Detection device, detection method, and detection program

Abstract

To improve the accuracy of a learning model.SOLUTION: A server device 10 collects measurement data measured by a field device 20, inputs the collected measurement data into a learned detection model that predicts a predetermined event in response to the input of the measurement data, and obtains an output result of the learned detection model. When the output result of the learned detection model differs from a determination result made by a worker W who has checked the field device 20 in which the predetermined event is predicted, the server device re-learns the learned detection model using a label value input by the worker W and the collected measurement data, and generates a re-learning model.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a detection device, a detection method, and a detection program. [Background technology]

[0002] A technology is known in which unsupervised machine learning is performed based on normal data collected in advance, a normal state model is created by extracting features of the normal data, and an abnormal state of a plant is detected based on the learned normal state model and input data. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 11-338848 Summary of the Invention [Problem to be solved by the invention]

[0004] However, with the above technology, it is difficult to improve the accuracy of the machine learning model ("learning model" as appropriate) that detects signs of abnormal conditions ("signs of abnormality" as appropriate). For example, with the above technology, the data collected in advance is not labeled, so that it is not possible to calculate an evaluation index for the learning model, and it is difficult to determine whether the learning model being used is appropriate.

[0005] The present invention has been made in consideration of the above, and aims to improve the accuracy of a learning model for detecting signs of abnormality occurrence. [Means for solving the problem]

[0006] The present invention provides a detection device comprising: a collection unit that collects measurement data measured by a measurement device; a detection unit that inputs the collected measurement data into a trained learning model that predicts a specific event in response to the input of measurement data to obtain a detection result that is the output of the trained learning model; and an execution unit that, when the output result of the trained learning model differs from the judgment result by a user who has checked the measuring device in which the specific event was predicted, performs re-learning of the trained learning model using the label value input by the user and the collected measurement data to generate a re-learned model.

[0007] The present invention also provides a detection method in which a computer collects measurement data measured by a measuring device, inputs the collected measurement data into a trained learning model that predicts a specified event in response to the input of the measurement data, obtains an output result of the trained learning model, and, if a detection result that is the output of the trained learning model differs from a judgment result made by a user who confirmed the measuring device for which the specified event was predicted, performs re-learning of the trained learning model using the label value input by the user and the collected measurement data to generate a re-learned model.

[0008] The present invention also provides a detection program that causes a computer to execute a process of collecting measurement data measured by a measuring device, inputting the collected measurement data into a trained learning model that predicts a specified event in response to the input of the measurement data, obtaining a detection result that is the output of the trained learning model, and, if the output result of the trained learning model differs from the judgment result by a user who confirmed the measuring device for which the specified event was predicted, re-learning the trained learning model using the label value input by the user and the collected measurement data to generate a re-learned model. Effect of the Invention

[0009] According to the present invention, there is an effect that the accuracy of the learning model can be improved. [Brief description of the drawings]

[0010] [Figure 1] 1 is a diagram illustrating a configuration example and a processing example of an abnormality sign detection system according to an embodiment; [Diagram 2] 1 is a block diagram showing an example of the configuration of each device of an abnormality sign detection system according to an embodiment; [Diagram 3] FIG. 4 is a diagram illustrating a detection result storage unit of the server device according to the embodiment. [Figure 4] FIG. 4 is a diagram illustrating a determination result storage unit of the server device according to the embodiment. [Diagram 5] FIG. 4 is a diagram illustrating an evaluation index storage unit of the server device according to the embodiment. [Figure 6] FIG. 4 is a diagram illustrating a detection model storage unit of the server device according to the embodiment. [Figure 7] FIG. 4 is a diagram illustrating an example of a detection model according to the embodiment. [Figure 8] FIG. 2 is a diagram showing a specific example 1 of a display screen of a worker terminal according to the embodiment. [Figure 9] FIG. 11 is a diagram showing a specific example 2 of a display screen of a worker terminal according to the embodiment. [Figure 10] FIG. 11 is a diagram showing a specific example 3 of a display screen of the worker terminal according to the embodiment. [Figure 11] 4 is a flowchart showing an example of the overall processing flow of the anomaly sign detection system according to the embodiment. [Figure 12] 10 is a flowchart showing an example of a flow of a detection model construction process of the anomaly sign detection system according to the embodiment. [Figure 13] 10 is a flowchart showing an example of the flow of an abnormality sign output process of the abnormality sign detection system according to the embodiment. [Figure 14] FIG. 2 is a diagram illustrating an example of a hardware configuration according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, a detection device, a detection method, and a detection program according to an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiment described below.

[0012] [Embodiment] Below, we will explain the configuration and processing of the abnormality sign detection system 100 according to the embodiment, the configuration and processing of each device of the abnormality sign detection system 100, and the processing flow of the abnormality sign detection system 100, and finally the effects of the embodiment will be explained.

[0013] 1. Configuration and Processing of Abnormality Sign Detection System 100 The configuration and processing of the abnormality sign detection system 100 according to the embodiment will be described in detail with reference to Fig. 1. Fig. 1 is a diagram showing an example of the configuration and processing of the abnormality sign detection system 100 according to the embodiment. Below, an example of the overall configuration of the abnormality sign detection system 100, an example of the overall processing of the abnormality sign detection system 100, and problems with the abnormality sign detection system 100P according to the reference technology will be described in order, and finally, the effects of the abnormality sign detection system 100 will be described. Note that in the embodiment, factory production remote monitoring using plant equipment, which is a device installed in a plant, will be described as an example, but the device and field of use are not limited, and the present invention can also be applied to environmental measurement remote monitoring such as power monitors, wind power generation, water and sewage monitors, and river monitors.

[0014] (1-1. Example of the overall configuration of the abnormality sign detection system 100) An example of the overall configuration of an abnormality sign detection system 100 will be described with reference to Fig. 1. The abnormality sign detection system 100 includes a server device 10, a field device 20, and an operator terminal 30. The server device 10, the field device 20, and the operator terminal 30 are connected to each other via a predetermined communication network (not shown) so as to be able to communicate with each other by wire or wirelessly. The predetermined communication network may be any of various communication networks such as the Internet or a dedicated line.

[0015] (1-1-1. Server device 10) The server device 10 is a detection device installed in a cloud environment. Note that the anomaly sign detection system 100 shown in Fig. 1 may include a plurality of server devices 10. The server device 10 may be realized in an on-premise environment, an edge environment, or the like.

[0016] (1-1-2. Field device 20) The field device 20 is a plant device that constitutes a plant. In the example of Fig. 1, the field device 20 is realized by a Coriolis flowmeter.

[0017] (1-1-3. Worker terminal 30) The worker terminal 30 is used by a worker W who performs maintenance, inspection, etc. of the plant and the field devices 20, and accepts operations by the worker W. The worker terminal 30 is realized, for example, by a smartphone, a tablet terminal, a desktop PC (Personal Computer), a notebook PC, a smart watch, a mobile phone, a PDA (Personal Digital Assistant), etc. The example of FIG. 1 shows a case where the worker terminal 30 is realized by a smartphone.

[0018] (1-2. Example of overall processing of the abnormality sign detection system 100) An example of the overall processing of the abnormality sign detection system 100 will be described with reference to Fig. 1. Note that the processing of the following steps S1 to S11 may be executed in a different order. Also, some of the processing of the following steps S1 to S11 may be omitted.

[0019] (1-2-1. Measurement data acquisition process) The field device 20 acquires measurement data (step S1). For example, the field device 20 acquires sensor data such as phase difference data, frequency data, temperature data, drive current data, fluid pressure data, and density data as the measurement data.

[0020] (1-2-2. Measurement data transmission process) The field device 20 transmits the measurement data to the server device 10 (step S2). For example, the field device 20 transmits sensor data such as phase difference data, frequency data, temperature data, driving current data, fluid pressure data, and density data as the acquired measurement data to the server device 10.

[0021] (1-2-3. Anomaly detection process) The server device 10 detects a sign of abnormality (or, where appropriate, an "irregularity") in the plant from the measurement data (step S3). For example, the server device 10 detects a sign of abnormality in the plant using a trained detection model DM, which is an unsupervised learning model that outputs a sign of abnormality in the plant in response to input of measurement data.

[0022] Here, the abnormality sign is a state that may cause an abnormal state that has a negative impact on the plant, such as equipment failure, abnormal values, etc. In addition to the above abnormality signs, the server device 10 can also detect a period of normality, or an improvement sign that indicates a sign of an intermediate region of transition from an abnormality state to a normal state.

[0023] Furthermore, the server device 10 may detect an abnormality sign using one detection model DM, or may detect an abnormality sign using a plurality of detection models DM.

[0024] (1-2-4. Detection result transmission process) The server device 10 transmits the detection result to the operator terminal 30 (step S4). For example, the server device 10 transmits to the operator terminal 30, as the detection result, the sign of abnormality in the plant, the detection time, the identification information of the detected field device 20, and the like.

