Abnormality detection method, abnormality detection program, and abnormality detection system

Abstract

To provide an abnormality detection method, an abnormality detection program, and an abnormality detection system that are capable of easily and highly accurately detecting an abnormality in an object to be detected.SOLUTION: A plurality of vector analysis models VM is created by calculating α normal state feature amounts for each divided data BD obtained by dividing normal state record data SRD, extracting two feature amounts from the calculated α normal state feature amounts in a round-robin method, and performing machine learning using as input a plurality of normal state feature amount vectors STV consisting of combinations of the two extracted feature amounts. α detection feature amounts are calculated for each divided data BD obtained by dividing detection record data KRD. Two of the calculated α detection feature amounts are extracted using a round-robin method and a plurality of detection feature amount vectors KTV consisting of combinations of the extracted two is input into the vector analysis model VM, so as to calculate an abnormality score IS for the detection feature amount vectors KTV. A determination whether detection record data KRD is "abnormal" or "normal" is made based on the abnormality score IS.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to an abnormality detection method, an abnormality detection program, and an abnormality detection system that detect an abnormality of a detection target by analyzing a vibration signal detecting the state of the detection target.

Background Art

[0002] Conventionally, in order to monitor the operating status of various machinery and equipment, an AE sensor or the like has been attached to the machinery and equipment, and the detected vibration signal has been analyzed to detect an abnormality.

[0003] As a method for analyzing a vibration waveform, for example, a method of analyzing a specific spectrum extracted by performing FFT analysis on the vibration waveform (Patent Document 1), a method of analyzing the magnitude of the vibration waveform, the value of the root mean square, the shape factor, and the correlation between the root mean square and the shape factor (Patent Document 2), and a method of calculating and analyzing an energy value that is an integral value of the vibration waveform (Patent Document 3) have been known.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Patent Document 2

Patent Document 3

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, in the analysis method of Patent Document 1, the processing load on the computer is large when performing FFT (Fast Fourier Transform). Furthermore, even after performing FFT, processing for high-dimensional data processing obtained as a calculation result and narrowing down a characteristic frequency band from the calculation result is required.

[0006] The analysis methods of Patent Documents 2 and 3 do not analyze the temporal changes in the vibration waveform and cannot capture the timing at which an abnormality occurs. Further, although the analysis method of Patent Document 2 focuses on the correlation between a plurality of characteristic values, since it only deals with linear relationships, it is difficult to accurately determine whether it is abnormal or normal.

[0007] The present invention has been made in view of the above background art, and an object thereof is to provide an abnormality detection method, an abnormality detection program, and an abnormality detection system that can easily and accurately detect an abnormality of a detection target object.

Means for Solving the Problems

[0008] The present invention is an abnormality detection method (a method executed by a computer system) for detecting an abnormality of a detection target object by analyzing a vibration signal that detects the state of the detection target object, When defining the data of the vibration signal in a record period of a fixed length as record data, the individual data obtained by dividing the record data at a specified time interval as divided data, the feature amount in the amplitude axis direction of the vibration signal included in the divided data as the amplitude axis feature amount, and the feature amount in the time axis direction of the vibration signal included in the divided data as the time axis feature amount, acquiring normal-time record data that is the record data when the detection target object is normal, calculating α normal-time feature amounts including the amplitude axis feature amount and the time axis feature amount for each of the divided data obtained by dividing the normal-time record data, extracting 2 out of the calculated α normal-time feature amounts by brute force, and performing machine learning with a plurality of normal-time feature amount vectors composed of the extracted 2 combinations as inputs to create a plurality of vector analysis models, or obtaining the plurality of created vector analysis models; a vector analysis model preparation step; acquiring detection record data that is the record data when it is unknown whether the detection target object is normal or abnormal, and a detection feature amount calculation step of calculating α detection feature amounts corresponding to the α normal-time feature amounts for each of the divided data obtained by dividing the detection record data; Extract two out of the α detected feature amounts calculated in the detected feature amount calculation step by brute force, and calculate abnormal scores that quantify the degree of abnormality of the detected feature vectors, each of which is composed of a combination of the two extracted ones, by inputting them into the corresponding vector analysis model respectively. An abnormality detection method comprising: an abnormality detection step of determining whether the detection record data is "abnormal" or "normal" based on the abnormality score calculated from the detection record data.

[0009] The amplitude axis feature amount is preferably the average value or the effective value of the absolute values of a plurality of sampling data constituting the divided data. Further, the time axis feature amount is calculated by summing the number of times the sampling data changes from a positive value to a value less than or equal to zero and the number of times the sampling data changes from a negative value to a value greater than or equal to zero when the plurality of sampling data constituting the divided data are arranged in time series, or the wave number calculated by summing the number of times the first-order difference of the plurality of sampling data constituting the divided data changes from a positive value to a value less than or equal to zero and the number of times the first-order difference changes from a negative value to a value greater than or equal to zero when the first-order differences are arranged in time series. It is preferable that at least one of the wave number and the difference wave number is included in the α normal-time feature amounts and the α detected feature amounts.

