Analyzing device, analyzing method, and program

Abstract

To provide a technique capable of obtaining an operation procedure with high accuracy.SOLUTION: An analyzing device according to one aspect of the present disclosure, includes: a first selection unit that selects a sensor data set that includes at least a part of sensor data in an abnormal period as sensor data for analysis by employing sensor data including measured values of a plurality of variable numbers representing a state of a target and an abnormal variable number of the target; a first preparation unit that prepares a first operation procedure by causal analysis using the sensor data for analysis; a second selection unit that selects an abnormal period during which an operation included in the first operation procedure is performed as an integrated target period by using the first operation procedure and log data; a second preparation unit that prepares a second operation procedure by analyzing the frequency of occurrence of operation log data by using the log data of the integrated target period; a third preparation unit that prepares a third operation procedure by the causal analysis by using the sensor data for analysis of the integrated target period; and an integration unit that integrates the second operation procedure and the third operation procedure.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present disclosure relates to an analysis device, an analysis method, and a program. [Background technology]

[0002] In order to improve the quality of plant operation, a technology is desired that presents an appropriate recovery operation procedure or avoidance operation procedure to an operator when an abnormality or its sign is detected. In response to this, a technology is known that can extract a recovery operation procedure or avoidance operation procedure from the history of past log data by using the frequency increase rate of operation logs during a period in which a specific event occurred (Patent Document 1). In addition, a technology is known that can extract a recovery operation procedure or avoidance operation procedure from the history of past sensor data by using a causal analysis technology (Patent Document 2). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2022-7859 [Patent Document 2] Patent No. 7222441 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the conventional technology, there are cases where it is not possible to obtain a highly accurate recovery operation procedure or avoidance operation procedure. For example, in the technology described in Patent Document 1, when there is an operation that is not recorded as log data, there are cases where it is not possible to obtain a highly accurate operation procedure. Similarly, for example, in the technology described in Patent Document 2, when a certain physical quantity is not recorded as sensor data, there are cases where it is not possible to obtain a highly accurate operation procedure.

[0005] The present disclosure has been made in consideration of the above points, and provides a technique that can obtain an operation procedure with high accuracy. [Means for solving the problem]

[0006] An analysis device according to an aspect of the present disclosure includes a first selection unit that uses sensor data including measured values ​​of a plurality of variables representing a state of an object and a target abnormality variable representing a variable related to an abnormality or an abnormal sign among the plurality of variables to select, as sensor data for analysis, a sensor data set including at least a portion of sensor data of an abnormal period representing a period during which the abnormality or an abnormal sign occurred; a first creation unit that uses the sensor data for analysis to create a first operation procedure representing a recovery or avoidance operation procedure when the abnormality or an abnormal sign occurs in the object by causal analysis; and a first creation unit that uses the first operation procedure and log data related to the object to select, as sensor data for analysis, a sensor data set including at least a portion of sensor data of an abnormal period representing a period during which the abnormality or an abnormal sign occurred. as a target period for integration; a second creation unit that uses log data of the target period for integration to create a second operation procedure representing a recovery or avoidance operation procedure when the abnormality or an abnormal symptom occurs in the target by analyzing the frequency of occurrence of log data representing an operation log for the target; a third creation unit that uses analytical sensor data of the abnormality period selected as the target period for integration to create a third operation procedure representing a recovery or avoidance operation procedure when the abnormality or an abnormal symptom occurs in the target by the causal analysis; and an integration unit that integrates the second operation procedure and the third operation procedure by using operations common to the second operation procedure and the third operation procedure. Effect of the Invention

[0007] A technique is provided that can obtain a highly accurate operation procedure. [Brief description of the drawings]

[0008] [Figure 1] 1 is a diagram illustrating an example of an overall configuration of an analysis system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram showing an example of log data stored in a log data DB; [Diagram 3] FIG. 2 is a diagram illustrating an example of sensor data stored in a sensor data DB. [Figure 4] FIG. 2 is a diagram illustrating an example of a hardware configuration of an analysis apparatus according to the present embodiment. [Diagram 5] FIG. 2 is a diagram illustrating an example of a functional configuration of an analysis device according to the present embodiment. [Figure 6] 4 is a flowchart showing an example of the operation of the analysis device according to the present embodiment. [Figure 7] FIG. 13 is a diagram illustrating an example of a causal model representing a recovery operation procedure extracted from sensor data. [Figure 8] FIG. 11 is a diagram illustrating an example of a recovery operation procedure extracted from sensor data. [Figure 9] FIG. 11 illustrates an example of a recovery operation procedure extracted from log data. [Figure 10] 13 is a flowchart illustrating an example of a process for selecting a period to be integrated according to the embodiment. [Figure 11] 10 is a flowchart illustrating an example of an integration process according to the embodiment. [Figure 12] FIG. 13 illustrates an example of a recovery operation procedure after integration. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] An embodiment of the present invention will be described below. In the following embodiment, an analysis system 1 capable of obtaining a highly accurate recovery operation procedure or avoidance operation procedure for an abnormality or its symptom will be described. For simplicity, the following will describe a case where an operation procedure (recovery operation procedure) for recovering from some abnormality is obtained. Note that if "abnormality" is read as "symptom of abnormality" and "recovery operation procedure" as "avoidance operation procedure," the following embodiment can be similarly applied to a case where an operation procedure (avoidance operation procedure) for avoiding the occurrence of some abnormality is obtained for a symptom of the abnormality.

