Abnormality type presentation device, abnormality type presentation method, and program

Abstract

To present the type of abnormality that has occurred in the abnormality detection target.SOLUTION: An abnormality type presentation system includes: an acquisition unit that acquires, based on an abnormality event log including a date and time of occurrence of a past abnormality that occurred in a target and an abnormality type that indicates the type of the abnormality, an abnormality period that includes at least a period based on the date and time of occurrence of the abnormality and the abnormality type; an assigning unit that assigns a first label representing normality or the abnormality type to first sample data obtained by measuring a past state of the target based on the abnormality period and the abnormality type; a creation unit that creates a model that predicts the first label when the first sample data is input, based on the first sample data to which the first label is assigned; an identification unit that, when second sample data of the target is given, identifies a second label representing a normal or abnormal type based on the model and the second sample data; and a presentation unit that presents at least the abnormality type when the second label represents the abnormality type.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present disclosure relates to an abnormality type presentation device, an abnormality type presentation method, and a program. [Background technology]

[0002] There are known techniques for detecting the occurrence of an abnormality in a plant, etc. For example, Non-Patent Document 1 discloses a technique for modeling a normal state by multivariate analysis of operation data representing the normal operating state of a plant, and then detecting the occurrence of an abnormality from the model. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Manabu Kano, "Multivariate Statistical Process Control", Internet<URL:http: / / manabukano.brilliant-future.net / research / report / Report2005_MSPC.pdf> Summary of the Invention [Problem to be solved by the invention]

[0004] However, while conventional technology can detect the occurrence of an abnormality, it cannot identify the type of abnormality when it occurs. Generally, the method of dealing with an abnormality differs depending on the type of abnormality, so it is necessary to be able to identify the type of abnormality.

[0005] The present disclosure has been made in consideration of the above points, and aims to present the type of abnormality that has occurred in an abnormality detection target. [Means for solving the problem]

[0006] An abnormality type presentation device according to one aspect of the present disclosure includes: an acquisition unit that acquires, based on an abnormality event log containing the date and time of occurrence of a past abnormality that occurred in an object and an abnormality type that represents the type of the abnormality, an abnormality period that includes at least a period based on the date and time of the occurrence, and the abnormality type; an assignment unit that assigns a first label that represents normality or the abnormality type to first sample data that measures a past state of the object, based on the abnormality period and the abnormality type; a creation unit that creates a model that predicts the first label when the first sample data is input, based on the first sample data to which the first label has been assigned; an identification unit that, when second sample data of the object is given, identifies a second label that represents normality or the abnormality type based on the model and the second sample data; and a presentation unit that, if the second label represents an abnormality type, presents at least the abnormality type. [Effects of the Invention]

[0007] The type of abnormality that has occurred in the abnormality detection target can be presented. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 2 is a diagram illustrating an example of a hardware configuration of the abnormality type presentation device according to the present embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of a functional configuration of an abnormality type presentation device according to the present embodiment. [Figure 3] FIG. 10 illustrates an example of an abnormality event log. [Figure 4] FIG. 10 is a diagram illustrating an example of a response manual. [Figure 5] 10 is a flowchart illustrating an example of a model creation process according to the present embodiment. [Figure 6] 10 is a flowchart illustrating an example of an abnormality type presentation process according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] An embodiment of the present invention will be described in detail below with reference to the drawings. In the following embodiment, an anomaly type presentation device 10 will be described that presents to a user such as an operator whether an anomaly has occurred in a plant, facility, equipment, device, or the like as an anomaly detection target, and the type of an anomaly if an anomaly has occurred and how to deal with that type of anomaly. This allows the user to know not only whether an anomaly has occurred, but also the type and how to deal with the anomaly if it has occurred, thereby enabling recovery work or the like to be carried out early in response to the anomaly. Note that an anomaly detection target is an object for which the presence or absence of an anomaly and the type of an anomaly are presented to the user, and may be called, for example, an "anomaly diagnosis target."