[0010] In the abnormality detection step, a comprehensive abnormality score that quantifies the degree of abnormality of the detection record data can be calculated based on the abnormality score for each divided data of the detection record data, and it can be configured to determine "abnormal" when the comprehensive abnormality score is greater than or equal to a threshold value. Further, when it is determined in the abnormality detection step that the detection record data is "normal", a vector analysis model update step of updating the vector analysis model by regarding the detection record data as the normal record data may be provided.

[0011] Obtain abnormal record data, which is the record data when the detection target is abnormal, and create a diagnostic model by performing machine learning with the abnormal score calculated from the abnormal record data as an input, or obtain the created diagnostic model; and an abnormal diagnosis step of specifying the content of the abnormality by inputting the abnormal score calculated from the detection record data into the diagnostic model when the detection record data is determined to be "abnormal" in the abnormal detection step. In this case, when the detection record data is determined to be "abnormal" in the abnormal detection step and the content of the abnormality is specified in the abnormal diagnosis step, it may be configured to include a diagnostic model update step of updating the diagnostic model by regarding the detection record data as the abnormal record data.

[0012] Furthermore, the present invention is an abnormality detection program configured by programs for executing each step for causing a computer system to execute the above-described abnormality detection method.

[0013] Furthermore, the present invention is an abnormality detection system configured by a computer, which detects an abnormality of a detection target by analyzing a vibration signal detecting the situation of the detection target, When the data of the vibration signal in a record period of a certain length is defined as record data, the individual data obtained by dividing the record data at a specified time interval is defined as divided data, the feature amount in the amplitude axis direction of the vibration signal included in the divided data is defined as the amplitude axis feature amount, and the feature amount in the time axis direction of the vibration signal included in the divided data is defined as the time axis feature amount, Obtain the normal-time record data, which is the record data when the object to be detected is normal, and for each of the divided data obtained by dividing the normal-time record data, calculate α normal-time feature amounts including the amplitude-axis feature amount and the time-axis feature amount. Extract two out of the calculated α normal-time feature amounts by brute force, and perform machine learning with a plurality of normal-time feature vector combinations composed of the two extracted combinations as inputs to create a plurality of vector analysis models, or obtain the plurality of created vector analysis models. This is the vector analysis model preparation unit. Obtain the detection record data, which is the record data when it is unknown whether the object to be detected is normal or abnormal, and for each of the divided data obtained by dividing the detection record data, calculate α detection feature amounts corresponding to the α normal-time feature amounts. This is the detection feature amount calculation unit. Extract two out of the α detection feature amounts calculated by the detection feature amount calculation unit by brute force, and input each of the plurality of detection feature vector combinations composed of the two extracted combinations into the corresponding vector analysis model to calculate an anomaly score that quantifies the degree of anomaly of the detection feature vector. This is the anomaly score calculation unit. An anomaly detection system comprising an anomaly detection unit that determines whether the detection record data is "abnormal" or "normal" based on the anomaly score calculated from the detection record data.

[0014] It may be configured to include a vector analysis model update unit that updates the vector analysis model by regarding the detection record data as the normal record data when the detection record data is determined to be "normal" by the anomaly detection unit.

[0015] Obtain abnormal record data which is the record data when the detection target is abnormal, and create a diagnostic model by performing machine learning with the abnormal score calculated from the abnormal record data as input, or obtain the created diagnostic model; and an abnormal diagnosis unit that specifies the content of the abnormality by inputting the abnormal score calculated from the detection record data into the diagnostic model when the detection record data is determined to be "abnormal" by the abnormal detection unit. In this case, when the detection record data is determined to be "abnormal" by the abnormal detection unit and the content of the abnormality is specified by the abnormal diagnosis unit, it may be configured to include a diagnostic model update unit that updates the diagnostic model by regarding the detection record data as the abnormal record data.

Advantages of the Invention

[0016] When the abnormal detection method, abnormal detection program, and abnormal detection system of the present invention obtain detection record data detecting the situation of one operation performed by a detection target, the detection record data is analyzed in units of divided data obtained by dividing it at regular time intervals, and based on the analysis results for each divided data, it is configured to comprehensively determine whether the detection record data is abnormal or normal. That is, since it analyzes in detail including the change over time of the detection record data, abnormal detection can be performed based on much more information than before, and even when various abnormal patterns are assumed, it is possible to detect the occurrence of an abnormality with high accuracy. In addition, it also becomes possible to accurately specify the content of the abnormality (type of abnormal pattern, timing when the abnormality occurred, etc.).