[0025] (1-2-5. Alert notification processing) The operator terminal 30 notifies the operator W of the alert (step S5). For example, when the operator terminal 30 receives the detection result from the server device 10, it displays the plant abnormality sign, the detection time, the identification information of the detected field device 20, etc. on the monitor screen, and prompts the operator W to check whether or not there is an abnormality sign in the plant.

[0026] (1-2-6. Detection result judgment process) The operator W judges whether the detection result is true or false (step S6). For example, the operator W visually checks whether there is a sign of abnormality in the field device 20 notified as the detection result, and judges whether the detection result is true or false. At this time, for example, when the field device 20 is a Coriolis flowmeter, the operator W judges that the abnormality sign is "true" if the fluid being measured contains slugs that are not found in a normal state, and judges that the abnormality sign is "false" if no difference from the normal state is observed.

[0027] (1-2-7. Judgment result input process) The worker W inputs the determination result to the worker terminal 30 (step S7). For example, the worker W operates an input screen displayed on the monitor screen of the worker terminal 30 to input whether the detection result is true or false.

[0028] (1-2-8. Judgment result transmission process) The worker terminal 30 transmits the determination result to the server device 10 (step S8). For example, the worker terminal 30 transmits the true or false for each detection result input by the worker W to the server device 10 as the determination result.

[0029] (1-2-9. Evaluation index calculation process) The server device 10 calculates an evaluation index from the determination result (step S9). For example, the server device 10 calculates an evaluation index within a predetermined period for each detection model DM, and transmits the calculated evaluation index to the operator terminal 30. Here, the evaluation index is a numerical value indicating the accuracy of the machine learning model, such as the accuracy rate, the precision rate, the recall rate, the specificity, the F-measure, etc.

[0030] In addition, the server device 10 generates a time series graph showing output data, measurement data, and the like of the abnormality sign within a predetermined period for each detection model DM, and transmits the generated time series graph to the operator terminal 30.

[0031] (1-2-10. Model re-learning process) The server device 10 re-learns the detection model DM (step S10). For example, the server device 10 re-learns a detection model DM among the multiple detection models DM for which the detection result is determined to be not true, using the measurement data, and updates various parameters. At this time, if the evaluation index of the detection model DM is less than a predetermined value, the server device 10 may re-learn the detection model DM using the measurement data and update various parameters.

[0032] (1-2-11. Model determination process) The server device 10 determines a detection model DM (step S11). For example, when the evaluation indexes of the multiple detection models DM are equal to or greater than a predetermined value, the server device 10 determines the detection model DM as a model to be used in the subsequent abnormality sign processing, for example, a model for detecting an abnormality sign in FIG. 13 described later (suitably referred to as an "adopted model"). At this time, the server device 10 may determine, as the adopted model, one or more detection models DM having evaluation indexes equal to or greater than a predetermined value among the multiple detection models DM. Furthermore, when there are multiple detection models DM determined as the adopted model, the server device 10 may notify the operator W of all detection results that are the output of the multiple detection models DM in the abnormality sign detection processing and detection result transmission processing of FIG. 13, or may notify the operator W of only the detection result that is the output of the detection model DM having the largest evaluation index among the multiple detection models DM.

[0033] Furthermore, the server device 10 may determine, as the adopted model, one or more detection models DM selected by the worker W based on the evaluation index or the time series graph from among the multiple detection models DM.

[0034] (1-3. Effects of the Anomaly Sign Detection System 100) In the following, an overview and problems of an abnormality sign detection system 100P according to the reference technology will be described, and then the effects of the abnormality sign detection system 100 will be described.

[0035] (1-3-1. Overview of the Anomaly Prediction Detection System 100P) The abnormality sign detection system 100P according to the reference technology executes the following processes. First, the abnormality sign detection system 100P performs unsupervised learning based on normal data collected in advance, extracts features of the normal data, and stores them as a normal state model. Second, the abnormality sign detection system 100P dynamically detects a normal judgment reference value that allows input data to be considered normal, based on unknown input data and a normal state model. Third, the abnormality sign detection system 100P calculates a judgment value for judging an abnormality of the input data, based on the input data and the normal state model. Fourth, the abnormality sign detection system 100P detects an abnormal state that deviates from the normal state, based on the normal judgment reference value and the judgment value, thereby detecting an abnormality sign of the input data.

[0036] (1-3-2. Problems with the Anomaly Sign Detection System 100P) The anomaly sign detection system 100P according to the reference technology has the following problems. First, in the anomaly sign detection system 100P, the data collected in advance is not labeled, so that it is not possible to calculate an evaluation index for the machine learning model. Second, in the anomaly sign detection system 100P, the machine learning model at the initial stage of introduction cannot be easily changed, so that it takes a lot of time to consider the machine learning model before introducing it to the plant.

[0037] (1-3-3. Overview of the Anomaly Sign Detection System 100) The abnormality sign detection system 100 according to the embodiment executes the following processes. First, the server device 10 collects measurement data transmitted by the field devices 20, and inputs the measurement data into the detection model DM to detect an abnormality sign in the plant. At this time, the server device 10 prepares a plurality of unsupervised learning models obtained in advance from a learning data set, learns time-series data for re-learning the model based on the obtained trained model, and notifies the output abnormality sign to the operator W. Second, the server device 10 accepts a judgment result for the detection result input by the operator W. At this time, when the operator W is notified of the abnormality sign, the operator W inputs whether the abnormality sign, i.e., the anomaly is correct (true abnormality: true positive, false abnormality: false positive) in an application on the operator terminal 30 such as a smartphone or PC. Here, a "true positive" is a situation in which the abnormality sign is detected by the server device 10 (anomaly is present) and the operator W confirms the abnormality sign (anomaly: correct). Moreover, a "false positive" is a situation in which the server device 10 detects an abnormality sign (sense of something strange), but the worker W is unable to confirm the abnormality sign (sense of something strange: incorrect).

[0038] (1-3-4. Effects of the Anomaly Sign Detection System 100) The abnormal sign detection system 100 has the following advantages. First, the abnormal sign detection system 100 can compare multiple detection models DM to determine which detection model DM is preferable by calculating an evaluation index, so that an appropriate trained detection model DM can be selected even when a change occurs in the normal range or work process. Second, the abnormal sign detection system 100 uses multiple detection models DM simultaneously to detect abnormal signs and compares them with the on-site judgment results from the worker W, making it possible to update the detection models DM, eliminating the need for detailed inspection before introducing them into the plant.

[0039] As described above, in the abnormality sign detection system 100, the detection model DM obtained by unsupervised learning can be updated to construct an optimal detection model DM, thereby improving the accuracy of the detection model DM for detecting abnormality signs in a plant. Furthermore, the abnormality sign detection system 100 can adopt the optimal model from among multiple models.

[0040] Furthermore, the abnormality sign detection system 100 has the following effects. The abnormality sign detection system 100 allows easy and intuitive operation by the worker W, so that the plant user can easily introduce the abnormality sign detection system 100 to the plant. In addition, a lot of domain knowledge and empirical rules are required to select a learning model, and the knowledge and empirical rules are required from the vendor of the learning model, but the abnormality sign detection system 100 uses on-site data on the plant user side as the basis for model selection, so the plant user side can conceal the data and domain knowledge from the vendor. In addition, the learning model must be changed when the work process is changed or a different device is introduced, but the abnormality sign detection system 100 allows the learning model to be reconstructed by performing the same work, so that the plant user side does not need to consult with the vendor again to reconstruct the learning model. In addition, the abnormality sign detection system 100 allows the basis for an experienced person's decision on what grounds to consider something abnormal to be modeled, so it can be used to resolve the shortage of successors and to educate inexperienced workers W. Furthermore, with the abnormality sign detection system 100, the vendor does not need to consult on or provide an abnormality sign detection solution tailored to the application or plant user, making it possible to generalize the solution.

[0041] 2. Configuration and Processing of Each Device of the Anomaly Sign Detection System 100 The configuration and processing of each device included in the abnormality sign detection system 100 shown in Fig. 1 will be described with reference to Fig. 2. Fig. 2 is a block diagram showing an example of the configuration of each device of the abnormality sign detection system 100 according to the embodiment. Below, an example of the overall configuration of the abnormality sign detection system 100 according to the embodiment will be described, and then an example of the configuration and processing of the server device 10, the field device 20, and the worker terminal 30 according to the embodiment will be described in detail.

[0042] (2-1. Example of the overall configuration of the abnormality sign detection system 100) An example of the overall configuration of the abnormality sign detection system 100 shown in FIG. 1 will be described with reference to FIG. 2. As shown in FIG. 2, the abnormality sign detection system 100 has a server device 10, a field device 20, and an operator terminal 30. The server device 10 is communicatively connected to the field device 20 and the operator terminal 30 via a communication network N realized by the Internet, a dedicated line, or the like. The server device 10 is installed in a cloud environment. The field device 20 is installed in a plant. The server device 10 may be installed in an on-premise environment, an edge environment, or the like.