[0010] Here, in the analysis system 1 according to the present embodiment, a recovery operation procedure is extracted from the history of past sensor data using the method described in Patent Document 2, and a recovery operation procedure is extracted from the history of past log data using the method described in Patent Document 1. Then, in the analysis system 1 according to the present embodiment, these recovery operation procedures are integrated to create a final recovery operation procedure. As a result, even if there is an operation that is not recorded as log data or a certain physical quantity is not recorded as sensor data, it is possible to obtain a highly accurate recovery operation procedure for recovering from an abnormality.

[0011] <Overall configuration example of analysis system 1> An example of the overall configuration of an analysis system 1 according to this embodiment is shown in Fig. 1. As shown in Fig. 1, the analysis system 1 according to this embodiment includes an analysis device 10, a facility 20, an input / output device 30, a log data DB 40, and a sensor data DB 50.

[0012] The analysis device 10 is an information processing device such as a general-purpose server or a PC (personal computer) that creates and visualizes a recovery operation procedure for an abnormality that occurs in equipment 21 in a facility 20, using log data stored in a log data DB 40 and sensor data stored in a sensor data DB 50. The analysis device 10 may be, for example, a general-purpose server or a PC that constitutes a distributed control system (DCS).

[0013] The facility 20 is, for example, various facilities such as a factory, a waste treatment facility, etc. The facility 20 includes equipment 21, a sensor 22, and a control device 23.

[0014] The facility 21 is, for example, a plant, a production facility, an industrial device (for example, a boiler, a heat exchanger, etc.), various devices, etc. However, these are merely examples, and the facility 21 is not limited to these, and may be any facility, device, equipment, etc. that is an analysis target.

[0015] The sensor 22 is a device that measures or gauges physical quantities (e.g., pressure, temperature, flow rate, current, voltage, etc.) that indicate various states of the equipment 21. Measurement values ​​of these physical quantities are stored in variables also called process variables, etc.

[0016] The control device 23 acquires (collects) values ​​(measured values) measured by the sensor 22, determines set values ​​so that these measured values ​​follow preset target values, and sets the set values ​​for the various devices and apparatuses that constitute the facility 21. The control device 23 also stores sensor data related to these measured values ​​in the sensor data DB 50. Furthermore, when an operator or the like performs an operation that is to be recorded in a log on the various devices and apparatuses that constitute the facility 21, an alarm occurs in these devices and apparatuses, or an operation that is to be recorded in a log is performed in these devices and apparatuses, the control device 23 stores log data related to these operations, alarms, and operations in the log data DB 40.

[0017] The operator may operate the various devices and apparatuses constituting the facility 21 by using, for example, a keyboard, a mouse, or the like provided in the control device 23, or may operate the various devices and apparatuses constituting the facility 21 by using a terminal or the like communicably connected to the control device 23. In addition, the various devices and apparatuses constituting the facility 21 may be operated by using, for example, a PC or the like constituting a distributed control system.

[0018] The input / output device 30 is a device that functions as an input / output interface for the analysis device 10. Examples of the input / output device 30 include a keyboard, a mouse, a display, and a touch panel.

[0019] The log data DB 40 stores log data. Specific examples of the log data will be described later. Examples of the log data include operation log data representing logs related to operations performed on various devices and apparatuses constituting the facility 21, alarm log data representing logs related to alarms generated in the various devices and apparatuses, and operation log data representing logs related to operations performed in the various devices and apparatuses.

[0020] The sensor data DB 50 stores sensor data. Specific examples of the sensor data will be described later.

[0021] 1 is an example, and is not limited thereto. For example, at least one of the analysis device 10, the input / output device 30, the log data DB 40, and the sensor data DB 50 may be integrally configured. Also, for example, the facility 20 includes an actuator that drives the equipment 21, and the control device 23 may acquire (collect) values ​​obtained by measuring or measuring the operation of this actuator (for example, measuring or measuring the presence or absence of some operation such as a stirring operation, its speed, etc.), and store data related to these values ​​in the sensor data DB 50 as sensor data.

[0022] <Log data> An example of log data stored in the log data DB 40 is shown in Fig. 2. As shown in Fig. 2, the log data DB 40 stores time-series data of one or more log data as history data, and each log data includes a date and time, a tag, and log contents.

[0023] The date and time is the date and time when the operation, action, alarm, etc. that is the subject of the log occurred. The tag is a label that indicates the variable (process variable) that was the subject of the operation, action, or alarm. The log content is information that indicates the operation, action, alarm content, etc. The label is information that is assigned to a process variable to identify it.

[0024] For example, the log data in the first line of the example shown in FIG. 2 includes the date and time "2015-01-01 00:00:04", the tag "T101", and the log content "AAAAA". Similarly, the log data in the second line includes the date and time "2015-01-01 00:10:15", the tag "P205", and the log content "BBBBB". Similarly, the log data in the third line includes the date and time "2015-01-01 00:35:40", the tag "L204", and the log content "CCCCC". Similarly, the log data in the fourth line includes the date and time "2015-01-01 00:49:01", the tag "T101", and the log content "ZZZZZ".