Brief Description of the Drawings

[0017]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Embodiments for Carrying Out the Invention

[0018] <<<One Embodiment of the Present Invention>>> Hereinafter, an embodiment of an anomaly detection method, an anomaly detection program, and an anomaly detection system of the present invention will be described with reference to the drawings. The anomaly detection system 10 of this embodiment is a system provided in a computer. As shown in FIG. 1, it is composed of a vector analysis model preparation unit 12, a detected feature quantity calculation unit 14, an anomaly score calculation unit 16, an anomaly detection unit 18, a diagnostic model preparation unit 20, an anomaly diagnosis unit 22, a vector analysis model update unit 24, and a diagnostic model update unit 26. The anomaly detection system 10 analyzes the detected record data KRD acquired by the detected feature quantity calculation unit 14, determines whether the detected record data KRD is abnormal or normal, outputs a determination result, and when it is determined to be abnormal, performs a process of specifying the content of the anomaly and outputting it as a diagnosis result.

[0019] The anomaly detection method of this embodiment is a method executed by the anomaly detection system 10. As shown in FIG. 2, it includes a vector analysis model preparation step S11, a detection feature amount calculation step S12, an anomaly score calculation step S13, an anomaly detection step S14, a diagnosis model preparation step S15, an anomaly diagnosis step S16, a vector analysis model update step S17, and a diagnosis model update step S18. Steps S11 to S18 are respectively executed by the function blocks 12 to 26 with corresponding names. Also, the anomaly detection program of this embodiment is composed of the above programs for executing steps S11 to S18, and is installed and used in the anomaly detection system 10 composed of a computer.

[0020] <<Explanation of Terms>> Before explaining this embodiment, the terms used in this specification will be explained. <Record Data RD> In this specification, the data of the vibration signal (the vibration signal detecting the situation of the object to be detected) in a record period Ta of a fixed length is referred to as record data RD. FIG. 3 shows a specific example of the record data RD. The upper two of the six are the data when the object to be detected is normal, and the lower four are the data when the object to be detected is abnormal. In addition, among the record data RD, the data known to be when the object to be detected is normal is referred to as normal-time record data SRD, and the data known to be when the object to be detected is abnormal is referred to as abnormal-time record data IRD. Also, the record data RD when it is unknown whether the object to be detected is normal or abnormal, that is, the unknown record data RD to be determined as normal or abnormal, is referred to as detection record data KRD.

[0021] <Segmented Data BD> As shown in FIG. 4, n pieces of data obtained by dividing the record data RD at a specified time interval are referred to as segmented data BD(k) [k = 1, 2, ···, n]. Also, the period corresponding to each segmented data BD(k) is referred to as a segmented period Tb(k).

[0022] <Amplitude Axis Feature Amount and Time Axis Feature Amount> As shown in FIG. 5, the feature amount in the amplitude axis direction of the vibration signal included in the divided data BD(k) is referred to as the amplitude axis feature amount, and the feature amount in the time axis direction is referred to as the time axis feature amount. The amplitude axis feature amount can be, for example, the average value of the absolute values of a plurality of sampling data constituting the divided data BD(k) [hereinafter referred to as the average value A(K).], the effective value of a plurality of sampling data constituting the divided data BD(k) [hereinafter referred to as the effective value D(K).], etc.

[0023] The time axis feature amount can be, for example, the number obtained by summing the number of times the sampling data changes from a positive value to a value below zero and the number of times it changes from a negative value to a value above zero when arranging the m sampling data constituting the divided data BD(k) in time series [hereinafter, this summed number is referred to as the wave number B(k).]. When applied to the model vibration waveform in the upper part of FIG. 5, the wave number B(k) becomes the number of zero-crossing points (= 4 points) indicated by the plot "▲". That is, the wave number B(k) indicates the number of large half-waves that oscillate in the positive and negative directions centered on zero.

[0024] Also, the time feature amount can be, for example, the number obtained by summing the number of times the first-order difference changes from a positive value to a value below zero and the number of times it changes from a negative value to a value above zero when arranging the first-order differences of the m sampling data constituting the divided data BD(k) in time series [hereinafter, this summed number is referred to as the differential wave number C(k).]. The model vibration waveform in the lower part of FIG. 5 is obtained by simply converting the upper model vibration waveform into a first-order difference waveform. When applied to the lower model vibration waveform, the differential wave number C(k) becomes the number of zero-crossing points (= 12 points) indicated by the plot "■". That is, the differential wave number C(k) indicates the number of small half-waves that oscillate in the positive and negative directions so as to overlap the large half-waves.

[0025] <<Explanation of each step of the abnormality detection method of this embodiment>> A major feature of this embodiment is to detect an abnormality of a detection target by analyzing a vibration signal that detects the situation of the detection target, and when an abnormality is detected, perform an abnormality diagnosis. Hereinafter, the contents of each step S11 to S18 shown in FIG. 2 will be described in order. <Vector analysis model preparation step S11> In the vector analysis model preparation step S11, a process of creating a plurality of vector analysis models VM(j,k) is performed based on a plurality of normal record data SRD.