[0043] (2-2. Configuration and Processing Examples of Server Device 10) A configuration example and a processing example of the server device 10 will be described with reference to Fig. 2. The server device 10 has an input unit 11, an output unit 12, a communication unit 13, a storage unit 14, and a control unit 15. Although a configuration example and a processing example of the server device 10 will be described below, the field device 20 can also execute the same processing. In other words, the abnormality sign detection system 100 can be realized with only the field device 20.

[0044] (2-2-1. Input section 11) The input unit 11 is responsible for inputting various types of information to the server device 10. For example, the input unit 11 is realized by a mouse, a keyboard, etc., and accepts input of various types of information to the server device 10.

[0045] (2-2-2. Output section 12) The output unit 12 controls the output of various information from the server device 10. For example, the output unit 12 is realized by a display or the like, and displays various information stored in the server device 10.

[0046] (2-2-3. Communications Department 13) The communication unit 13 manages data communication with other devices. For example, the communication unit 13 performs data communication with each communication device via a router, etc. The communication unit 13 can also perform data communication with an operator's terminal (not shown).

[0047] (2-2-4. Storage section 14) The storage unit 14 stores various information referenced when the control unit 15 operates and various information acquired when the control unit 15 operates. The storage unit 14 has a detection result storage unit 14a, a judgment result storage unit 14b, an evaluation index storage unit 14c, and a detection model storage unit 14d. Here, the storage unit 14 can be realized by, for example, a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. In the example of FIG. 2, the storage unit 14 is installed inside the server device 10, but may be installed outside the server device 10, or multiple storage units may be installed.

[0048] (2-2-4-1. Detection result storage unit 14a) The detection result storage unit 14a stores the detection results. For example, the detection result storage unit 14a stores the detection results detected by a detection unit 15b of the control unit 15 described later. Here, an example of data stored in the detection result storage unit 14a will be described with reference to FIG. 3. FIG. 3 is a diagram showing an example of the detection result storage unit 14a of the server device 10 according to the embodiment. In the example of FIG. 3, the detection result storage unit 14a has items such as "Plant", "Detection result", "Detection model", "Detection time", and "Field device".

[0049] "Plant" indicates identification information for identifying the plant to be monitored, such as the identification number or identification symbol of the plant. "Detection result" indicates identification information for identifying the detection result, such as the identification number or identification symbol of the abnormality sign detected by the detection unit 15b. "Detection model" indicates identification information for identifying the machine learning model, such as the identification number or identification symbol of the detection model DM that outputs the abnormality sign. "Detection time" indicates the time when the detection result was detected, such as the year, month, day, hour, minute, and second. "Field device" indicates identification information for identifying the field device 20 that acquired the measurement data, such as the identification number or identification symbol of the device name or model number of the field device 20.

[0050] That is, FIG. 3 shows an example in which data for a plant identified by "Plant PS001" is stored in the detection result memory unit 14a, such as "Detection result #1" {detection model: "Detection model DM001", detection time: "10:10:00", field device: "FI001"}, "Detection result #2" {detection model: "Detection model DM002", detection time: "10:10:00", field device: "FI001"}, "Detection result #3" {detection model: "Detection model DM003", detection time: "14:30:00", field device: "FI001"}, etc.

[0051] (2-2-4-2. Judgment result storage unit 14b) The judgment result storage unit 14b stores the judgment result. For example, the judgment result storage unit 14b stores the judgment result input by the worker W and transmitted from the worker terminal 30. Here, an example of data stored in the judgment result storage unit 14b will be described with reference to FIG. 4. FIG. 4 is a diagram showing an example of the judgment result storage unit 14b of the server device 10 according to the embodiment. In the example of FIG. 4, the judgment result storage unit 14b has items such as "Plant", "Detection result", and "Judgment result".

[0052] "Plant" indicates identification information for identifying the plant to be monitored, such as the identification number or identification symbol of the plant. "Detection result" indicates identification information for identifying the detection result, such as the identification number or identification symbol of an abnormality sign detected by detection unit 15b. "Judgment result" indicates a judgment result corresponding to the detection result, such as a judgment of the truth or falsity of an abnormality sign confirmed by operator W.

[0053] That is, Figure 4 shows an example in which data for a plant identified by "Plant PS001" in which the judgment as to whether the abnormal sign corresponding to "Detection result #1" is true or false is "Judgment result #1," the judgment as to whether the abnormal sign corresponding to "Detection result #2" is true or false is "Judgment result #2," the judgment as to whether the abnormal sign corresponding to "Detection result #3" is true or false is "Judgment result #3," etc. are stored in the judgment result memory unit 14b.

[0054] (2-2-4-3. Evaluation index storage unit 14c) The evaluation index storage unit 14c stores evaluation indexes. For example, the evaluation index storage unit 14c stores an evaluation index for each detection model DM calculated by an execution unit 15c of the control unit 15, which will be described later. Here, an example of data stored in the evaluation index storage unit 14c will be described with reference to FIG. 5. FIG. 5 is a diagram showing an example of the evaluation index storage unit 14c of the server device 10 according to the embodiment. In the example of FIG. 5, the evaluation index storage unit 14c has items such as "detection model", "evaluation index", and "calculation time".

[0055] "Detection model" indicates identification information for identifying the learning model, such as an identification number or identification symbol of the detection model DM that output an anomaly sign. "Evaluation index" indicates an evaluation index that is a numerical value indicating the accuracy of the learning model, such as the accuracy rate, precision, recall, specificity, F-score, etc. of the detection model DM. "Calculation time" indicates the time when the evaluation index was calculated, and is expressed, for example, as year / month / day, hour / minute / second.

[0056] That is, Figure 5 shows an example in which the following data is stored in the evaluation index memory unit 14c: for the detection model DM identified by "detection model DM001", {evaluation index 1 (accuracy rate): "80%", evaluation index 2 (suitability rate): "75%, calculation time: "10:30:00", ···}, for the detection model DM identified by "detection model DM002", {evaluation index 1 (accuracy rate): "75%, evaluation index 2 (suitability rate): "70%, calculation time: "10:30:00", ···}, for the detection model DM identified by "detection model DM003", {evaluation index 1 (accuracy rate): "90%, evaluation index 2 (suitability rate): "85%, calculation time: "15:00:00", ···}, ··

[0057] (2-2-4-4. Detection model storage unit 14d) The detection model storage unit 14d stores a detection model DM. For example, the detection model storage unit 14d stores a detection model DM used by a detection unit 15b of the control unit 15 described later. Here, an example of data stored in the detection model storage unit 14d will be described with reference to FIG. 6. FIG. 6 is a diagram showing an example of the detection model storage unit 14d of the server device 10 according to the embodiment. In the example of FIG. 6, the detection model storage unit 14d has an item such as "detection model."

[0058] A "detection model" is model data of a machine learning model, and is data including model parameters, hyperparameters, etc., which are execution data for executing the algorithm of the detection model DM.

[0059] That is, Figure 6 shows an example in which data such as "detection model DM001," "detection model DM002," "detection model DM003," etc. are stored in the detection model memory unit 14d as model data of the detection model DM used by the detection unit 15b.

[0060] Here, a specific example of a detection model DM in binary classification in which measurement data collected from a Coriolis flowmeter is used as input data and abnormality prediction data is used as output data will be described with reference to Fig. 7. Note that Fig. 7 describes an example of a detection model DM using a neural network, but it may be an isolation forest, one-class SVM (Support-Vector Machine), or the like, and is not particularly limited.

[0061] In the example of Figure 7, the detection model DM accepts sensor data such as phase difference data, frequency data, temperature data, driving current data, fluid pressure data, and density data in the input layer, analyzes the received sensor data in the middle layer, and outputs abnormality sign data such as "signs of abnormality present" or "no signs of abnormality present" in the output layer.

[0062] The detection model DM is constructed using a learning model that learns normal data by unsupervised learning of Hotelling's T2 theory, local outlier factor method, neural network system such as autoencoder, self-organizing map, one-class support vector machine, classification tree system such as isolation forest, change point detection, k-nearest neighbor method, k-means method, and density-based clustering, and outputs a result of classifying different behavior as an abnormality sign, i.e., an anomaly. In addition, the detection model DM uses one or more of the sensor data obtained inside the field device 20 in the input layer.

[0063] (2-2-5. Control unit 15) Returning to Fig. 2, the control unit 15 controls the entire server device 10. The control unit 15 has a collection unit 15a, a detection unit 15b, and an execution unit 15c. Here, the control unit 15 can be realized by, for example, an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0064] (2-2-5-1. Collection section 15a) The collecting unit 15a collects various types of information. The collecting unit 15a may store the collected various types of information in the storage unit 14. For example, the collecting unit 15a collects measurement data measured by a measurement device.