[0025] 2 is an example, and each log data may include other information, such as identification information of a device or apparatus corresponding to the log data (i.e., a device or apparatus on which an operation of the log content included in the log data was performed).

[0026] <Sensor data> An example of sensor data stored in the sensor data DB 50 is shown in Fig. 3. As shown in Fig. 3, the sensor data DB 50 stores time-series data of one or more pieces of sensor data as history data, and each piece of sensor data includes a date and time and one or more measurement values.

[0027] The date and time is the date and time measured by the sensor 22. The measurement value is a measurement value measured by the sensor 22.

[0028] For example, the sensor data in the first row of the example shown in FIG. 3 includes the date and time "2015-01-01 00:00:00" and measurement values ​​stored in variables represented by the tags "T101" to "L210". Similarly, the sensor data in the second row includes the date and time "2015-01-01 00:00:10" and measurement values ​​stored in variables represented by the tags "T101" to "L210". Similarly, the sensor data in the third row includes the date and time "2015-01-01 00:00:20" and measurement values ​​stored in variables represented by the tags "T101" to "L210".

[0029] 3 is an example, and each sensor data may include other information, such as identification information of a device or apparatus corresponding to the sensor data (i.e., a device or apparatus that measured the measurement value included in the sensor data).

[0030] <Hardware configuration example of the analysis device 10> An example of the hardware configuration of the analysis device 10 according to this embodiment is shown in Fig. 4. As shown in Fig. 4, the analysis device 10 according to this embodiment has an external I / F 101, a communication I / F 102, a RAM (Random Access Memory) 103, a ROM (Read Only Memory) 104, an auxiliary storage device 105, and a processor 106. Each of these pieces of hardware are connected to each other via a bus 107 so as to be able to communicate with each other.

[0031] The external I / F 101 is an interface with an external device such as a recording medium 101a. Examples of the recording medium 101a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0032] The communication I / F 102 is an interface for connecting the analysis device 10 to a communication network. The RAM 103 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 104 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 105 is a non-volatile storage device such as a hard disk drive (HDD) or a solid state drive (SSD) and stores programs and data. The processor 106 is various types of arithmetic devices such as a central processing unit (CPU) or a graphics processing unit (GPU).

[0033] 4 is an example, and the analysis device 10 may have other hardware configurations. For example, the analysis device 10 may have multiple auxiliary storage devices 105 and multiple processors 106, and may have various hardware other than the hardware shown in the figure (for example, input devices such as a keyboard and a mouse, and output devices such as a display and a display panel).

[0034] <Example of functional configuration of the analysis device 10> An example of the functional configuration of the analysis device 10 according to this embodiment is shown in Fig. 5. As shown in Fig. 5, the analysis device 10 according to this embodiment has a target tag designation unit 201, a sensor data selection unit 202, a sensor data analysis unit 203, an integration target period selection unit 204, a log data analysis unit 205, an integration analysis unit 206, and a visualization unit 207. Each of these units is realized, for example, by a process in which one or more programs installed in the analysis device 10 are executed by the processor 106.

[0035] The target tag designation unit 201 accepts designation of a tag representing a variable (hereinafter also referred to as a target abnormal variable) related to an abnormality for which a recovery operation procedure is to be obtained, among the variables in which each measurement value included in the sensor data stored in the sensor data DB 50 is stored. The tag representing the target abnormal variable is designated by the user, for example, using a keyboard, mouse, touch panel, or the like included in the input / output device 30. For example, the tag representing the target abnormal variable is designated by the user from a list of variables and tags representing the variables displayed on a display included in the input / output device 30 (a list of variables in which each measurement value included in the sensor data is stored and tags representing the variables). Hereinafter, the tag representing the target abnormal variable will also be referred to as a "target abnormal variable tag". Although multiple target abnormal variable tags may be designated, in the following, for simplicity, it is assumed that one target abnormal variable tag is designated. Note that the target abnormal variable may be designated instead of the target abnormal variable tag.

[0036] The sensor data selection unit 202 uses the sensor data stored in the sensor data DB 50 and the target abnormal variable tag accepted by the target tag designation unit 201 to select a set of sensor data called an abnormal case as sensor data for analysis.

[0037] The sensor data analysis unit 203 extracts a recovery operation procedure when an abnormality related to a target abnormal variable occurs, using the sensor data for analysis selected by the sensor data selection unit 202. The sensor data analysis unit 203 also extracts a recovery operation procedure when an abnormality related to a target abnormal variable occurs, using an abnormality case corresponding to the integration target period selected by the integration target period selection unit 204. The sensor data analysis unit 203 may extract the recovery operation procedure, for example, by the method described in Patent Document 2.

[0038] The integration target period selection unit 204 selects a period called the integration target period, using the abnormal period identified by the sensor data selection unit 202 when selecting the sensor data for analysis, the log data stored in the log data DB 40, and the recovery operation procedures extracted by the sensor data analysis unit 203. The integration target period is an abnormal period that is a target for integrating the recovery operation procedures extracted from the sensor data and the recovery operation procedures extracted from the log data, among the abnormal periods identified by the sensor data selection unit 202 when selecting the sensor data for analysis.