[0026] First, obtain the normal record data SRD, and for each piece of divided data BD(k) obtained by dividing the normal record data SRD, calculate α normal feature amounts including an amplitude axis feature amount and a time axis feature amount. Here, as shown in FIG. 4, the α normal feature amounts are three, namely, an average value A(k), a wave number B(k), and a differential wave number C(k).

[0027] When the average value A(k), the wave number B(k), and the differential wave number C(k) are calculated for each piece of divided data BD(k), two are extracted from the three calculated ones, and the combination of the two extracted ones is used as the normal feature amount vector STV(j). Then, by performing machine learning with the normal feature amount vector STV(j) as an input, a vector analysis model VM(j,k) is created. Therefore, as shown in the table of FIG. 6, there are three (j = 1, 2, 3) vector analysis models VM(j,k) for one divided period Tb(k), and since there are n divided periods Tb(k) [k = 1, 2, ··· n], the total number of vector analysis models VM(j,k) is 3 × n.

[0028] The graph shown on the lower left side of FIG. 6 is a scatter diagram simply showing the registered contents of the vector analysis model VM(1,18). The vector analysis model VM(1,18) is related to the normal feature amount vector STV(1) combining the average value A(18) and the wave number B(18) in the divided period Tb(18), and the distribution of the plots "〇" shows the distribution of the vertices of the registered normal feature amount vectors STV(1).

[0029] Also, the graph shown on the lower right side of FIG. 6 is a scatter diagram that simply represents the registered content of the vector analysis model VM(2,23). The vector analysis model VM(2,23) is related to the normal-time feature vector STV(2) that combines the average value A(23) and the differential wave number C(23) in the division period Tb(23). The distribution of the plot "〇" indicates the distribution of the vertices of the registered normal-time feature vector STV(2).

[0030] Regarding the vector analysis model preparation step S11, in the explanations so far, the vector analysis model VM(j,k) has been "created", but it may be configured to "acquire" the vector analysis model VM(j,k) created in advance. "Acquire" means going to obtain data stored in other devices or storage media, receiving data transmitted from other devices, etc., and also includes reading out the data that has already been acquired and stored and making it available for use.

[0031] <Detection feature quantity calculation step S12> In the feature quantity calculation step S12, detection record data KRD (unknown record data RD that is the object of determination of whether it is abnormal or normal) is acquired, and for each divided data BD(k) obtained by dividing the detection record data KRD, a process of calculating α detection feature quantities corresponding to the above α normal-time feature quantities is performed. Here, since the normal-time feature quantities are three, namely the average value A(k), the wave number B(k), and the differential wave number C(k), the α detection feature quantities are also three, namely the average value A(k), the wave number B(k), and the differential wave number C(k).

[0032] <Abnormality score calculation step S13> In the abnormality score calculation step S13, two out of the three detection feature quantities calculated in the detection feature quantity calculation step are extracted by brute force, and the combination of the two extracted is set as the detection feature vector KTV(j). Then, by inputting each detection feature vector KTV(j) into the corresponding vector analysis model VM(j,k), an abnormality score IS that quantifies the degree of abnormality of each detection feature vector KTV(j) is calculated.

[0033] The method for calculating the anomaly score IS is arbitrary, and it may be calculated using an appropriate statistical method so that the higher the degree of anomaly, the larger the value. For example, the MT method for calculating the Mahalanobis distance from the population (unit space) of normal data to the sample data, or a method such as the one-class support vector machine that determines the discrimination boundary of the normal class and calculates the distance from the discrimination boundary of the sample data can be used.

[0034] The graph shown in the upper part of FIG. 7 is a scatter diagram simply showing the situation where the detection feature vector KTV(2) of the division period Tb(23) is input to the vector analysis model VM(2,23) described above.

[0035] The detection feature vector KTV(2)-1 in this scatter diagram is a detection feature vector derived from a certain detection record data KRD-1, and since it is plotted at a position far from the area where the normal-time feature vector STV(2) is concentrated, the anomaly score IS becomes a relatively large value (=139.56).

[0036] Also, the detection feature vector KTV(2)-2 in this scatter diagram is a detection feature vector derived from another detection record data KRD-2, and since it is plotted at a position close to the area where the normal-time feature vector STV(2) is concentrated, the anomaly score IS becomes a relatively small value (=0.05).

[0037] Also, the detection feature vector KTV(2)-3 in this scatter diagram is a detection feature vector derived from yet another detection record data KRD-3, and since it is plotted at an intermediate position between the detection feature vectors KTV(2)-1 and KTV(2)-2, the anomaly score IS becomes an intermediate value (=57.98).