[0010] In the following, it is assumed that there are past anomaly event logs and sensor data for the anomaly detection target. An anomaly event log is log data that includes the date and time of occurrence and end date and time, type of anomaly, etc. when an anomaly occurs in the anomaly detection target. Sensor data is time-series sample data consisting of measurement values ​​from various sensors installed in the anomaly detection target. Below, the sample data is referred to as x, and the sample data x contains n variables x1,...,x n In addition, the sample data at time t is assumed to be x(t) = (x1(t), ,x n In this case, if the sensor data is X, it can be expressed as X = {x(t)|t∈T}. Here, T is a set of dates and times. For example, if the measurement start date and time is T, s , the measurement end date and time is T e Then T=[T s ,T e ] etc. The sensor data may be called, for example, "operation data" or "status data". Also, the variables x1,...,x n may be called, for example, a "state variable."

[0011] <Example of Hardware Configuration of Abnormality Type Presentation Device 10> An example of the hardware configuration of the abnormality type presentation device 10 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the hardware configuration of the abnormality type presentation device 10 according to this embodiment.

[0012] 1, the abnormality type presentation device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0013] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the abnormality type presentation device 10 does not necessarily have to include at least one of the input device 101 and the display device 102, for example.

[0014] The external I / F 103 is an interface with an external device such as a recording medium 103a. Examples of the recording medium 103a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0015] The communication I / F 104 is an interface for connecting to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a non-volatile storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive) that stores programs and data. The processor 108 is a variety of arithmetic devices such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit).

[0016] 1 is an example, and the hardware configuration of the abnormality type presentation device 10 is not limited to this. For example, the abnormality type presentation device 10 may have multiple auxiliary storage devices 107 or multiple processors 108, may not have some of the hardware shown in the figure, or may have various types of hardware other than the hardware shown in the figure.

[0017] <Example of functional configuration of abnormality type presentation device 10> An example of the functional configuration of the abnormality type presentation device 10 according to this embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the functional configuration of the abnormality type presentation device 10 according to this embodiment.

[0018] As shown in FIG. 2 , the abnormality type presentation device 10 according to this embodiment includes an abnormality period acquisition unit 201, a label assignment unit 202, a model creation unit 203, an abnormality type identification unit 204, and a presentation unit 205. These units are realized, for example, by a process in which one or more programs installed in the abnormality type presentation device 10 are executed by a processor 108 or the like. The abnormality type presentation device 10 according to this embodiment also includes an abnormality event log storage unit 206, a sensor data storage unit 207, a model storage unit 208, and a response manual storage unit 209. Each of these storage units is realized, for example, by a storage area of ​​the auxiliary storage device 107 or the like. However, at least some of these storage units may be realized by a storage area of ​​a storage device (e.g., a storage device provided in a database server) communicably connected to the abnormality type presentation device 10.

[0019] The abnormality period acquisition unit 201 acquires the abnormality type and abnormality period from the abnormality event log stored in the abnormality event log storage unit 206. The abnormality period is, for example, the period from the date and time when the abnormality occurs to the date and time when the abnormality ends.

[0020] The labeling unit 202 assigns a label indicating normality or abnormality type to each piece of sample data x(t) included in the sensor data X stored in the sensor data storage unit 207, using the abnormality type and abnormality period acquired by the abnormality period acquisition unit 201. That is, the labeling unit 202 assigns a label indicating abnormality type corresponding to the abnormality period to sample data x(t) included in the abnormal period, and assigns a label indicating normality to sample data x(t) not included in any abnormal period. Hereinafter, the label assigned to sample data x(t) is referred to as y(t), and the sensor data composed of the sample data after labeling is referred to as "labeled sensor data." If the labeled sensor data is X', then X' is expressed as X' = {(x(t), y(t)) | t ∈ T}. Note that the label y takes the values ​​y ∈ {0, 1, . . . , C}, where y = 0 indicates normality, and y = c (1 ≦ c ≦ C) indicates the cth abnormality type.

[0021] The model creation unit 203 uses the labeled sensor data X' to create a model (hereinafter referred to as an "anomaly type identification model") that identifies whether an anomaly has occurred in the anomaly detection target and, if an anomaly has occurred, the type of the anomaly. The model creation unit 203 creates the anomaly type identification model by using techniques such as machine learning, statistics, and multivariate analysis, with each variable x(t) included in the sample data x(t) as an explanatory variable and the label y(t) as a target variable, so as to accurately predict the label y(t) for the sample data x(t). In other words, when the sample data x(t) is used as input data and the label y(t) is used as training data, the model creation unit 203 creates the anomaly type identification model by a supervised learning technique so as to improve the prediction accuracy of a C+1 class classification task.