[0065] To explain a specific example, the collection unit 15a collects the measurement data transmitted by the field device 20, which is a Coriolis flowmeter, in chronological order as follows: “measurement data 001” {phase difference data: “phase difference data 001”, frequency data: “frequency data 001”, temperature data: “temperature data 001”, driving current data: “driving current data 001”, fluid pressure data: “fluid pressure data 001”, density data: “density data 001”}, “measurement data 002” {phase difference data: “phase difference data 002”, frequency data: “frequency data 002”, temperature data: “temperature data 002”, driving current data: “driving current data 002”, fluid pressure data: “fluid pressure data 002”, density data: “density data 002”}, ...

[0066] (2-2-5-2. Detection unit 15b) The detection unit 15b executes a process related to the detection result. The detection unit 15b stores various information in the storage unit 14. The detection unit 15b also acquires various information stored in the storage unit 14. The detection unit 15b also acquires various information collected by the collection unit 15a. The event prediction detection process and the detection result transmission process will be described below.

[0067] (Event prediction and detection processing) The detection unit 15b acquires the output result of the detection model DM and detects a prediction of an event. The detection unit 15b stores the detection result in the detection result storage unit 14a. For example, the detection unit 15b inputs collected measurement data into the detection model DM, which is a learned model that has been trained to predict a specific event in response to input of measurement data, acquires the detection result that is the output of the learned detection model DM, and detects the detection result as a prediction of an event. The detection unit 15b also acquires the detection result that is the output of each of a plurality of learned detection models DM that predict a specific event, and detects the detection result as a prediction of an event.

[0068] Here, the trained detection model DM is a learning model trained by unsupervised learning using each measurement data that is a normal value among a plurality of measurement data collected during a predetermined period as training data.

[0069] In addition, event predictions include an "abnormal prediction" which is a sign of an abnormal state of the monitored object, a "normal prediction" which is a sign of a normal state of the monitored object, and an "improvement prediction" which is a sign of the monitored object being improved, i.e., an intermediate range of transition from an abnormal state to a normal state.

[0070] As the "abnormality prediction", the detection unit 15b detects, based on the measurement data acquired by the field device 20 of the plant, a sign of an abnormal state such as "sign of abnormality present" corresponding to a sign of a failure or an abnormal value occurrence in the field device 20. At this time, the detection unit 15b may detect the absence of a sign of an abnormal state such as "no sign of abnormality", that is, a sign of a normal state described later.

[0071] In addition, the detection unit 15b can also detect, as a "normal prediction," signs of a normal state, such as "normal signs" that the field device 20 will transition to normal operation in the future, based on the measurement data acquired by the field device 20 in the plant.

[0072] Furthermore, as the "improvement prediction", the detection unit 15b can also detect a sign of an improvement state, such as "sign of improvement", in which the current abnormal or abnormality predictor state of the field device 20 will transition to an improvement in the future abnormal value, based on the measurement data acquired by the field device 20 of the plant. At this time, the detection unit 15b may detect that there is no sign of an improvement state, such as "no sign of improvement".

[0073] To explain a specific example, the detection unit 15b inputs, as input data, "measurement data 001" {phase difference data: "phase difference data 001", frequency data: "frequency data 001", temperature data: "temperature data 001", drive current data: "drive current data 001", fluid pressure data: "fluid pressure data 001", density data: "density data 001"} collected from field device 20, which is a Coriolis flowmeter, into each of "detection model DM001", "detection model DM002", and "detection model DM003", and obtains, as output data, {detection model DM001: "signs of abnormality present", detection model DM002: "signs of abnormality present", detection model DM003: "no signs of abnormality present"}. Furthermore, the detection unit 15b inputs, as input data, "measurement data 002" {phase difference data: "phase difference data 002", frequency data: "frequency data 002", temperature data: "temperature data 002", drive current data: "drive current data 002", fluid pressure data: "fluid pressure data 002", density data: "density data 002"} collected from the field device 20, which is a Coriolis flowmeter, into each of the "detection model DM001", "detection model DM002", and "detection model DM003", and obtains, as output data, {detection model DM001: "no signs of abnormality", detection model DM002: "no signs of abnormality", detection model DM003: "signs of abnormality present"}.

[0074] (Detection result transmission process) When the detection unit 15b acquires the output result of the detection model DM, the detection unit 15b transmits the acquired output result as a detection result to the terminal used by the user, and notifies the user of the detection result.

[0075] The detection unit 15b notifies a user when the output result of the trained detection model DM corresponds to a sign of an abnormal state. For example, when the detection unit 15b detects an abnormality prediction based on the measurement data acquired by the field device 20 of the plant, the detection unit 15b transmits the detection result regarding the abnormality prediction to the operator terminal 30 and notifies the operator W of the plant by displaying the detection result such as "there is a sign of abnormality".

[0076] Furthermore, the detection unit 15b notifies the user when the output result of the trained detection model DM corresponds to a sign of a normal state. For example, when the detection unit 15b detects a normal prediction based on the measurement data acquired by the field device 20 of the plant, the detection unit 15b transmits the detection result regarding the normal prediction to the operator terminal 30 and notifies the operator W of the plant by displaying the detection result such as "normal sign."

[0077] Furthermore, the detection unit 15b notifies the user when the output result of the trained detection model DM corresponds to a sign of an improvement state. For example, when the detection unit 15b detects an improvement prediction based on the measurement data acquired by the field device 20 of the plant, the detection unit 15b transmits the detection result regarding the improvement prediction to the operator terminal 30 and notifies the plant operator W by displaying the detection result such as "there is a sign of improvement".

[0078] To explain a specific example, the detection unit 15b transmits the detection result of "detection model DM001" {detection result: "detection result #1", detection time: "10:10:00", field device: "FI001"}, the detection result of "detection model DM002" {detection result: "detection result #2", detection time: "10:10:00", field device: "FI001"}, and the detection result of "detection model DM003" {detection result: "detection result #3", detection time: "14:30:00", field device: "FI001"} to the worker terminal 30 used by the worker W at the plant, and displays them on the input / output unit 31, which is the monitor screen of the worker terminal 30.

[0079] (2-2-5-3. Executive Unit 15c) The execution unit 15c executes a process related to the adoption or re-learning of the detection model DM. The execution unit 15c acquires various information stored in the storage unit 14. The execution unit 15c also acquires various information collected by the collection unit 15a. The execution unit 15c also acquires various information output by the detection unit 15b. The following describes the re-learning execution process, score calculation process, time series graph generation process, and detection model determination.

[0080] (Relearning execution process) When the detection result of the detection model DM, which is a trained learning model, differs from the judgment result by the worker W, who is a user who confirmed the device in which a predetermined event is predicted, the execution unit 15c performs re-learning of the trained detection model DM using the label value input by the worker W and the collected measurement data to generate a re-learned model. In addition, the execution unit 15c performs re-learning of the trained detection model DM by supervised learning in which a label value based on the judgment result is assigned to the collected measurement data as teacher data. In addition, when the detection result, which is the output of the trained learning model, corresponds to a sign of an abnormal state and the worker W has not confirmed an abnormal state or an abnormal sign in the measuring device, the execution unit 15c performs re-learning of the trained detection model DM using teacher data in which the presence or absence of an abnormal state or an abnormal sign state based on the judgment result is assigned to the collected measurement data as a label value.

[0081] To explain a specific example, the execution unit 15c inputs "measurement data 001" collected from a field device 20 that is a Coriolis flowmeter as input data into the "detection model DM002" and obtains {detection model DM002: "Signs of abnormality present"} as output data. If the output data is a false positive that differs from the judgment result input by the operator W, the execution unit 15c re-learns the "detection model DM002" using as training data the teacher data in which the "measurement data 001" used in the above processing has been assigned the label value "no signs of abnormality", and updates the model parameters and hyperparameters.

[0082] In addition, the execution unit 15c executes re-learning of the trained detection model DM based on the evaluation index. For example, the execution unit 15c executes re-learning of the trained detection model DM whose evaluation index is less than a predetermined value.

[0083] To explain a specific example, the execution unit 15c calculates the accuracy rate as an evaluation index of the "detection model DM002" by the evaluation index calculation process described below, and if the accuracy rate is less than "75%, "re-learns the "detection model DM002" using the "measurement data 001" used in the above process as training data, and updates the model parameters and hyperparameters.

[0084] (Evaluation index calculation process) The execution unit 15c calculates an evaluation index of the trained detection model DM based on the output result of the trained detection model DM and the judgment result by the worker W who confirmed the measurement device for which the predetermined event was predicted. The execution unit 15c also calculates at least one of the accuracy rate, the precision rate, the recall rate, the specificity, and the F-measure as an evaluation index based on the detection results of each of the multiple trained detection models DM and the judgment result by the worker W who confirmed the device for which the predetermined event was predicted. The execution unit 15c also causes the worker terminal 30 used by the worker W to display the calculated evaluation index.