[0038] The detected feature vector KTV(j) has three (j = 1, 2, 3) for each segmentation period Tb(k), and since there are n segmentation periods Tb(k) (k = 1, 2, ··· n), the number of detected feature vectors KTV(j) is a total of 3 × n, the same as the number of vector analysis models VM(j, k). Therefore, as shown in the upper table of Fig. 8, a total of 3 × n anomaly scores IS are calculated for each detection record data KRD.

[0039] <Anomaly detection step S14> In anomaly detection step S14, based on the 3 × n anomaly scores IS calculated from the detection record data KRD, it is determined whether the detection record data KRD is "abnormal" or "normal". For example, based on the anomaly scores IS for each divided data BD(k) of the detection record data KRD (refer to the upper table of Fig. 8), a comprehensive anomaly score SIS (refer to the lower table of Fig. 8) that quantifies the degree of anomaly of the detection record data KRD is calculated, and a method of determining "abnormal" when the comprehensive anomaly score SIS is greater than or equal to the threshold value can be considered. The comprehensive anomaly score SIS is preferably a statistic such as the average value, total value, or maximum value of the anomaly scores IS. Also, for the determination threshold value, it is advisable to use μ + 3σ as the threshold value when the average value of the comprehensive anomaly scores SIS calculated from a plurality of normal record data SRD is μ and the standard deviation is σ. By using such a statistical method for determination, anomalies can be detected objectively and accurately.

[0040] <Diagnostic model preparation step S15> In diagnostic model preparation step S15, a process of creating a diagnostic model SM is performed based on the anomaly scores IS calculated from a plurality of abnormal record data IRD. The diagnostic model SM is a prediction model for diagnosing the content of an anomaly when an anomaly occurs and is used in the subsequent anomaly diagnosis step S16.

[0041] When creating the diagnostic model SM, a plurality of abnormal record data IRD are acquired, and machine learning is performed using the anomaly score IS calculated from the abnormal record data IRD as input. The type and analysis method of the diagnostic model SM are free. For example, a model using multinomial logistic regression analysis to determine which feature quantities are affected by the regression coefficient, a model using a decision tree that calculates and analyzes the probability belonging to the target variable with a combination of a plurality of explanatory variables, a model using random forest or gradient boosting developed from the decision tree, a model using the K-nearest neighbor method that can grasp common trends based on the similarity of the learning data, etc. can be used.

[0042] Figure 9 shows, as an example of the diagnostic model SM, a model using a decision tree. Here, the target variables are abnormal patterns 1 to 4, and the explanatory variables are the anomaly scores IS of the detection feature quantity vectors KTV(j) for each divided period Tb(k).

[0043] Regarding the diagnostic model preparation step S15, in the explanations so far, the diagnostic model SM has been described as "created", but it may be configured to "acquire" a previously created diagnostic model SM. "Acquire" means going to retrieve data stored in other devices or storage media, receiving data transmitted from other devices, etc., and also includes making the already acquired and stored data readable and usable.

[0044] <Abnormal diagnosis step S16> The abnormal diagnosis step S16 is a step executed when the detection record data KRD is determined to be "abnormal" in the abnormal detection step S14, and performs a process of specifying the content of the abnormality by inputting the anomaly score IS calculated from the detection record data KRD into the diagnostic model SM.

[0045] For example, when the anomaly score IS of the detected record data KRD determined as "abnormal" is input into the decision tree shown in FIG. 9, if the anomaly score IS of the vector analysis model VM(2,23) is less than 2.26 and the anomaly score IS of the vector analysis model VM(1,9) is less than 3.74, a diagnostic result that "the content of the anomaly is likely to be anomaly pattern 2" can be obtained. Also, if the anomaly score IS of the vector analysis model VM(2,23) is 2.62 or more and the anomaly score IS of the vector analysis model VM(1,18) is less than 51.15, a diagnostic result that "the content of the anomaly is likely to be anomaly pattern 1" can be obtained.

[0046] <Vector analysis model update step S17> The vector analysis model update step S17 is a step executed when the detected record data KRD is determined as "normal" in the anomaly detection step S14, and performs a process of automatically updating the existing vector analysis model VM by regarding the detected record data KRD as normal record data SRD. By repeating this vector analysis model update step S17, the accuracy of anomaly detection can be further improved.

[0047] Note that the vector analysis model update step S17 may be performed every time the detected record data KRD determined as "normal" occurs in the anomaly detection step S14, or may be performed collectively at the timing when a certain amount of the detected record data KRD determined as "normal" has been accumulated. <Diagnostic model update step S18> The diagnostic model update step S18 is a step executed when the detected record data KRD is determined as "abnormal" in the anomaly detection step S14, and performs a process of automatically updating the existing diagnostic analysis model SM by regarding the detected record data KRD as abnormal record data IRD. By repeating this diagnostic model update step S18, the accuracy of anomaly diagnosis can be further improved.