[0022] The anomaly type identification model can be any machine learning model, statistical model, or multivariate analysis model, such as a neural network, a support vector machine, a decision tree, or a random forest.

[0023] The anomaly type identification unit 204 detects the current time t=t p Sample data x(t p ) (hereinafter referred to as "target sample data x(t p ) is given, the anomaly type identification model identifies whether an anomaly has occurred and, if an anomaly has occurred, the type of the anomaly.

[0024] When the occurrence of an abnormality and the type of the abnormality are identified, the presentation unit 205 obtains a countermeasure corresponding to the type of abnormality from the countermeasure manual stored in the countermeasure manual storage unit 209, and then presents the type of abnormality and the corresponding countermeasure to the user, etc.

[0025] The abnormal event log storage unit 206 stores the abnormal event log. An example of the abnormal event log will be described later.

[0026] The sensor data storage unit 207 stores the sensor data X={x(t)|t∈T}.

[0027] The model storage unit 208 stores the abnormality type identification model created by the model creation unit 203 .

[0028] The troubleshooting manual storage unit 209 stores a troubleshooting manual. An example of the troubleshooting manual will be described later.

[0029] <Example of an abnormal event log> An example of the abnormal event log stored in the abnormal event log storage unit 206 will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the abnormal event log.

[0030] 3, the abnormality event log storage unit 206 stores one or more abnormality event logs, and each abnormality event log includes an occurrence date and time, an end date and time, an abnormality type, etc. Here, the occurrence date and time refers to the date and time when the abnormality occurred, the end date and time refers to the date and time when the abnormality ended (in other words, the date and time when the countermeasure for the abnormality was completed and the system returned to normal), and the abnormality type refers to the type of abnormality that occurred. There are various types of abnormalities depending on the type of abnormality detection target, and specific examples include "torque abnormality," "current abnormality," "abnormal noise," "product defect," "scratch," "warping," etc.

[0031] For example, in the example shown in FIG. 3, the anomaly event log on the first line contains the occurrence date and time "s1", the end date and time "e1", the anomaly type "anomaly 1", etc. Similarly, the anomaly event log on the second line contains the occurrence date and time "s2", the end date and time "e2", the anomaly type "anomaly 2", etc. Similarly, the anomaly event log on the third line contains the occurrence date and time "s3", the end date and time "e3", the anomaly type "anomaly 1", etc. Similarly, the anomaly event log on the fourth line contains the occurrence date and time "s4", the end date and time "e4", the anomaly type "anomaly 3", etc.

[0032] In addition to the occurrence date and time, end date and time, and type of abnormality, the abnormality event log may also include information such as the method of dealing with the abnormality and the person who dealt with it.

[0033] <Example of a response manual> An example of the response manual stored in the response manual storage unit 209 will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the response manual.

[0034] 4, one or more troubleshooting manuals are stored in the troubleshooting manual storage unit 209, and each troubleshooting manual includes an abnormality type, a troubleshooting method, etc. Here, the abnormality type refers to the type of abnormality, and the troubleshooting method refers to the method for dealing with the abnormality (i.e., a method for returning to normal when the abnormality occurs).

[0035] For example, in the example shown in Figure 4, the troubleshooting manual on the first line includes the abnormality type "Abnormality 1" and the corresponding countermeasures. Similarly, the troubleshooting manual on the second line includes the abnormality type "Abnormality 2" and the corresponding countermeasures. Similarly, the troubleshooting manual on the third line includes the abnormality type "Abnormality 3" and the corresponding countermeasures. Similarly, the troubleshooting manual on the fourth line includes the abnormality type "Abnormality 4" and the corresponding countermeasures.

[0036] In addition to the type of abnormality and the countermeasure, the countermeasure manual may also include information such as the estimated time required to deal with the abnormality when the countermeasure is implemented.

[0037] <Model creation process> The model creation process for creating an anomaly type identification model will be described below with reference to Fig. 5. Fig. 5 is a flowchart showing an example of the model creation process according to this embodiment. The following model creation process is executed when the anomaly detection target is offline. However, for example, the model creation process may also be executed in the background when the anomaly detection target is online.

