor that controls the factory equipment. This factory equipment system can use the anomaly detection device to calculate the degree of anomaly or deviation. In the factory equipment system, the factory equipment is controlled based on the calculated degree of anomaly or deviation.

[0148] For example, by changing the operating conditions of factory equipment, such as the amount of operation or the type of equipment being operated, process data changes. Because the process data input to the anomaly detection device changes, the anomaly degree and deviation degree output by the anomaly detection device change accordingly. Therefore, according to this disclosure, the anomaly degree can be reduced by appropriately changing the operating conditions of the factory equipment under equipment constraints. Furthermore, the operating conditions of the factory equipment that are the main cause of increased anomaly degree can be determined based on the deviation degree output from the anomaly detection device. By appropriately changing the identified operating conditions that are the main cause of increased anomaly degree under equipment constraints, the deviation degree can be reduced, and consequently, the anomaly degree can be reduced.

[0149] In this way, the factory equipment system controls the factory equipment based on the degree of anomaly or deviation calculated by the anomaly detection device. For example, the factory equipment system changes the operating conditions of the process, such as changing the operating equipment, to control the factory equipment to ensure the process operates normally. As a result, damage to the factory equipment can be prevented.

[0150] In addition, the following structures are also included within the scope of this disclosure.

[0151] (1) An anomaly detection device, comprising:

[0152] A process data acquisition unit acquires process data of a process having multiple process characteristics; and

[0153] An anomaly detection unit detects abnormal states in the process based on anomaly degree, wherein the anomaly degree represents the difference between the acquired process data and the normal state of the process characterized by feature information, and the feature information characterizes the features of the normal process data for each process characteristic.

[0154] The feature information characterizing the normal state of the process is the optimal feature information for each process characteristic searched by evaluating the candidate of the feature information based on the error between the estimated process data calculated using the candidate of the feature information and the normal process data. The candidate of the feature information is generated according to each process characteristic based on multiple normal process data obtained when the process is in a normal state.

[0155] (2) According to the anomaly detection device described in (1) above, wherein,

[0156] The anomaly detection unit uses a feature matrix representing the features of normal process data characterizing the process to factorize the matrix representing the acquired process data, thereby obtaining a coefficient matrix representing the feature information of the process data.

[0157] The anomaly detection unit calculates the anomaly degree based on the matrix representing the process data, the feature matrix, and the coefficient matrix.

[0158] (3) The anomaly detection device according to (1) or (2) above, wherein,

[0159] The anomaly degree is the distance between the value of the process data and the hyperplane that characterizes the normal state of the process through feature information, wherein the feature information characterizes the features of the normal process data for each process characteristic.

[0160] (4) The anomaly detection device according to (3) above, wherein,

[0161] The anomaly detection unit calculates the deviation of the anomaly degree according to each operating condition of the process data.

[0162] (5) The anomaly detection device according to any one of (1) to (4) above, wherein,

[0163] The anomaly detection device includes a processing unit for generating feature information characterizing the normal state of the process.

[0164] The processing unit has:

[0165] A feature information generation unit generates candidate feature information representing features of the normal process data for each process characteristic, based on multiple normal process data acquired when a process with multiple process characteristics is in a normal state; and

[0166] The search unit evaluates the candidates of the feature information based on the error between the estimated process data calculated using the candidate feature information and the normal process data, thereby searching for the best feature information for each of the process characteristics.

[0167] (6) The anomaly detection device according to (5) above, wherein,

[0168] The search unit calculates the evaluation threshold based on the quartiles of the error.

[0169] The search unit evaluates the feature information based on the number of normal process data that exceed the evaluation threshold.

[0170] (7) The anomaly detection device according to (6) above, wherein,

[0171] The search unit searches for the feature information with the smallest number of normal process data exceeding the evaluation threshold, and uses this as the optimal feature information.

[0172] (8) A factory equipment system comprising: factory equipment having a process having a plurality of process characteristics; and an anomaly detection device according to any one of (1) to (7) above.

[0173] The anomaly detection device calculates the anomaly degree or the deviation of the anomaly degree according to each operating condition of the process data, and controls the factory equipment based on the anomaly degree or the deviation.

[0174] (9) An anomaly detection method, comprising the following steps:

[0175] The process data acquisition step involves acquiring process data for a process, wherein the process has multiple process characteristics; and

[0176] The anomaly detection step detects abnormal states of the process based on anomaly degree, where the anomaly degree represents the difference between the acquired process data and the normal state of the process characterized by feature information, and the feature information characterizes the features of the normal process data for each process characteristic.

[0177] The feature information characterizing the normal state of the process is the optimal feature information for each process characteristic searched by evaluating the candidate of the feature information based on the error between the estimated process data calculated using the candidate of the feature information and the normal process data. The candidate of the feature information is generated according to each process characteristic based on multiple normal process data obtained when the process is in a normal state.

[0178] (10) According to the anomaly detection method described in (9) above, wherein,

[0179] In the anomaly detection step,

[0180] By using the feature matrix representing the features of normal process data characterizing the process, the matrix representing the acquired process data is factored to obtain the coefficient matrix representing the feature information of the process data.