[0048] Note that the diagnostic model update step S18 may be performed every time detection record data KRD determined as "abnormal" in the abnormality detection step S14 occurs, or may be performed collectively at the timing when the detection record data KRD determined as "abnormal" has been accumulated to a certain extent.

[0049] <<Verification Experiment of the Abnormality Detection Method of this Embodiment>> Next, a verification experiment conducted to confirm the effect of the above-described abnormality detection method will be described with reference to FIG. 10. First, the method of the verification experiment will be described. In a situation where a bar is being cut by a cutting machine, vibration signals are detected using an AE sensor, and abnormality detection of the bar and the cutting machine, which are objects to be detected, is to be performed.

[0050] The record period Ta is the period of one cutting operation (= 59 milliseconds), and under the condition of a sampling period Tsam = 1 microsecond, a total of 172 pieces of detection record data KRD were acquired. Then, in order to make the division period Tb 1 millisecond, each piece of detection record data KRD was divided into 59 parts for analysis.

[0051] Note that it is known in what actual situations the 172 pieces of detection record data KRD were acquired. There are 70 pieces of normal-time data and 102 pieces of abnormal-time data. Among the 102 pieces of abnormal-time data, there are 17 pieces of data when abnormal pattern 1 actually occurred, 47 pieces of data when abnormal pattern 2 occurred, 15 pieces of data when abnormal pattern 3 occurred, and 23 pieces of data when abnormal pattern 4 occurred.

[0052] When the abnormality detection method of this embodiment was applied to the above 172 pieces of detection record data KRD, in the abnormality detection step S14, all 172 pieces of normal data were determined as "normal", all 102 pieces of abnormal data were determined as "abnormal", and the correct rate of the abnormal / normal determination was 100%.

[0053] In addition, for 102 pieces of abnormal data, when the abnormal diagnosis step S16 was performed using a predetermined diagnosis model SM (a decision tree model different from FIG. 9), the abnormal pattern could be correctly identified as one of 1 to 4 in 99 cases, and the correct answer rate of the diagnosis result was 97.1%. The result of 97.1% correct answer rate is a satisfactory result at the current stage and is considered a numerical value with sufficient practicality.

[0054] It is presumed that the correct answer rate did not reach 100% because the diagnosis model SM used in the verification experiment was a model at a stage where the number of registered abnormal data was small. Although it is difficult to obtain a large amount of abnormal data in a short period, it is considered that if abnormal data is further accumulated in the future and the number of registrations in the diagnosis model SM increases, the correct answer rate will further improve.

[0055] <<Effects of this Embodiment>> As described above, the abnormal detection system 10, abnormal detection method, and abnormal detection program of this embodiment obtain the detection record data KRD that detects the situation of one operation performed by the detection target object, and then analyze the detection record data KRD in units of divided data BD(k) divided at a specified time interval. Based on the analysis results for each divided data BD(k), it is configured to comprehensively determine whether the detection record data KRD is abnormal or normal. That is, since it analyzes in detail including the change over time of the detection record data KRD, abnormal detection can be performed based on much more information than before, and even when various abnormal patterns are assumed, the occurrence of an abnormality can be detected with high accuracy. In addition, the content of the abnormality (type of abnormal pattern, timing when the abnormality occurred, etc.) can also be accurately specified, which can greatly contribute to quality improvement.

[0056] In addition, as the feature amounts of the divided data BD(k), statistical amounts such as the average value A(k), the wave number B(k), and the differential wave number C(k) are used, so that the noise information included in the sampling data is appropriately masked, and the features of the divided data BD(k) can be accurately analyzed. Further, the wave number B(k) and the differential wave number C(k) are time-axis feature amounts extracted without assuming the periodicity of vibration, and since highly complex calculations and processes such as FFT (Fast Fourier Transform) analysis are unnecessary, they can be easily derived even if the computer is a general-purpose personal computer or the like.

[0057] <<<Other embodiments, modifications, etc.>>> Note that the abnormality detection method, abnormality detection program, and abnormality detection system of the present invention are not limited to the above embodiments. For example, the contents of the amplitude-axis feature amount and the time-axis feature amount indicating the features of the divided data can be appropriately changed according to the nature of the object to be detected, and feature amounts different from those of the above embodiments can be used. For example, in the above embodiment, the amplitude-axis feature amount is the average value A(k), but it may be changed to the effective value D(k) or another numerical value similar thereto. Further, in the above embodiment, the time-axis feature amounts are the wave number B(k) and the differential wave number C(k), which are unique parameters, but they may be changed to parameters different from these. However, it is preferable to include at least one of the wave number B(k) and the differential wave number C(k) in the time-axis feature amounts.