[0038] The abnormality period acquisition unit 201 acquires the abnormality type and abnormality period from the abnormality event log stored in the abnormality event log storage unit 206 (step S101). That is, the abnormality period acquisition unit 201 acquires the occurrence date and time and the end date and time as the abnormality period from each abnormality event log stored in the abnormality event log storage unit 206, and also acquires the abnormality type from the abnormality event log. As a result, (abnormality period, abnormality type) is acquired from each abnormality event log.

[0039] Hereinafter, assuming that I abnormal event logs are stored in the abnormal event log storage unit 206, the abnormal period acquired from the i (1≦i≦I)-th abnormal event log is defined as Δ i =[s i -ε i1 ,s i -ε i2 ](where ε i1 ≧ε i2 , ε i1 ≧0), the abnormality type obtained from the i-th abnormal event log is d i In addition, the abnormality type is expressed as an integer value between 1 and C, and d i ∈{1, ,C}, where s i is the occurrence date and time included in the i-th abnormal event log. i =[s i -ε i1 ,s i -ε i2 The reason for this is that i -ε i1 From s i -ε i2 This is because the period between is considered to be abnormally related. i ,d i )|1≦i≦I}. However, for simplicity, in the following, for any i≠j∈{1, ,I}, Δ i ∩Δ j =φ. This means that each abnormal period Δ i This means that only one type of anomaly occurs. i2Note that is not limited to 0 or a positive number, but can also be a negative number.

[0040] In step S101, the abnormal period is Δ i =[s i -ε i1 ,s i -ε i2 ], but for example, Δ i =[s i ,e i ] or ε i1 '≧0,ε i2 '≧0(where (ε i1 ',ε i2 ')≠(0,0)), and Δ i =[s i -ε i1 ',e i +ε i2 '] can also be used.

[0041] The labeling unit 202 calculates the {(Δ i ,d i )|1≦i≦I}, the label assignment unit 202 assigns a label to each sample data x(t) included in the sensor data X (step S102). i For sample data x(t), the anomaly type d i Let t∈T\(Δ1∪ ∪Δ I ) sample data x(t) is assigned a label y(t) indicating normality. i ∈{1, ,C}, so the anomaly type d i The label y(t) represents y(t)=d i On the other hand, the label y(t) representing normality can be set to y(t) = 0. As a result, in step S102 above, the labeled sensor data X' = {(x(t), y(t))|t∈T} is obtained.

[0042] The model creation unit 203 creates an anomaly type identification model using the labeled sensor data X' obtained in step S102 above (step S103). That is, when sample data x(t) is used as input data to the anomaly type identification model and label y(t) is used as training data for the input data, the model creation unit 203 creates the anomaly type identification model by a supervised learning method so as to improve the prediction accuracy of the C+1 class classification task. More specifically, when the predicted label when sample data x(t) is input to the anomaly type identification model is set to ^y(t), the model creation unit 203 updates the parameters of the anomaly type identification model so as to minimize the error (which may also be called "loss") between ^y(t) and y(t).

[0043] The model creating unit 203 stores the anomaly type identification model created in the above step S103 in the model storage unit 208 (step S104).

[0044] <Anomaly type presentation processing> Hereinafter, an abnormality type presentation process for presenting to a user or the like whether an abnormality has occurred in the abnormality detection target, and if an abnormality has occurred, the type of abnormality and a countermeasure, will be described with reference to FIG. 6. FIG. 6 is a flowchart showing an example of the abnormality type presentation process according to this embodiment. The following abnormality type presentation process is carried out by displaying target sample data x(t p ) is given. p ) is provided to the abnormality type presentation device 10, for example, at each sampling period of the sample data.

[0045] The anomaly type identification unit 204 uses the given target sample data x(t p ) is acquired (step S201).

[0046] The anomaly type identification unit 204 uses the anomaly type identification model stored in the model storage unit 208 to identify the target sample data x(t p) to identify whether an abnormality has occurred and, if an abnormality has occurred, the type of abnormality (step S202). p ) is input to the anomaly type identification model, and the predicted label ^y(t p ) is output. This predicted label ^y(t p ) is ^y(t p )=0 is normal, ^y(t p )=c(1≦c≦C) indicates that the cth abnormality type has occurred.