[0039] The log data analysis unit 205 extracts a recovery operation procedure when an abnormality related to a target abnormal variable occurs, using the log data of the integration target period selected by the integration target period selection unit 204. Note that the log data analysis unit 205 may extract the recovery operation procedure by, for example, the method described in Patent Document 1.

[0040] The integrated analysis unit 206 creates a recovery operation procedure by integrating the recovery operation procedure extracted by the sensor data analysis unit 203 and the recovery operation procedure extracted by the log data analysis unit 205 .

[0041] The visualization unit 207 visualizes the recovery operation procedure created by the integrated analysis unit 206 on a display included in the input / output device 30 .

[0042] <Example of operation of the analysis device 10> An example of the operation of the analysis device 10 according to this embodiment will be described below with reference to FIG.

[0043] First, the target tag designation unit 201 accepts the designation of a target abnormal variable tag (step S101).

[0044] Next, the sensor data selection unit 202 selects sensor data for analysis using the sensor data stored in the sensor data DB 50 and the target abnormal variable tag received in the above step S101 (step S102). The sensor data selection unit 202 may select the sensor data for analysis by, for example, a process similar to the "model construction data selection process" described in Patent Document 2. For example, the sensor data selection unit 202 can select the sensor data for analysis by the following steps 1-1 to 1-3.

[0045] Step 1-1: The sensor data selection unit 202 identifies an abnormal period from the measurement values ​​stored in the variables represented by the target abnormal variable tags among the measurement values ​​included in the sensor data stored in the sensor data DB 50, and stores the start date and time and the end date and time in order of the longest period. Note that an abnormal period is a continuous period during which the measurement value of the target abnormal variable exceeds the upper control limit, or a continuous period during which the measurement value is below the lower control limit. Hereinafter, the i-th abnormal period is defined as [t s (i) ,t e (i) ], and the set of abnormal periods is {[t s (i) ,t e (i) ]|i∈I}, where I is the set of indexes of abnormal periods, t s (i) is the time index representing the start date and time of the i-th abnormal period, t e (i) represents the end date and time of the i-th abnormal period. Note that only either the upper control limit or the lower control limit may be set for the target abnormal variable. The total number of abnormal periods is |I|.

[0046] Step 1-2: The sensor data selection unit 202 selects the length of the period t e (i) -t s (i) In descending order, t s (i) and t e (i) Sort the start date and time after sorting.s (1) ,t s (|I|) , end time is t e (1) ,t e (|I|) These start date and time and end date and time are stored in a memory (for example, a storage area such as the RAM 103 or the auxiliary storage device 105).

[0047] Step 1-3: The sensor data selection unit 202 selects the first abnormal period [t s (1) ,t e (1) ], and creates an abnormality case from each selected abnormality period. For example, when creating an i-th abnormality case, the sensor data selection unit 202 selects a predetermined number or |I| abnormality periods from the i-th abnormality period [t s (i) ,t e (i) ], and extract sensor data at a certain interval during the abnormal period after the combination. The set of extracted sensor data is taken as the i-th abnormal case. s (i) ,t e (i) The length of the period immediately before and after the t e (i) -t s (i) The interval for extracting sensor data in the abnormal period after the combination may be, for example, (the number of sensor data in the abnormal period after the combination) / (a predetermined number of sensor data).

[0048] As a result, for example, when k abnormal periods are selected in the above procedure 1-3, k abnormal cases are created, and these k abnormal cases are obtained as sensor data for analysis. Note that the periods of the abnormal cases are long in the order of the first abnormal case, ..., the kth abnormal case. However, the above procedure 1-3 does not necessarily need to be executed, and for example, a set of sensor data in the abnormal period after sorting in the above procedure 1-2 may be set as an abnormal case. Or, for example, a set of sensor data extracted at a certain interval from the set of sensor data in the abnormal period after sorting in the above procedure 1-2 may be set as an abnormal case.

[0049] Next, the sensor data analysis unit 203 uses the analytical sensor data selected in the above step S102 to extract a recovery operation procedure (hereinafter also referred to as a first recovery operation procedure) when an abnormality related to the target abnormal variable occurs (step S103). The sensor data analysis unit 203 may extract the first recovery operation procedure, for example, by the "variable selection process," "causal model construction process," and "operation procedure extraction process" described in Patent Document 2. For example, the sensor data analysis unit 203 can extract the first recovery operation procedure by the following steps 2-1 to 2-5.

[0050] Step 2-1: The sensor data analysis unit 203 uses the analytical sensor data to select a variable having a Granger causal relationship with the target abnormal variable for each abnormal case. That is, the sensor data analysis unit 203 standardizes the measurement value included in each abnormal case for each variable, and then deletes variables with a low standard deviation (for example, a standard deviation within a predetermined positive number ε). Then, the sensor data analysis unit 203 calculates the sum of EDM (Empirical Dynamic Modeling) in both directions between the target abnormal variable and other variables as an EDM value for each abnormal case, and then selects variables whose EDM value is greater than a predetermined threshold value (or a predetermined number of variables in order of EDM value greater than the threshold value). As a result, a variable having a Granger causal relationship with the target abnormal variable (hereinafter also referred to as a selected variable) is selected for each abnormal case. For details of EDM, please refer to, for example, Reference 1.