[0058] In the above embodiment, the total number α of the feature amounts (normal-time feature amounts or detection feature amounts) calculated from one piece of divided data is three, but it can be reduced to two or increased to four or more on the condition that it includes one or more amplitude-axis feature amounts and one or more time-axis feature amounts. However, the smaller the number of feature amounts, the shorter the analysis time, but the accuracy of abnormality detection and abnormality diagnosis relatively decreases, so it is important to set the number to a value that can obtain the desired accuracy.

[0059] In the abnormality detection step S14 (abnormality detection unit 18) of the above embodiment, based on the abnormality score IS for each divided data BD(k) of the detection record data KRD, the comprehensive abnormality score SIS of the detection record data KRD is calculated, and when the comprehensive abnormality score SIS is equal to or greater than the threshold value, it is determined as "abnormal". However, the determination of whether there is an abnormality may be performed by other methods. For example, instead of calculating the comprehensive abnormality score SIS, a method of determining "abnormal" when there is even one divided data BD(k) for which an abnormality score IS equal to or greater than the reference value is calculated may be considered.

[0060] In the above embodiment, a vector analysis model update step S17 is provided, and the computer is configured to automatically update the vector analysis model VM(j,k). However, step S17 can be deleted as needed. Further, in the above embodiment, a diagnosis model update step S18 is provided, and the computer is configured to automatically update the diagnosis model SM. However, step S18 can be deleted as needed. Furthermore, in the above embodiment, a diagnosis model preparation step S15 and an abnormality diagnosis step S16 are provided, and the configuration is such that the content of the abnormality is specified. However, steps S15 and S16 can be deleted as needed.

[0061] In addition, the type of the detection target is not particularly limited, and various objects that generate mechanical vibrations during operation, such as processing machines and workpieces to be processed, various production facilities excluding processing machines, air conditioning facilities, and construction machines, can be set as the detection target.

Explanation of Reference Numerals

[0062] 10 Abnormality detection system 12 Vector analysis model preparation unit 14 Detection feature quantity calculation unit 16 Abnormality score calculation unit 18 Abnormality detection unit 20 Diagnosis model preparation unit 22 Abnormality diagnosis unit 24 Vector analysis model update unit 26 Diagnosis model update unit S11 Vector analysis model preparation step S12 Detection Feature Quantity Calculation Step S13 Abnormality Score Calculation Step S14 Abnormality Detection Step S15 Diagnostic Model Preparation Step S16 Abnormality Diagnosis Step S17 Vector Analysis Model Update Step S18 Diagnostic Model Update Step A(k) Average Value (Amplitude Axis Feature Quantity) B(k) Wave Number (Time Axis Feature Quantity) C(k) Differential Wave Number (Time Axis Feature Quantity) D(k) Effective Value (Amplitude Axis Feature Quantity) IRD Abnormal Record Data IS Abnormality Score KRD Detection Record Data KTV(j) Detection Feature Quantity Vector RD Record Data SIS Comprehensive Abnormality Score SM Diagnostic Model SRD Normal Record Data STV(j) Normal Time Feature Quantity Vector Ta Record Period Tb(k) Division Period Tsam Sampling Period VM(j,k) Vector Analysis Model X(k) Sampling Data

Claims

1. A method executed by a computer system, in an anomaly detection method for detecting an anomaly of a detection target object by analyzing a vibration signal that has detected the situation of the detection target object, when defining the data of the vibration signal in a record period of a fixed length as record data, individual data obtained by dividing the record data at a specified time interval as divided data, a feature amount in the amplitude axis direction of the vibration signal included in the divided data as an amplitude axis feature amount, and a feature amount in the time axis direction of the vibration signal included in the divided data as a time axis feature amount, respectively, acquire normal-time record data which is the record data when the detection target object is normal, calculate α normal-time feature amounts including the amplitude axis feature amount and the time axis feature amount for each of the divided data obtained by dividing the normal-time record data, extract two out of the calculated α normal-time feature amounts by brute force, and create a plurality of vector analysis models by performing machine learning with a plurality of normal-time feature vector combinations composed of the extracted two combinations as inputs, or acquire the plurality of created vector analysis models; a vector analysis model preparation step, acquire detection record data which is the record data when it is unknown whether the detection target object is normal or abnormal, and for each of the divided data obtained by dividing the detection record data, calculate α detection feature amounts corresponding to the α normal-time feature amounts; a detection feature amount calculation step, extract two out of the α detection feature amounts calculated in the detection feature amount calculation step by brute force, and calculate an anomaly score for each by numerically quantifying the degree of anomaly of the detection feature vector by inputting a plurality of detection feature vectors composed of the extracted two combinations into the corresponding vector analysis model; an anomaly score calculation step, and an anomaly detection step of determining whether the detection record data is "abnormal" or "normal" based on the anomaly score calculated from the detection record data. An anomaly detection method characterized by comprising the above steps.

2. The anomaly detection method according to claim 1, wherein the amplitude axis feature amount is the average value or the effective value of the absolute values of a plurality of sampling data constituting the divided data.