[0085] The execution unit 15c calculates the accuracy rate, the precision rate, the recall rate, the specificity, the F-value, etc., within a predetermined period as the evaluation indexes. For example, the execution unit 15c calculates the precision rate as the evaluation indexes of the detection model DM that outputs only "signs of abnormality present" (positive), calculates the accuracy rate, the recall rate, and the F-value as the evaluation indexes of the detection model DM that outputs only "signs of abnormality present" (positive) and "no signs of abnormality present" (negative), and calculates the specificity as the evaluation index of the detection model DM that outputs only "no signs of abnormality present" (negative).

[0086] In the following, the evaluation indexes calculated by the execution unit 15c will be described in the order of accuracy rate, precision rate, recall rate, specificity, and F-value. In the following description of each evaluation index, the presence of a prediction of a predetermined event such as an abnormality sign detected by the detection unit 15b is referred to as "positive", the absence of a prediction of a predetermined event detected by the detection unit 15b is referred to as "negative", the presence of a prediction of a predetermined event judged to be correct by the confirmation of the operator W is referred to as "true positive", the presence of a prediction of a predetermined event judged to be incorrect by the confirmation of the operator W is referred to as "false positive", the absence of a prediction of a predetermined event judged to be correct by the confirmation of the operator W is referred to as "true negative", and the absence of a prediction of a predetermined event judged to be incorrect by the confirmation of the operator W is referred to as "false negative".

[0087] (Accuracy rate) If, out of 200 output results of "detection model DM003" that are "signs of abnormality present" and "no signs of abnormality present," 85 are true positives, 15 are false positives, 75 are true negatives, and 25 are false negatives, then the accuracy rate = (true positives + true negatives) / (true positives + false positives + true negatives + false negatives) = 85 + 75 / 200 = 0.90, and therefore the execution unit 15c calculates "90%" as the evaluation index for "detection model DM003."

[0088] (precision rate) If, out of 100 output results of "detection model DM003" that indicate "signs of abnormality," 85 results are true positives and 15 results are false positives, then the execution unit 15c calculates "85%" as the evaluation index for "detection model DM003," since the precision rate = (true positive) / (true positive + false positive) = 85 / 100 = 0.85.

[0089] (recall rate) If, out of 200 output results of "detection model DM002" that are "signs of abnormality present" and "no signs of abnormality present," 70 are true positives, 30 are false positives, 80 are true negatives, and 20 are false negatives, then the recall rate = (true positives) / (true positives + false negatives) = 70 / 70 + 20 = 0.777, and therefore the execution unit 15c calculates "78%" as the evaluation index for "detection model DM002."

[0090] (specificity) If, out of 100 output results of "detection model DM001" that are "no signs of abnormality," 85 are true negatives and 15 are false negatives, then specificity = (true negative) / (true negative + false negative) = 85 / 100 = 0.85, so the execution unit 15c calculates "85%" as the evaluation index for "detection model DM001."

[0091] (F value) If, out of 200 output results of "detection model DM002" that are "signs of abnormality present" and "no signs of abnormality present," 70 are true positives, 30 are false positives, 80 are true negatives, and 20 are false negatives, then the F-value (β=1) = (true positive) / {true positive + (false positive + false negative) / 2} = 70 / {70 + (30 + 20) / 2} = 0.736, and therefore the execution unit 15c calculates "74%" as the evaluation index for "detection model DM002."

[0092] (Time series graph generation process) The execution unit 15c generates a time series graph showing the output results of each of the multiple trained detection models DM and the history of the collected measurement data. In addition, the execution unit 15c causes the worker terminal 30 used by the worker W to display the evaluation index and the time series graph.

[0093] To explain a specific example, the execution unit 15c displays, as a time series graph of the "detection model DM001," "measurement data 001," "measurement data 002," "measurement data 003," ... collected from the field device 20, which is a Coriolis flowmeter, as a line graph, and generates a time series graph in which the detection time at which the "detection model DM001" outputs "signs of abnormality present" is displayed in color, transmits the generated time series graph data to the operator terminal 30, and displays the time series graph on the input / output unit 31, which is the monitor screen of the operator terminal 30.

[0094] The execution unit 15c also generates a screen (normal state screen) showing the normal state, which is the detection result. The execution unit 15c also displays the generated screen on the worker terminal 30 used by the worker W in a form that can be switched between displayed and hidden by the operation of the worker W.

[0095] To explain a specific example, the execution unit 15c generates a time series graph showing the current normal operation or future normal operation of the field device 20, which is a Coriolis flowmeter, as a normal state screen of the "detection model DM001," transmits the generated time series graph data to the operator terminal 30, and displays the time series graph on the input / output unit 31, which is the monitor screen of the operator terminal 30. At this time, the execution unit 15c may generate time series graph data including buttons such as "normal state notification ON," "normal state notification OFF," and the like, and display the normal state screen on the operator terminal 30 so that it can be switched between display and non-display by an operation by the operator W.

[0096] (Model determination process) The execution unit 15c decides to adopt a trained detection model DM having an evaluation index equal to or greater than a predetermined value among the multiple trained detection models DM. In addition, the execution unit 15c decides to adopt a trained detection model DM selected by the operator W among the multiple trained detection models DM.

[0097] To explain a specific example, if the evaluation index of "detection model DM001" is "80%, the evaluation index of "detection model DM002" is "75%, and the evaluation index of "detection model DM003" is "85%," and the reference value for adopting the evaluation index is set to "80%," the execution unit 15c determines "detection model DM001" and "detection model DM003" as the adopted models and uses them in the processing of the detection unit 15b after the determination.

[0098] In addition, the execution unit 15c displays the evaluation indexes of "detection model DM001", "detection model DM002", and "detection model DM003", as well as time series graphs of "detection model DM001", "detection model DM002", and "detection model DM003" on the worker terminal 30, and when the worker W selects "detection model DM001" on the display screen, it determines "detection model DM003" as the adopted model and uses it in the processing of the detection unit 15b after the determination.

[0099] (2-3. Example of configuration and processing of field device 20) An example of the configuration and processing of the field device 20 will be described with reference to Fig. 2. The field device 20 is a sensor device such as a thermometer, a pressure gauge, a flow meter, or the like, and includes an acquisition unit 21 and a communication unit 22.

[0100] (2-3-1. Acquisition part 21) The acquiring unit 21 acquires measurement data. For example, the acquiring unit 21 acquires sensor data such as phase difference data, frequency data, temperature data, driving current data, fluid pressure data, and density data as the measurement data. Here, the measurement data includes sensor data acquired from each sensor, or calculated data secondarily calculated from the sensor data. For example, when the field device 20 is a Coriolis flowmeter, the acquiring unit 21 performs calculation processing on mass flow data, density data, and the like, and outputs the data, and in the calculation processing process, measures or calculates temperature data, phase difference data, frequency data, driving current data, fluid pressure data, and the like.

[0101] (2-3-2. Communications section 22) The communication unit 22 manages data communication with other devices. For example, the communication unit 22 performs data communication with each communication device via a router, etc. The communication unit 22 can also perform data communication with an operator's terminal (not shown).

[0102] (2-4. Configuration and Processing Examples of the Worker Terminal 30) An example of the configuration and processing of the worker terminal 30 will be described with reference to Fig. 2. The worker terminal 30 is a terminal used by a worker W who performs maintenance, inspection, etc. of the plant and the field devices 20, and includes an input / output unit 31, a transmission / reception unit 32, and a communication unit 33.

[0103] (2-4-1. Input / output section 31) The input / output unit 31 is responsible for inputting various types of information to the worker terminal 30. For example, the input / output unit 31 is realized by a mouse, a keyboard, a touch panel, or the like, and accepts input of setting information and the like to the worker terminal 30. The input / output unit 31 also displays various types of information from the worker terminal 30. For example, the input / output unit 31 is realized by a display or the like, and displays the setting information and the like stored in the worker terminal 30.

[0104] The input / output unit 31 displays a confirmation result input screen on which the worker W inputs the determination result. Details of the confirmation result input screen will be described later in (2-4-4. Specific example 1 of display screen of worker terminal 30). The input / output unit 31 also displays a detection model determination screen that enables the worker W to select a detection model DM. Details of the detection model determination screen will be described later in (2-4-5. Specific example 2 of display screen of worker terminal 30) and (2-4-6. Specific example 3 of display screen of worker terminal 30).

[0105] (2-4-2. Transmitter / receiver 32) The transmitting / receiving unit 32 transmits various information. For example, the transmitting / receiving unit 32 transmits the determination result input by the worker W on the confirmation result input screen to the server device 10. In addition, the transmitting / receiving unit 32 transmits identification information of the detection model DM selected by the worker W on the detection model determination screen to the server device 10.

[0106] The transmitting / receiving unit 32 receives various information. For example, the transmitting / receiving unit 32 receives from the server device 10 the detection result, the evaluation index, the time series graph, and the like to be notified to the worker W.