[0051] Step 2-2: The sensor data analysis unit 203 uses the target abnormal variable and the selection variables to select a common variable from the selection variables. That is, the sensor data analysis unit 203 performs calculations for each abnormal case using VAR-LiNGAM, a causal search technique that takes Granger causality into account, and its extended function, Causal Effect, to calculate the CE (Causal Effect) value from the target abnormal variable to each selection variable, and sorts the selection variables in descending order of CE value. Hereinafter, an ordered set representing the selected variables of the i-th abnormal case sorted in descending order of CE value is called X (i) Then, the sensor data analysis unit 203 writes Y (1) =X (1) Then, for i=1, ,k-1, Y (i+1) ←Y (i) ∩X (i+1) By calculating the set of common variables Y = Y (K) However, if the number of common variables for a certain i' falls below a preset lower limit, the set of common variables Y obtained immediately before that is (i'-1) Let Y be the final set of common variables. Also, Y (K)If the number of common variables in is equal to or greater than a preset upper limit, Y (K) Among the common variables included in, select the upper limit number of common variables from the top, and let the ordered set of selected common variables be the final set of common variables Y. For more information on VAR-LiNGAM and the Causal Effect, see, for example, References 2 and 3.

[0052] Step 2-3: The sensor data analysis unit 203 calculates the common variable set Y=Y (K) In other words, the sensor data analysis unit 203 combines and copies the measurement values ​​related to the common variables using the common variable set Y=Y (K) For each common variable included in Y, the time series of the measurement value of the common variable in the second abnormal case to the kth abnormal case are sequentially combined with the end of the time series of the measurement value of the common variable in the first abnormal case. Then, the sensor data analysis unit 203 calculates the common variable set Y=Y (K) For each common variable in , the time series of measurements of that common variable is copied and appended to the end of the time series of measurements.

[0053] Step 2-4: The sensor data analysis unit 203 uses the prior information to set the target abnormal variable tag at the top of the causal model, and then uses the target abnormal variable as the objective variable and the common variables included in the common variable set Y as explanatory variables to construct a causal model by VAR-LiNGAM using the time series of measurement values ​​after combining and copying in the above step 2-3. Note that the prior information is information obtained in advance regarding the causal order and is provided by the user. As a result, a weighted directed graph is obtained as the causal model, with the target abnormal variable tag and tags representing the common variables as nodes, and the Granger causal relationship between the variables represented by the two nodes as weighted directed edges.

[0054] Step 2-5: Using the causal model constructed in step 2-4 above, the sensor data analysis unit 203 extracts tags (hereinafter also referred to as candidate manipulated variable tags) representing common variables to be manipulated when an abnormality related to the target abnormal variable occurs, and the order of their manipulation as a first recovery operation procedure. That is, the sensor data analysis unit 203 deletes edges less than a preset threshold from the causal model (i.e., deletes tags representing common variables with weak causality), and deletes the last edge of a path other than the shortest path when there are multiple paths between the tags representing each common variable and the target abnormal variable tag. This results in a recovery operation procedure represented by the causal model after step 2-5 above is performed. However, for example, at least one of the joining and copying in step 2-3 above may not be performed.

[0055] An example of the causal model after the above steps 2-5 are performed is shown in Fig. 7. In the causal model shown in Fig. 7, the target abnormal variable tag "T202", the manipulated variable candidate tags "P205", "L204", and "P305" are nodes, and "T202" to "P205", "P205" to "L204", and "P205" to "P305" are connected by weighted directed edges. Note that the weights of the edges are not shown in the example shown in Fig. 7.

[0056] Moreover, the recovery operation procedure represented by the causal model shown in Fig. 7 is shown in Fig. 8. As shown in Fig. 8, the causal model shown in Fig. 7 indicates that when an abnormality occurs related to the variable represented by the target abnormal variable tag "T202", after manipulating the variable represented by the manipulated variable candidate tag "P205", the variable represented by the manipulated variable candidate tag "L204" and the variable represented by the manipulated variable candidate tag "P305" should be manipulated.

[0057] Next, the integration target period selection unit 204 selects an integration target period from the abnormal period using the abnormal period identified when selecting the sensor data for analysis in the above step S102, the log data stored in the log data DB 40, and the first recovery operation procedure extracted in the above step S103 (step S104). Hereinafter, it is assumed that one or more integration target periods are selected in this step. If no integration target period is selected in this step, the analysis device 10 may end the process. Details of the process in this step will be described later.

[0058] Next, the log data analysis unit 205 uses the log data of the integration target period selected in the above step S104 to extract a recovery operation procedure (hereinafter also referred to as a second recovery operation procedure) when an abnormality related to the target abnormal variable occurs (step S105). The log data analysis unit 205 may, for example, use the method described in Patent Document 1 to calculate the frequency increase rate of logs related to each operation (hereinafter also referred to as an operation log), and then extract the second recovery operation procedure from the operation log data using the frequency increase rate of each operation log. For example, the log data analysis unit 205 can extract the second recovery operation procedure by the following steps 3-1 to 3-3. In the following, the number of abnormal periods identified in step 1-1 of the above step S102 is set as N1=|I|. In the following, the type of operation log is represented by i, and the i-th type of operation log is represented as "operation log i". Furthermore, the entire period of the log data stored in the log data DB 40 is divided into fixed periods, and each period is designated as Period 1, . . . , Period N2.