3. The time axis feature amount is The wave number calculated by summing the number of times the sample data changes from a positive value to a value less than or equal to zero and the number of times the sample data changes from a negative value to a value greater than or equal to zero when arranging a plurality of sample data constituting the divided data in time series, or, The differential wave number calculated by summing the number of times the first-order difference of a plurality of sample data constituting the divided data changes from a positive value to a value less than or equal to zero and the number of times the first-order difference changes from a negative value to a value greater than or equal to zero when arranging the first-order differences in time series, The abnormality detection method according to claim 1, wherein at least one of the wave number and the differential wave number is included in α of the normal-time feature amounts and α of the detected feature amounts.

4. In the abnormality detection step, based on the abnormality score for each divided data of the detection record data, a comprehensive abnormality score that quantifies the degree of abnormality of the detection record data is calculated, and when the comprehensive abnormality score is equal to or greater than a threshold value, it is determined as "abnormal". The abnormality detection method according to any one of claims 1 to 3.

5. A vector analysis model update step of updating the vector analysis model by regarding the detection record data as the normal record data when the detection record data is determined to be "normal" in the abnormality detection step. The abnormality detection method according to any one of claims 1 to 3.

6. An abnormality diagnosis model preparation step of obtaining abnormal-time record data which is the record data when the object to be detected is abnormal, and creating a diagnosis model by performing machine learning with the abnormality score calculated from the abnormal-time record data as an input, or obtaining the created diagnosis model, An abnormality diagnosis step of specifying the content of the abnormality by inputting the abnormality score calculated from the detection record data into the diagnosis model when the detection record data is determined to be "abnormal" in the abnormality detection step. The abnormality detection method according to any one of claims 1 to 3.

7. A diagnosis model update step of updating the diagnosis model by regarding the detection record data as the abnormal-time record data when the detection record data is determined to be "abnormal" in the abnormality detection step and the content of the abnormality is specified in the abnormality diagnosis step. The abnormality detection method according to claim 6.

8. An abnormality detection program composed of programs for executing each step for causing a computer system to execute the abnormality detection method according to claims 1 to 7.

9. In an abnormality detection system configured by a computer, which detects an abnormality of a detection target object by analyzing a vibration signal detecting a state of the detection target object, When defining the data of the vibration signal in a record period of a certain length as record data, individual data obtained by dividing the record data at a prescribed time interval as divided data, a feature quantity in the amplitude axis direction of the vibration signal included in the divided data as an amplitude axis feature quantity, and a feature quantity in the time axis direction of the vibration signal included in the divided data as a time axis feature quantity, respectively, A vector analysis model preparation unit that acquires normal-time record data, which is the record data when the detection target object is normal, calculates α normal-time feature quantities including the amplitude axis feature quantity and the time axis feature quantity for each of the divided data obtained by dividing the normal-time record data, extracts two out of the calculated α normal-time feature quantities by brute force, and creates a plurality of vector analysis models by performing machine learning using a plurality of normal-time feature quantity vectors composed of the extracted two combinations as inputs, or acquires the plurality of created vector analysis models; A detection feature quantity calculation unit that acquires detection record data, which is the record data when it is unknown whether the detection target object is normal or abnormal, and calculates α detection feature quantities corresponding to the α normal-time feature quantities for each of the divided data obtained by dividing the detection record data; An abnormality score calculation unit that extracts two out of the α detection feature quantities calculated by the detection feature quantity calculation unit by brute force, and calculates an abnormality score that quantifies the degree of abnormality of the detection feature quantity vector by inputting each of the plurality of detection feature quantity vectors composed of the extracted two combinations into the corresponding vector analysis model; An abnormality detection system comprising: an abnormality detection unit that determines whether the detection record data is "abnormal" or "normal" based on the abnormality score calculated from the detection record data.

10. The abnormality detection system according to claim 9, further comprising a vector analysis model update unit that, when the abnormality detection unit determines that the detection record data is "normal", regards the detection record data as the normal record data and updates the vector analysis model.

11. An abnormality diagnosis model preparation unit that acquires abnormal record data, which is the record data when the detection target is abnormal, and creates a diagnosis model by performing machine learning using the abnormality score calculated from the abnormal record data, or acquires the created diagnosis model. The abnormality detection system according to claim 9, further comprising an abnormality diagnosis unit that specifies the content of the abnormality by inputting the abnormality score calculated from the detection record data into the diagnosis model when the detection record data is determined to be "abnormal" by the abnormality detection unit.

12. The abnormality detection system according to claim 11, further comprising a diagnosis model update unit that updates the diagnosis model by regarding the detection record data as the abnormal record data when the detection record data is determined to be "abnormal" by the abnormality detection unit and the content of the abnormality is specified by the abnormality diagnosis unit.

Images