[0107] (2-4-3. Communications Department 33) The communication unit 33 manages data communication with other devices. For example, the communication unit 33 performs data communication with each communication device via a router, etc. The communication unit 33 can also perform data communication with an operator's terminal (not shown).

[0108] (2-4-4. Specific Example 1 of Display Screen of Worker Terminal 30) Here, a specific example 1 of a display screen output by the input / output unit 31 of the worker terminal 30 will be described with reference to Fig. 8. Fig. 8 is a diagram showing a specific example 1 of a display screen of the worker terminal 30 according to the embodiment. The following describes the "detection result determination screen" displayed on the "discomfort detection system confirmation result input screen."

[0109] (2-4-4-1. Detection result judgment screen) As shown in the example of FIG. 8, the operator terminal 30 displays "detection result," "detection time," "field device," and "determination" for each plant. In the example of FIG. 8, the operator terminal 30 displays, for the detection result "detection result #1," the detection time of the anomaly that is a sign of anomaly is "10:10:00," the field device 20 that transmitted the measurement data is "FI001," and a check box for inputting the truth or falsity of "detection result #1." At this time, if the result of checking "detection result #1" at the plant site is "true" the same as the detection result, the operator W inputs the determination result by clicking the "true" check box of "determination." Similarly, if the result of checking "detection result #2" at the plant site is "false" different from the detection result, the operator W inputs the determination result by clicking the "false" check box of "determination," and if the result of checking "detection result #3" at the plant site is "true," the operator W inputs the determination result by clicking the "true" check box of "determination." Then, when the worker W has input all the judgment results, the worker W can transmit the judgment results to the server device 10 by clicking the "send" button.

[0110] If the results confirmed at the plant site cannot be judged as either "true" or "false," the worker W can input the judgment result by clicking the "unknown" checkbox under "judgment." At this time, the detection results for which "unknown" is checked are excluded from the teacher data to which label values ​​are assigned, and are also excluded from the calculation of the evaluation index.

[0111] (2-4-4-2. Display format) As shown in the example of Fig. 8, the operator terminal 30 can display the detection results in the order of the detection time of the abnormality signs. In the example of Fig. 8, "Display in order of detection" is selected as a pull-down menu on the operator terminal 30, so the detection results are displayed in the order of the detection time of the abnormality signs. At this time, the operator terminal 30 may display the detection results for each detection model DM or field device 20.

[0112] (2-4-5. Specific Example 2 of Display Screen of Worker Terminal 30) Here, a specific example 2 of a display screen output by the input / output unit 31 of the worker terminal 30 will be described with reference to Fig. 9. Fig. 9 is a diagram showing a specific example 2 of a display screen of the worker terminal 30 according to the embodiment. The following describes the "evaluation index display screen" displayed on the "discomfort detection system detection model determination screen".

[0113] (2-4-5-1. Evaluation index display screen) As shown in the example of Fig. 9, the operator terminal 30 displays "adoption", "detection model", "evaluation index 1 (correct rate)", "evaluation index 2 (conformance rate)", ... for each plant. In the example of Fig. 8, the operator terminal 30 displays a list of evaluation indexes in which, for the "detection model DM003", the "evaluation index 1 (correct rate)" is "90%" and the "evaluation index 2 (conformance rate)" is "85%", for the "detection model DM001", the "evaluation index 1 (correct rate)" is "80%" and the "evaluation index 2 (conformance rate)" is "75%", and for the "detection model DM002", the "evaluation index 1 (correct rate)" is "75%" and the "evaluation index 2 (conformance rate)" is "70%". At this time, when worker W selects "detection model DM003" and "detection model DM001" whose "evaluation index 2 (fit rate)" is "75%" or more as adopted models, worker W clicks the "Adopt" checkbox of "detection model DM003" and the "Adopt" checkbox of "detection model DM001". Then, when worker W determines the adopted model, he / she can transmit the selection result of the adopted model to server device 10 by clicking the "Determine" button.

[0114] (2-4-5-2. Display format) As shown in the example of Fig. 9, the operator terminal 30 can display the detection models DM in descending order of the evaluation index. In the example of Fig. 9, "Display in descending order of score" is selected as a pull-down menu on the operator terminal 30, so that the evaluation indexes of the detection models DM are displayed in descending order of the numerical value of "Evaluation index 1 (correctness rate)" or "Evaluation index 2 (suitability rate)". At this time, the operator terminal 30 may display the detection results for each type of algorithm of the detection model DM, etc.

[0115] (2-4-6. Specific Example 3 of Display Screen of Worker Terminal 30) Here, a specific example 3 of a display screen output by the input / output unit 31 of the worker terminal 30 will be described with reference to Fig. 10. Fig. 10 is a diagram showing a specific example 3 of a display screen of the worker terminal 30 according to the embodiment. The following describes the "time-series data display screen" displayed on the "discomfort detection system detection model determination screen."

[0116] (2-4-6-1. Detection result judgment screen) As shown in the example of FIG. 10, the operator terminal 30 displays a time series graph of "detection model DM001", "detection model DM002", ... for each plant. In the example of FIG. 10, the operator terminal 30 displays a line graph showing the numerical values ​​of the measurement data "Data 1" and "Data 2" of the field device 20 together with a figure showing the detection of "Uncomfortable 1", "Uncomfortable 2", "Uncomfortable 3", and "Uncomfortable 4" as abnormality signs for the "detection model DM001". In addition, the operator terminal 30 displays a line graph showing the numerical values ​​of the measurement data "Data 1" and "Data 2" of the field device 20 together with a figure showing the detection of "Uncomfortable 1" and "Uncomfortable 2" as abnormality signs for the "detection model DM002". At this time, when the operator W selects the "detection model DM001" as the adopted model, he / she clicks the "Adopt" checkbox of the "detection model DM001". When the operator W determines the adopted model, he / she can transmit the selection result of the adopted model to the server device 10 by clicking the "Determine" button.

[0117] (2-4-6-2. Display format) As shown in the example of FIG. 10, the worker terminal 30 can select and display data necessary for determining the adopted model. In the example of FIG. 10, "Display detection results and measurement data" is selected as a pull-down menu on the worker terminal 30, so "discomfort" which is the detection result and "data" which is the measurement data are displayed. At this time, the worker terminal 30 can display only the detection result or only the measurement data. In addition, the worker terminal 30 may display the evaluation index of the detection model DM superimposed on the above-mentioned time series graph.

[0118] (2-4-6-3. Entering the judgment result) The worker W can also input whether the detection result is true or false by operating on the time series graph. For example, the worker W can input that the detection result is "true" by double-clicking on the diamond shape of the figure indicating "discomfort", which is the detection result.

[0119] 3. Processing flow of the abnormality prediction system 100 11 to 13, the process flow of the abnormality sign detection system 100 according to the embodiment will be described. Below, the process flow of the entire abnormality sign detection system 100 will be described, followed by the detection model construction process and the abnormality sign output process.

[0120] (3-1. Overall processing of the abnormality sign detection system 100) The overall process flow of the abnormality sign detection system 100 according to the embodiment will be described with reference to Fig. 11. Fig. 11 is a flowchart showing an example of the overall process flow of the information processing system 100 according to the embodiment. Note that the processes of steps S101 to S102 below may be executed in a different order. Also, some of the processes of steps S101 to S102 below may be omitted.

[0121] (3-1-1. Detection model construction process) First, the server device 10 executes a detection model construction process (step S101). For example, the server device 10 acquires a highly accurate detection model DM by repeatedly executing the processes of steps S201 to S209, which will be described later.

[0122] (3-1-2. Abnormality prediction output processing) Secondly, the server device 10 executes an abnormality sign output process (step S102). For example, the server device 10 uses the highly accurate detection model DM constructed in the process of step S101 to execute the processes of steps S301 to S303 described below, thereby achieving highly accurate abnormality sign detection.

[0123] (3-2. Detection model construction process) The flow of the detection model construction process of the abnormality sign detection system 100 according to the embodiment will be described with reference to Fig. 12. Fig. 12 is a flowchart showing an example of the flow of the detection model construction process of the abnormality sign detection system 100 according to the embodiment. Note that the processes of steps S201 to S209 below may be executed in a different order. Also, some of the processes of steps S201 to S209 below may be omitted.

[0124] (3-2-1. Measurement data collection processing) First, the server device 10 executes a measurement data collection process (step S201). For example, the server device 10 collects measurement data acquired by the field devices 20.

[0125] (3-2-2. Anomaly detection process) Secondly, the server device 10 executes an abnormality sign detection process (step S202). For example, the server device 10 detects an abnormality sign by inputting the collected measurement data into a detection model DM.

[0126] (3-2-3. Detection result transmission process) Thirdly, the server device 10 executes a detection result transmission process (step S203). For example, the server device 10 transmits the detection result to the worker terminal 30 used by the worker W, and causes it to be displayed on a monitor screen.