[0059] Step 3-1: The log data analysis unit 205 calculates the frequency and the entire period frequency of each operation log i by using the log data stored in the log data DB 40. The log data analysis unit 205 may calculate the frequency and the entire period frequency of the operation log i by, for example, any one of the following calculation methods 1 to 3.

[0060] <Calculation method 1> ·frequency r i :Frequency of operation log i Cik : The number of occurrences of operation log data of operation log i during the kth abnormal period In this case, r i =(Σ k C ik ) / N1, the frequency r of operation log i i where k = 1, , N1.

[0061] -Full-period frequency R i :Frequency of operation log i over the entire period ΣC i : Number of occurrences of operation log data of operation log i in the entire period At this time, R i =(ΣC i ) / N2, the total period frequency of operation log i, R i Calculate.

[0062] <Calculation method 2> ·frequency r i :Frequency of operation log i C ik : The number of occurrences of operation log data of operation log i during the kth abnormal period A km : The number of occurrences of log data of log m (i.e., the mth type of log) during the kth abnormal period In this case, r i =(Σ k C ik ) / (Σ m Σ k A km ) the frequency r of operation log i i Calculate.

[0063] -Full-period frequency R i :Frequency of operation log i over the entire period ΣC i : Number of occurrences of operation log data of operation log i in the entire period ΣA m : Number of occurrences of log data of log m in the entire period At this time, R i =(ΣC i ) / (Σ mΣA m ) to obtain the total period frequency R i Calculate.

[0064] <Calculation method 3> ·frequency r i :Frequency of operation log i C ik : The number of occurrences of operation log data of operation log i during the kth abnormal period Σ k t: Sum of the duration (time) of all abnormal periods In this case, r i =(Σ k C ik ) / (Σ k t), the frequency r of operation log i i Calculate.

[0065] -Full-time frequency R i :Frequency of operation log i over the entire period ΣC i : Number of occurrences of operation log data of operation log i in the entire period Σt: Total period length (time length) At this time, R i =(ΣC i ) / (Σt) gives the total period frequency R i Calculate.

[0066] Step 3-2: The log data analysis unit 205 calculates the frequency increase rate of the operation log i by using the frequency calculated in the above step 3-1 and the entire period frequency. For example, the log data analysis unit 205 calculates the frequency increase rate of the operation log i by using the frequency r i and the total period frequency R i Using this, the frequency increase rate of operation log i is r i / R i It is calculated as follows.

[0067] Step 3-3: The log data analysis unit 205 extracts a second recovery operation procedure using the frequency increase rate. For example, the log data analysis unit 205 extracts a second recovery operation procedure using the frequency increase rate r i / R iBy extracting the operation log data of the operation log i in which the frequency of the operation log i is equal to or greater than a predetermined threshold in order of date and time, the operation log data in the order of date and time is extracted as a second recovery operation procedure. Alternatively, for example, the log data analysis unit 205 may extract the operation log data in the order of date and time from the log data of a certain abnormal period, i / R i A predetermined number of operation log data of the operation logs i in descending order of size may be extracted, and the operation log data may be rearranged in order of date and time and extracted as the second recovery operation procedure.

[0068] An example of the second recovery operation procedure extracted in step 3-3 above is shown in Fig. 9. The second recovery operation procedure shown in Fig. 9 indicates that when an abnormality occurs related to the variable represented by the target abnormal variable tag "T202", the variable represented by the manipulated variable candidate tag "P305" should be manipulated, and then the variable represented by the manipulated variable candidate tag "T303" should be manipulated. In the second recovery operation procedure shown in Fig. 9, log contents are also associated with each manipulated variable candidate tag.

[0069] Next, the sensor data analysis unit 203 extracts a recovery operation procedure (hereinafter also referred to as a third recovery operation procedure) when an abnormality related to a target abnormal variable occurs, using the abnormality case corresponding to the integration target period selected in the above step S104 (step S106). The sensor data analysis unit 203 extracts the third recovery operation procedure by the same process as the above step S103. That is, the sensor data analysis unit 203 may extract the third recovery operation procedure by, for example, executing the above steps 2-1 to 2-5 using only the abnormality cases corresponding to the integration target period as analysis data. Note that the abnormality cases corresponding to the integration target period are abnormality cases created from the abnormality period selected as the integration target period.

[0070] Next, the integration analysis unit 206 integrates the second recovery operation procedure extracted in the above step S105 and the third recovery operation procedure extracted in the above step S106 to create a fourth recovery operation procedure (step S107). Details of the process of this step will be described later.

[0071] Finally, the visualization unit 207 visualizes the fourth recovery operation procedure created in the above step S107 on a display included in the input / output device 30 (step S108). This allows a user such as an operator of the facility 20 to know the recovery operation procedure when an abnormality occurs in the equipment 21.

[0072] <Selection of integration period> The process of step S104 (integration target period selection process) will be described in detail with reference to FIG.