[0181] The anomaly degree is calculated based on the matrix representing the process data, the feature matrix, and the coefficient matrix.

[0182] (11) According to the anomaly detection method described in (9) or (10) above, wherein,

[0183] The anomaly degree is the distance between the value of the process data and the hyperplane that characterizes the normal state of the process through feature information, wherein the feature information characterizes the features of the normal process data for each process characteristic.

[0184] (12) According to the anomaly detection method described in (11) above, wherein,

[0185] In the anomaly detection step, the deviation of the anomaly degree is calculated according to each operating condition of the process data.

[0186] (13) The anomaly detection method according to any one of (9) to (12) above, wherein,

[0187] The process for generating feature information characterizing the normal state of the process includes the following steps:

[0188] The feature information generation step involves generating candidate feature information representing the features of the normal process data for each process characteristic, based on multiple normal process data acquired when a process with multiple process characteristics is in a normal state; and

[0189] The search step evaluates the candidates of the feature information based on the error between the estimated process data calculated using the candidate feature information and the normal process data, thereby searching for the best feature information for each of the process characteristics.

[0190] (14) According to the anomaly detection method described in (13) above, wherein,

[0191] In the search step,

[0192] The evaluation threshold is calculated based on the quartiles of the error.

[0193] The feature information is evaluated based on the number of normal process data that exceed the evaluation threshold.

[0194] (15) According to the anomaly detection method described in (14) above, wherein,

[0195] In the search step, the feature information with the smallest number of normal process data exceeding the evaluation threshold is used as the optimal feature information.

[0196] (16) A program for enabling a computer to function as an anomaly detection device, the anomaly detection device comprising:

[0197] A process data acquisition unit acquires process data of a process having multiple process characteristics; and

[0198] An anomaly detection unit detects abnormal states in the process based on anomaly degree, wherein the anomaly degree represents the difference between the acquired process data and the normal state of the process characterized by feature information, and the feature information characterizes the features of the normal process data for each process characteristic.

[0199] The feature information characterizing the normal state of the process is the optimal feature information for each process characteristic searched by evaluating the candidate of the feature information based on the error between the estimated process data calculated using the candidate of the feature information and the normal process data. The candidate of the feature information is generated according to each process characteristic based on multiple normal process data obtained when the process is in a normal state.

[0200] (17) According to the procedure described in (16) above, wherein,

[0201] The anomaly detection unit uses a feature matrix representing the features of normal process data characterizing the process to factorize the matrix representing the acquired process data, thereby obtaining a coefficient matrix representing the feature information of the process data.

[0202] The anomaly detection unit calculates the anomaly degree based on the matrix representing the process data, the feature matrix, and the coefficient matrix.

[0203] (18) According to the procedure described in (16) or (17) above, wherein,

[0204] The anomaly degree is the distance between the value of the process data and the hyperplane that characterizes the normal state of the process through feature information, wherein the feature information characterizes the features of the normal process data for each process characteristic.

[0205] (19) According to the procedure described in (18) above, wherein,

[0206] The anomaly detection unit calculates the deviation of the anomaly degree according to each operating condition of the process data.

[0207] (20) The procedure according to any one of (16) to (19) above, wherein,

[0208] The program enables the computer to function as an anomaly detection device with a processing unit, which generates characteristic information representing the normal state of the process.

[0209] The processing unit includes:

[0210] A feature information generation unit generates candidate feature information representing features of the normal process data for each process characteristic, based on multiple normal process data acquired when a process with multiple process characteristics is in a normal state; and

[0211] The search unit evaluates the candidates of the feature information based on the error between the estimated process data calculated using the candidate feature information and the normal process data, thereby searching for the best feature information for each of the process characteristics.

[0212] (21) According to the procedure described in (20) above, wherein,

[0213] The search unit calculates an evaluation threshold based on the quartiles of the error, and evaluates the feature information based on the number of normal process data that exceed the evaluation threshold.

[0214] (22) According to the procedure described in (21) above, wherein,

[0215] The search unit searches for the feature information with the smallest number of normal process data exceeding the evaluation threshold, and uses this as the optimal feature information.

[0216] Explanation of reference numerals in the attached figures

[0217] 1: Anomaly detection system; 10: Process; 30: Process data storage unit; 100: Feature information generation device; 110: Feature information generation unit; 120: Search unit; 200: Anomaly detection device; 210: Process data acquisition unit; 220: Anomaly detection unit; 300: Feature information storage unit; 500: Terminal; 900: Information processing device; 901: CPU; 903: ROM; 905: RAM; 907: Bus; 909: Input I / F; 911: Output I / F; 913: Storage device; 915: Driver; 917: Connection port; 919: Communication device; 921: Input device; 923: Output device; 925: Removable recording medium; 927: External device; 929: Communication network.