[0127] (3-2-4. Detection result judgment process) Fourth, the server device 10 executes a detection result determination process (step S204). For example, the server device 10 receives a true / false determination of the abnormality sign confirmed by the worker W via the worker terminal 30. If the detection result is true (step S204: Yes), the server device 10 proceeds to the process of step S205. On the other hand, if the detection result is false (step S204: No), the server device 10 proceeds to the process of step S206.

[0128] (3-2-5. Evaluation index calculation process) Fifth, the server device 10 executes an evaluation index calculation process (steps S205 and S206). For example, the server device 10 calculates the matching rate of the detection model DM as the evaluation index.

[0129] (3-2-6. Re-learning execution process) Sixth, the server device 10 executes a re-learning execution process (step S207), and returns to the process of step S202. For example, the server device 10 executes re-learning of the detection model DM for which the detection result has been determined to be false, and updates the parameters.

[0130] (3-2-7. Learning continuation determination process) Seventh, the worker W executes a learning continuation determination process (step S208). For example, the worker W determines to end the learning when the evaluation index becomes equal to or exceeds a predetermined value or when it is determined that there is no problem with the work situation. If the server device 10 determines to continue the learning (step S208: Yes), the process returns to step S202. On the other hand, if the server device 10 determines not to continue the learning (step S208: No), the process proceeds to step S209.

[0131] (3-2-8. Detection model determination process) Eighth, the server device 10 executes a detection model determination process (step S209) and ends the detection model construction process. For example, when the server device 10 automatically selects a detection model DM having a predetermined evaluation index or receives a detection model DM selected by the operator W, the server device 10 uses the selected detection model DM as an adopted model in the abnormality sign detection process.

[0132] (3-3. Abnormality prediction output processing) The flow of the abnormality sign output process of the abnormality sign detection system 100 according to the embodiment will be described with reference to Fig. 13. Fig. 13 is a flowchart showing an example of the flow of the abnormality sign output process of the abnormality sign detection system 100 according to the embodiment. Note that the processes of steps S301 to S303 below may be executed in a different order. Also, some of the processes of steps S301 to S303 below may be omitted.

[0133] (3-3-1. Measurement data collection processing) First, the server device 10 executes a measurement data collection process (step S301). For example, the server device 10 collects measurement data acquired by the field devices 20.

[0134] (3-3-2. Anomaly detection process) Secondly, the server device 10 executes an abnormality sign detection process (step S302). For example, the server device 10 detects an abnormality sign by inputting the collected measurement data into a detection model DM that is an adopted model. At this time, if there are multiple detection models DM determined as adopted models, the server device 10 may detect an abnormality sign using the multiple detection models DM, or may detect an abnormality sign using the detection model DM with the maximum evaluation index among the multiple detection models DM.

[0135] (3-3-3. Detection result transmission process) Thirdly, the server device 10 executes a detection result transmission process (step S303) and ends the abnormality sign output process. For example, the server device 10 transmits the detection result to the worker terminal 30 used by the worker W and displays it on a monitor screen. At this time, when there are multiple detection models DM determined as adopted models, the server device 10 may transmit all of the multiple detection results to the worker terminal 30, or may notify the worker terminal 30 of only the detection result that is the output of the detection model DM with the maximum evaluation index among the multiple detection models DM.

[0136] 4. Effects of the embodiment Finally, effects of the embodiment will be described below: Effects 1 to 10 corresponding to the processing according to the embodiment will be described below.

[0137] (4-1. Effect 1) First, in the process according to the embodiment described above, the server device 10 collects measurement data measured by the field devices 20, inputs the collected measurement data into a trained detection model DM that predicts a predetermined event in response to the input of the measurement data, obtains an output result of the trained detection model DM, and, if the output result of the trained detection model DM differs from the confirmation result by the operator W who confirmed the field device 20 in which the predetermined event was predicted, performs re-learning of the trained detection model DM using the label value input by the operator W and the collected measurement data to generate a re-learned model. Therefore, in this process, the accuracy of the trained model can be improved.

[0138] (4-2. Effect 2) Secondly, in the process according to the embodiment described above, the trained detection model DM is a detection model DM trained by unsupervised machine learning using each measurement data that is a normal value among a plurality of measurement data collected during a predetermined period as training data. Also, the server device 10 executes re-training of the trained learning model by supervised learning in which a label value based on the judgment result is assigned to the collected measurement data as supervised data. Therefore, in this process, the accuracy of the learning model by unsupervised learning can be improved.

[0139] (4-3. Effect 3) Thirdly, in the process according to the embodiment described above, when the output result of the trained detection model DM corresponds to a sign of an abnormal condition and the operator W determines that an abnormal condition or an abnormality predictor condition in the field device 20 has not been confirmed, the server device 10 executes re-learning of the trained detection model DM using teacher data in which the presence or absence of an abnormal condition or an abnormality predictor condition based on the determination result is assigned as a label value to the collected measurement data. Therefore, in this process, the accuracy of the trained model for detecting abnormality predictors can be improved.

[0140] (4-4. Effect 4) Fourth, in the process according to the embodiment described above, the server device 10 calculates an evaluation index for the trained detection model DM based on the detection result, which is the output of the trained detection model DM, and the judgment result by the operator W who confirmed the field device 20 in which a predetermined event was predicted. Therefore, in this process, the accuracy of the trained detection model can be improved by evaluating the trained model by unsupervised learning.

[0141] (4-5. Effect 5) Fifth, in the process according to the embodiment described above, the server device 10 executes re-learning of the learned learning model based on the calculated evaluation index. Therefore, in this process, the accuracy of the learned model can be improved by re-learning the learning model with a low evaluation index.

[0142] (4-6. Effect 6) Sixth, in the process according to the embodiment described above, the server device 10 acquires the output result of each of the plurality of trained detection models DM that predict a predetermined event, calculates an evaluation index for each of the plurality of trained detection models DM based on the output result of each of the plurality of trained detection models DM and the judgment result by the operator W who confirmed the field device 20 for which the predetermined event was predicted, and determines to select, from the plurality of trained detection models DM, a trained detection model DM whose evaluation index is equal to or greater than a predetermined value. Therefore, in this process, the accuracy of the trained models can be improved by automatically selecting a trained model with high accuracy.

[0143] (4-7. Effect 7) Seventh, in the process according to the embodiment described above, the server device 10 decides to adopt the trained detection model DM selected by the worker W from among a plurality of trained detection models DM. Therefore, in this process, the accuracy of the machine learning model can be improved by the worker W selecting a machine learning model with high accuracy.

[0144] (4-8. Effect 8) Eighth, in the process according to the embodiment described above, the server device 10 calculates at least one of the accuracy rate, the precision rate, the recall rate, the specificity, and the F-measure as an evaluation index based on the detection result, which is the output of the trained detection model DM, and the judgment result by the operator W who confirmed the field device 20 in which a predetermined event was predicted, and causes the operator terminal 30 used by the operator W to display the evaluation index. Therefore, in this process, the operator W can improve the accuracy of the learning model by selecting a learning model with high accuracy according to the type of output result.

[0145] (4-9. Effect 9) Ninth, in the process according to the embodiment described above, the server device 10 generates a time series graph showing the history of collected measurement data, displays the generated time series graph on the worker terminal 30 used by the worker W, and decides to adopt a learning model based on the displayed time series graph. Therefore, in this process, the worker W can improve the accuracy of the machine learning model by selecting a machine learning model with high accuracy while referring to the time series data.

[0146] (4-10. Effect 10) Tenth, in the processing according to the embodiment described above, the server device 10 generates a normal state screen indicating the period of the normal state which is the detection result, and causes the worker terminal 30 used by the worker W to display the generated normal state screen in a form which can be switched on or off by the operation of the worker W.

[0147] 〔system〕 The information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

[0148] In addition, each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure. In other words, all or part of them can be functionally or physically distributed and integrated in any unit according to various loads, usage conditions, etc.

[0149] Furthermore, each processing function performed by each device may be realized, in whole or in part, by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware using wired logic.

[0150] [Hardware] Next, a hardware configuration example of a server device 10 which is an alarm detection device will be described. Note that other devices may have a similar hardware configuration. FIG. 14 is a diagram showing a hardware configuration example according to an embodiment. As shown in FIG. 14, the server device 10 has a communication device 10a, a HDD (Hard Disk Drive) 10b, a memory 10c, and a processor 10d. Furthermore, each unit shown in FIG. 14 is connected to each other via a bus or the like.

[0151] The communication device 10a is a network interface card or the like, and communicates with other servers. The HDD 10b stores programs and databases that operate the functions shown in FIG.