[0073] The integration target period selection unit 204 selects one tag as a selected tag from among the operational variable candidate tags included in the first recovery operation procedure extracted in the above step S103 (step S201).

[0074] Next, the integration target period selection unit 204 selects each abnormal period [t s (i) ,t e (i) ](i∈I) is searched for log data including the selected tag (step S202).

[0075] Next, the integration target period selection unit 204 determines whether or not one or more pieces of log data have been found in the above step S202 (step S203).

[0076] If it is determined in step S203 that one or more log data have been found, the integration target period selection unit 204 sets the abnormal period including the log data found in step S203 as the integration target period (step S204).

[0077] If it is not determined in the above step S203 that one or more log data have been searched, or following the above step S204, the integration target period selection unit 204 determines whether or not there is an unselected tag among the operational variable candidate tags included in the first recovery operation procedure extracted in the above step S103 (step S205).

[0078] If it is determined in step S205 that there is an unselected tag, the integration target period selection unit 204 selects the unselected tag as a selected tag from among the operational variable candidate tags included in the first recovery operation procedure extracted in step S103 (step S206). As a result, the processes in and after step S202 are executed again using the selected tag.

[0079] If it is determined in step S205 that there is no unselected tag, the integration target period selection unit 204 ends the integration target period selection process. As a result, the abnormal period in which the log data including the operational variable candidate tag included in the first recovery operation procedure exists is selected as the integration target period.

[0080] <Merge processing> The process (integration process) of step S107 will be described in detail with reference to FIG.

[0081] First, the integrated analysis unit 206 identifies an operational variable candidate tag common between the second and third recovery operation procedures as a common operational variable candidate tag (step S301). For example, when the recovery operation procedure shown in Fig. 9 is extracted as the second recovery operation procedure and the recovery operation procedure shown in Fig. 8 is extracted as the third recovery operation procedure, the integrated analysis unit 206 identifies the operational variable candidate tag "P305" as the common operational variable candidate tag.

[0082] Then, the integration analysis unit 206 creates a fourth recovery operation procedure by integrating the second recovery operation procedure and the third recovery operation procedure using the common operational variable candidate tag identified in the above step S301 (step S302). That is, the integration analysis unit 206 combines the second recovery operation procedure and the third recovery operation procedure using the common operational variable candidate tag, and then determines the step numbers of the operational variable candidate tags other than the common operational variable candidate tag included in the second recovery operation procedure from their dates and times.

[0083] For example, when the recovery operation procedure shown in Fig. 9 is extracted as the second recovery operation procedure and the recovery operation procedure shown in Fig. 8 is extracted as the third recovery operation procedure, the second recovery operation procedure and the third recovery operation procedure are combined with the common operational variable candidate tag "P305". At this time, the date and time of the operational variable candidate tag "T303" included in the second recovery operation procedure is after the common operational variable candidate tag "P305", so its procedure number is determined to be "3". As a result, for example, the recovery operation procedure shown in Fig. 12 is created as the fourth recovery operation procedure.

[0084] In addition, depending on the date and time of the operational variable candidate tag other than the common operational variable candidate tag included in the second recovery operation procedure, the procedure number may not be uniquely determined. In this case, the procedure number does not need to be determined.

[0085] <Summary> As described above, when extracting recovery operation procedures from the sensor data and the log data, the analysis device 10 according to the present embodiment selects an integration target period as an abnormal period for integrating these recovery operation procedures. The analysis device 10 according to the present embodiment then uses these integration target periods to extract recovery operation procedures from the sensor data and to extract recovery operation procedures from the log data, and integrates these two recovery operation procedures to create a final recovery operation procedure. This makes it possible to obtain an accurate recovery operation procedure by integrating the recovery operation procedures extracted from the sensor data and the log data, even if, for example, there is an operation that is not recorded as log data or a certain physical quantity is not recorded as sensor data.

[0086] For example, the third restoration operation procedure shown in Fig. 8 does not extract operations related to the operational variable candidate tag "T303", and the second restoration operation procedure shown in Fig. 9 does not extract operations related to the operational variable candidate tags "P205" and "L204". On the other hand, by integrating these to create the fourth restoration operation procedure shown in Fig. 12, a complete restoration operation procedure without any omissions can be obtained.

[0087] An example of an operation that is not recorded as log data is when an operation that is not subject to log recording is performed, etc. Also, an example of a physical quantity that is not recorded as sensor data is when a failure or malfunction occurs in the sensor 22 that measures the physical quantity, when the physical quantity changes instantaneously, and so on, resulting in measurement omission.

[0088] The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims.