Claims

1. An anomaly detection device, comprising: A process data acquisition unit acquires process data of a process, wherein the process has multiple process characteristics characterizing trends in the process data; and An anomaly detection unit detects abnormal states in the process based on anomaly degree, wherein... The anomaly degree represents the distance between the acquired process data and the hyperplane, where the hyperplane represents the boundary of the space representing the normal state of the process, generated by feature information, and the feature information characterizes the features of the normal process data for each process characteristic. The feature information characterizing the normal state of the process is the optimal feature information for each process characteristic searched by evaluating the candidate of the feature information based on the error between the estimated process data calculated using the candidate of the feature information and the normal process data. The candidate of the feature information is generated according to each process characteristic based on multiple normal process data obtained when the process is in a normal state.

2. The anomaly detection device according to claim 1, wherein, The anomaly detection unit uses a feature matrix representing the features of normal process data characterizing the process to factorize the matrix representing the acquired process data, thereby obtaining a coefficient matrix representing the feature information of the process data. The anomaly detection unit calculates the anomaly degree based on the matrix representing the process data, the feature matrix, and the coefficient matrix.

3. The anomaly detection device according to claim 1 or 2, wherein, The anomaly degree is the distance between the value of the process data and the hyperplane that characterizes the normal state of the process through feature information, wherein the feature information characterizes the features of the normal process data for each process characteristic.

4. The anomaly detection device according to claim 3, wherein, The anomaly detection unit calculates the deviation of the anomaly degree according to each operating condition of the process data.

5. A factory equipment system comprising: factory equipment having a process, said process having a plurality of process characteristics characterizing trends in process data; and an anomaly detection device according to claim 1. in, The anomaly detection device calculates the anomaly degree or the deviation of the anomaly degree according to each operating condition of the process data, and controls the factory equipment based on the anomaly degree or the deviation.

6. A feature information generation device, comprising: The feature information generation unit generates candidate feature information representing features of the normal process data for each process characteristic, based on multiple normal process data acquired when the process with multiple characteristic process data trends is in a normal state; and The search unit evaluates the candidates for the feature information based on the error between the estimated process data calculated using the candidate feature information and the normal process data, thereby searching for the optimal feature information for each of the process characteristics. in, A space representing the normal state of the process is generated based on the feature information.

7. The feature information generation apparatus according to claim 6, wherein, The search unit calculates the evaluation threshold based on the quartiles of the error. The search unit evaluates the feature information based on the number of normal process data that exceed the evaluation threshold.

8. The feature information generation apparatus according to claim 7, wherein, The search unit searches for the feature information with the smallest number of normal process data exceeding the evaluation threshold, and uses this as the optimal feature information.

9. An anomaly detection method, comprising the following steps: The process data acquisition step involves acquiring process data for a process, wherein the process has multiple process characteristics that characterize the trends of the process data. as well as The anomaly detection step detects abnormal states of the process based on anomaly degree, where the anomaly degree represents the distance between the acquired process data and the hyperplane, and the hyperplane represents the boundary of a space representing the normal state of the process generated by feature information, where the feature information characterizes the features of normal process data for each process characteristic. The feature information characterizing the normal state of the process is the optimal feature information for each process characteristic searched by evaluating the candidate of the feature information based on the error between the estimated process data calculated using the candidate of the feature information and the normal process data. The candidate of the feature information is generated according to each process characteristic based on multiple normal process data obtained when the process is in a normal state.

10. A method for generating feature information, comprising the following steps: The feature information generation step involves generating candidate feature information representing the features of the normal process data according to each process characteristic, based on multiple normal process data obtained when the process with multiple characteristic process data trends is in a normal state. as well as The search step evaluates the candidate feature information based on the error between the estimated process data calculated using the candidate feature information and the normal process data, thereby searching for the optimal feature information for each process characteristic. Specifically, a space representing the normal state of the process is generated based on the feature information.

11. A computer-readable recording medium storing a program for enabling a computer to function as an anomaly detection device, the anomaly detection device comprising: A process data acquisition unit acquires process data of a process, wherein the process has multiple process characteristics characterizing trends in the process data; and An anomaly detection unit detects abnormal states in the process based on anomaly degree, wherein... The anomaly degree represents the distance between the acquired process data and the hyperplane, where the hyperplane represents the boundary of the space representing the normal state of the process, generated by feature information, and the feature information characterizes the features of the normal process data for each process characteristic. The feature information characterizing the normal state of the process is the optimal feature information for each process characteristic searched by evaluating the candidate of the feature information based on the error between the estimated process data calculated using the candidate of the feature information and the normal process data. The candidate of the feature information is generated according to each process characteristic based on multiple normal process data obtained when the process is in a normal state.

12. A computer-readable recording medium storing a program for enabling a computer to function as a feature information generation device, the feature information generation device comprising: The feature information generation unit generates candidate feature information representing features of the normal process data for each process characteristic, based on multiple normal process data acquired when the process with multiple characteristic process data trends is in a normal state; and The search unit evaluates the candidates for the feature information based on the error between the estimated process data calculated using the candidate feature information and the normal process data, thereby searching for the optimal feature information for each of the process characteristics. in, A space representing the normal state of the process is generated based on the feature information.

13. A computer program product comprising a computer program that, when executed by a processor, implements the anomaly detection method of claim 9.

14. A computer program product comprising a computer program that, when executed by a processor, implements the feature information generation method of claim 10.

Images