[0152] The processor 10d reads out a program that executes the same processes as the respective processing units shown in FIG. 2 from the HDD 10b, etc., and loads it in the memory 10c, thereby operating a process that executes each function described in FIG. 2, etc. For example, this process executes a function similar to that of each processing unit possessed by the server device 10. Specifically, the processor 10d reads out a program having functions similar to those of the collection unit 15a, the detection unit 15b, the execution unit 15c, etc., from the HDD 10b, etc. Then, the processor 10d executes a process that executes the same processes as those of the collection unit 15a, the detection unit 15b, the execution unit 15c, etc.

[0153] In this way, the server device 10 operates as a device that executes various processing methods by reading and executing the programs. The server device 10 can also realize functions similar to those of the above-mentioned embodiment by reading the programs from a recording medium using a media reading device and executing the read programs. Note that the programs in these other embodiments are not limited to being executed by the server device 10. For example, the present invention can be similarly applied to cases where other computers or servers execute the programs, or where these execute the programs in cooperation with each other.

[0154] This program can be distributed via a network such as the Internet. This program can also be recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, a magneto-optical disk (MO), or a digital versatile disk (DVD), and can be executed by being read out from the recording medium by a computer.

[0155] 〔others〕 Some examples of combinations of the disclosed technical features are set out below.

[0156] (1) A detection device comprising: a collection unit that collects measurement data measured by a measurement device; a detection unit that inputs the collected measurement data into a trained learning model that predicts a specified event in response to the input of measurement data to obtain a detection result that is the output of the trained learning model; and an execution unit that, when the detection result of the trained learning model differs from a judgment result made by a user who has checked the measurement device for which the specified event was predicted, performs re-learning of the trained learning model using the label value input by the user and the collected measurement data to generate a re-learned model.

[0157] (2) The detection device described in (1), wherein the trained learning model is a learning model trained by unsupervised learning using each measurement data that is a normal value among multiple measurement data collected over a specified period as training data, and the execution unit re-trains the trained learning model by supervised learning in which the label value based on the judgment result is assigned to the collected measurement data as training data.

[0158] (3) The detection device described in (1) or (2), in which, when the detection result, which is the output of the trained learning model, corresponds to a sign of an abnormal condition and the judgment result does not confirm an abnormal condition or an abnormality predictor state, the execution unit re-trains the trained learning model using teacher data in which the collected measurement data is assigned the presence or absence of the abnormal condition or the abnormality predictor state based on the judgment result as the label value.

[0159] (4) A detection device described in any one of (1) to (3), wherein the execution unit calculates an evaluation index of the trained learning model based on the detection result, which is the output of the trained learning model, and the judgment result.

[0160] (5) The detection device described in (4), wherein the execution unit performs re-learning of the trained learning model based on the evaluation index.

[0161] (6) The detection device described in any one of (1) to (5), wherein the detection unit acquires detection results which are the output of each of a plurality of trained learning models that predict the specified event, and the execution unit calculates an evaluation index for each of the plurality of trained learning models based on the detection results which are the output of each of the plurality of trained learning models and the judgment result, and decides to adopt a trained learning model among the plurality of trained learning models whose evaluation index is equal to or greater than a predetermined value.

[0162] (7) The detection device according to any one of (1) to (6), wherein the execution unit decides to adopt a trained learning model selected by the user from among the plurality of trained learning models.

[0163] (8) A detection device described in any one of (1) to (7), wherein the execution unit calculates at least one of the accuracy rate, the precision rate, the recall rate, the specificity, and the F-measure as an evaluation index of the trained learning model based on the detection result which is the output of the trained learning model and the judgment result by the user who confirmed the measurement device in which the specified event was predicted, and displays the evaluation index on a terminal used by the user.

[0164] (9) A detection device described in any one of (1) to (8), wherein the execution unit generates a time series graph showing a history of the collected measurement data, displays the time series graph on a terminal used by the user, and decides to adopt a learning model based on the displayed time series graph.

[0165] (10) The detection device described in any one of (1) to (9), wherein the execution unit generates a screen showing a period of normal state which is the detection result, and displays the generated screen on the terminal used by the user in a form that can be switched on or off by the user's operation.

[0166] (11) A detection method in which a computer collects measurement data measured by a measuring device, inputs the collected measurement data into a trained learning model that predicts a specified event in response to the input of the measurement data, obtains a detection result that is the output of the trained learning model, and, if the detection result that is the output of the trained learning model differs from the judgment result by a user who confirmed the measuring device for which the specified event was predicted, performs re-learning of the trained learning model using the label value input by the user and the collected measurement data to generate a re-learned model.

[0167] (12) A detection program that causes a computer to execute a process of collecting measurement data measured by a measuring device, inputting the collected measurement data into a trained learning model that predicts a specified event in response to the input of the measurement data, obtaining a detection result that is the output of the trained learning model, and, if the detection result that is the output of the trained learning model differs from the judgment result by a user who confirmed the measuring device for which the specified event was predicted, re-learning the trained learning model using the label value input by the user and the collected measurement data to generate a re-learned model. [Explanation of symbols]

[0168] 10. Server device 11 Input section 12 Output section 13. Communications Department 14 Storage section 14a Detection result storage unit 14b Judgment result storage unit 14c Evaluation index memory section 14d Detection model storage section 15 Control section 15a Collection Section 15b Detection section 15c Executive Department 20 Field Equipment 21 Acquisition Department 22 Communications Department 30 Worker terminal 31 Input / output section 32 Transmitter / receiver 33 Communications Department 100 Anomaly Prediction Detection System

Claims

1. A collection unit that collects measurement data measured by the measurement device; A detection unit inputs the collected measurement data into a trained learning model that predicts a predetermined event in response to the input of the measurement data, and obtains a detection result that is an output of the trained learning model; an execution unit that, when a detection result of the trained learning model differs from a judgment result by a user who has confirmed the measurement device in which the predetermined event is predicted, re-learns the trained learning model using the label value input by the user and the collected measurement data to generate a re-learned model; A detection device comprising:

2. The trained learning model is A learning model trained by unsupervised learning using each normal value among a plurality of measurement data collected during a predetermined period as training data, The execution unit is performing re-learning of the learned learning model by supervised learning in which the label value based on the determination result is assigned as teaching data to the collected measurement data; The detection device according to claim 1 .

3. The execution unit is When the detection result, which is the output of the trained learning model, corresponds to a sign of an abnormal state and the judgment result does not confirm an abnormal state or an abnormality sign state, re-learning of the trained learning model is performed using teacher data in which the presence or absence of the abnormal state or the abnormality sign state based on the judgment result is assigned as the label value to the collected measurement data. The detection device according to claim 1 .

4. The execution unit is Calculating an evaluation index of the trained learning model based on the detection result, which is an output of the trained learning model, and the judgment result; The detection device according to claim 1 .

5. The execution unit is Re-learning the trained learning model based on the evaluation index.

5. The detection device according to claim 4.

6. The detection unit is Obtaining detection results that are outputs of a plurality of trained learning models that predict the predetermined event; The execution unit is Calculating an evaluation index for each of the plurality of trained learning models based on a detection result and a judgment result, which are outputs of each of the plurality of trained learning models; determining, from among the plurality of trained learning models, to adopt a trained learning model whose evaluation index is equal to or greater than a predetermined value; The detection device according to claim 1 .

7. The execution unit is determining adoption of a trained learning model selected by the user from among the plurality of trained learning models; The detection device according to claim 1 .

8. The execution unit is Calculating at least one of an accuracy rate, a precision rate, a recall rate, a specificity rate, and an F-measure as an evaluation index of the trained learning model based on the detection result that is the output of the trained learning model and a judgment result by the user who confirmed the measuring device in which the predetermined event was predicted; Displaying the evaluation index on a terminal used by the user. The detection device according to claim 1 .

9. The execution unit is generating a time series graph showing a history of the collected measurement data; Displaying the time series graph on a terminal used by the user; Deciding to adopt a learning model based on the displayed time series graph. The detection device according to claim 1 .

10. The execution unit is generating a screen showing a period of the normal state that is the detection result; displaying the generated screen on a terminal used by the user in a form that can be switched between displayed and hidden by an operation of the user; The detection device according to claim 1 .

11. The computer Collecting measurement data measured by a measuring device; Inputting the collected measurement data into a trained learning model that predicts a predetermined event in response to the input of the measurement data, and obtaining a detection result that is an output of the trained learning model; When the detection result, which is the output of the trained learning model, differs from a judgment result by a user who has checked the measuring device in which the predetermined event is predicted, re-training the trained learning model using the label value input by the user and the collected measurement data to generate a re-trained model. The detection method to perform the action.

12. On the computer, Collecting measurement data measured by a measuring device; Inputting the collected measurement data into a trained learning model that predicts a predetermined event in response to the input of the measurement data, and obtaining a detection result that is an output of the trained learning model; When the detection result, which is the output of the trained learning model, differs from a judgment result by a user who has checked the measuring device in which the predetermined event is predicted, re-training the trained learning model using the label value input by the user and the collected measurement data to generate a re-trained model. The detection program that causes the process to run.

Images