[0089] [References] Reference 1: Chang, Chun-Wei; Ushio, Masayuki; Hsieh, Chihhao., Empirical dynamic modeling for beginners, Ecological Research 2017, 32(6): 785-796. Reference 2: Aapo Hyvarinen, Kun Zhang, Shohei Shimizu, Patrik O. Hoyer. Estimation of a Structural Vector Autoregression Model Using Non-Gaussianity. Journal of Machine Learning Research, 11: 1709-1731, 2010. Reference 3: P. Blobaum and S. Shimizu. Estimation of interventional effects of features on prediction. In Proc. 2017 IEEE International Workshop on Machine Learning for Signal Processing (MLSP2017), pp. 1-6, Tokyo, Japan, 2017. [Explanation of symbols]

[0090] 1. Analysis system 10 Analyzer 20 Facilities 21 Equipment 22 Sensors 23 Control device 30 Input / Output Devices 40 Log data DB 50 Sensor Data DB 101 External I / F 101a Recording media 102 Communication I / F 103 RAM 104 ROM 105 Auxiliary storage device 106 processors 107 Bus 201 Target tag specification section 202 Sensor data selection unit 203 Sensor Data Analysis Department 204 Integration Target Period Selection Department 205 Log Data Analysis Department 206 Integrated Analysis Department 207 Visualization section

Claims

1. a first selection unit that uses sensor data including measurement values ​​of a plurality of variables that represent a state of a target and a target abnormality variable that represents a variable related to an abnormality or an abnormal sign among the plurality of variables to select, as sensor data for analysis, a sensor data set that includes at least a portion of sensor data of an abnormal period that represents a period during which the abnormality or an abnormal sign occurred; a first creation unit that creates a first operation procedure representing a recovery or avoidance operation procedure when the abnormality or an abnormal symptom occurs in the target by causal analysis using the analytical sensor data; a second selection unit that selects, as an integration target period, an abnormal period during which an operation included in the first operation procedure is performed from the abnormal period, by using the first operation procedure and log data related to the target; a second creation unit that creates a second operation procedure that represents a recovery or avoidance operation procedure when the abnormality or an abnormality symptom occurs in the target by analyzing an occurrence frequency of log data that represents an operation log for the target using the log data for the integration target period; a third creation unit that creates a third operation procedure representing a recovery or avoidance operation procedure when the abnormality or an abnormality symptom occurs in the target by the causal analysis using the analytical sensor data of the abnormality period selected as the integration target period; an integration unit that integrates the second operation procedure and the third operation procedure by using an operation common to the second operation procedure and the third operation procedure; An analytical device having

2. The second selection unit is Searching for log data related to an operation included in the first operating procedure from the log data during the abnormal period; The analysis device according to claim 1 , further comprising: selecting an abnormal period in which the searched log data is included as the integration target period.

3. The integration unit includes: combining the second operation procedure and the third operation procedure by a common operation representing an operation common to the second operation procedure and the third operation procedure; The analysis device of claim 1 or 2, wherein the second operation procedure and the third operation procedure are integrated by determining the order of operations other than the common operation among the operations included in the second operation procedure from the date and time included in the log data representing the operation log related to the operations.

4. The analysis device according to claim 3, further comprising a visualization unit that visualizes a fourth operation procedure, which is an integration of the second operation procedure and the third operation procedure, on a display device used by an operator who operates the object.

5. a first selection step of selecting, as sensor data for analysis, a sensor data set including at least a portion of sensor data from an abnormal period representing a period during which the abnormality or abnormal sign occurred, using sensor data including measured values ​​of a plurality of variables representing a state of a target and a target abnormality variable representing a variable related to an abnormality or an abnormal sign among the plurality of variables; a first creation procedure for creating a first operation procedure representing a recovery or avoidance operation procedure when the abnormality or an abnormal symptom occurs in the target by causal analysis using the analytical sensor data; a second selection procedure for selecting, as an integration target period, an abnormal period during which an operation included in the first operation procedure was performed from the abnormal period, by using the first operation procedure and log data related to the target; a second creation procedure for creating a second operation procedure representing a recovery or avoidance operation procedure when the abnormality or abnormal symptom occurs in the target by analyzing an occurrence frequency of log data representing an operation log for the target using the log data for the integration target period; a third creation step of creating a third operation procedure representing a recovery or avoidance operation procedure when the abnormality or an abnormality symptom occurs in the target by the causal analysis using the analytical sensor data of the abnormality period selected as the integration target period; an integration step of integrating the second operation procedure and the third operation procedure by using an operation common to the second operation procedure and the third operation procedure; A computer-implemented analytical method.

6. a first selection step of selecting, as sensor data for analysis, a sensor data set including at least a portion of sensor data from an abnormal period representing a period during which the abnormality or abnormal sign occurred, using sensor data including measured values ​​of a plurality of variables representing a state of a target and a target abnormality variable representing a variable related to an abnormality or an abnormal sign among the plurality of variables; a first creation procedure for creating a first operation procedure representing a recovery or avoidance operation procedure when the abnormality or an abnormal symptom occurs in the target by causal analysis using the analytical sensor data; a second selection procedure for selecting, as an integration target period, an abnormal period during which an operation included in the first operation procedure was performed from the abnormal period, by using the first operation procedure and log data related to the target; a second creation procedure for creating a second operation procedure representing a recovery or avoidance operation procedure when the abnormality or abnormal symptom occurs in the target by analyzing an occurrence frequency of log data representing an operation log for the target using the log data for the integration target period; a third creation step of creating a third operation procedure representing a recovery or avoidance operation procedure when the abnormality or an abnormality symptom occurs in the target by the causal analysis using the analytical sensor data of the abnormality period selected as the integration target period; an integration step of integrating the second operation procedure and the third operation procedure by using an operation common to the second operation procedure and the third operation procedure; A program that causes a computer to execute the following.

Images