[0047] The presentation unit 205 determines whether the value is determined to be normal in step S202 (i.e., ^y(t p )=0 (step S203).

[0048] If it is determined in step S203 above that the abnormality type is identified as normal, the presentation unit 205 ends the abnormality type presentation process. In this case, however, the presentation unit 205 may present the normality to the user, etc. In this case, the presentation unit 205 may present the normality to the user, etc. by outputting it to the display device 102 such as a display, or may present it to the user, etc. by outputting it to an operator terminal, etc., that is communicably connected to the abnormality type presentation device 10.

[0049] On the other hand, if it is not determined that the abnormality is specified as normal in step S203, the presenting unit 205 acquires a countermeasure corresponding to the abnormality type from the countermeasure manual stored in the countermeasure manual storage unit 209 (step S204). p If c)=c, the countermeasure for the c-th abnormality type is obtained from the countermeasure manual. Note that if the countermeasure is included in the abnormality event log, the presentation unit 205 may obtain the countermeasure for the c-th abnormality type from the abnormality event log.

[0050] The presentation unit 205 presents the anomaly type identified in step S202 and the countermeasure acquired in step S204 to the user or the like (step S205). At this time, the presentation unit 205 may present the anomaly type and the countermeasure to the user or the like by outputting them to the display device 102 such as a display, or may present them to the user or the like by outputting them to an operator terminal or the like communicably connected to the anomaly type presentation device 10. This allows the user or the like to know the type of anomaly that has occurred in the anomaly detection target and the countermeasure for the anomaly, and enables recovery work or the like to be carried out early on.

[0051] <Summary> As described above, the anomaly type presentation device 10 according to this embodiment creates learning data by labeling each sample data included in sensor data using an anomaly event log, and then creates an anomaly type identification model from this learning data through supervised learning. This makes it possible to identify not only whether an anomaly has occurred when the anomaly detection target is online, but also the type of an anomaly if one does occur. This makes it possible to quickly take appropriate action depending on the type of anomaly, and achieve early recovery of the anomaly detection target.

[0052] In the above embodiment, the type of abnormality and the countermeasure are presented to the user in step S205 of FIG. 6. However, in addition to this, information such as the estimated time required for the countermeasure may also be presented to the user.

[0053] Furthermore, in the above embodiment, the type of abnormality and a solution to the problem are presented to the user in step S205 of FIG. 6, but it is not always necessary to present a solution to the problem, and only the type of abnormality may be presented to the user.

[0054] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims. [Explanation of symbols]

[0055] 10 Abnormality type display device 101 Input Device 102 Display device 103 External I / F 103a Recording media 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage 108 processors 109 Bus 201 Abnormal period acquisition section 202 Label Assignment Unit 203 Model Creation Department 204 Abnormality type identification unit 205 Presentation section 206 Abnormal event log storage unit 207 Sensor data storage unit 208 Model Memory Unit 209 Response manual memory section

Claims

1. an acquisition unit that acquires, based on an abnormality event log including a date and time of occurrence of a past abnormality that occurred in the target and an abnormality type that indicates the type of the abnormality, an abnormality period that includes at least a period based on the date and time of occurrence; and the abnormality type; an assigning unit that assigns a first label representing normality or the abnormality type to first sample data obtained by measuring a past state of the object based on the abnormality period and the abnormality type; a creation unit that creates a model that predicts the first label when the first sample data is input, based on the first sample data to which the first label is assigned; an identification unit that, when second sample data of the subject is given, identifies a second label representing a normal or abnormal type based on the model and the second sample data; a presentation unit that presents at least the abnormality type when the second label represents the abnormality type; An abnormality type presentation device having the same.

2. The granting unit 2. The abnormality type presentation device according to claim 1, wherein a first label representing an abnormality type corresponding to the abnormal period is assigned to first sample data whose measurement date and time falls within the abnormal period, and a first label representing normality is assigned to first sample data whose measurement date and time fall outside any of the abnormal periods.

3. The creation unit The anomaly type presentation device according to claim 1 , wherein the model is created by a supervised learning method using the first sample data as input data and the first label as training data.

4. The presentation unit 2. The abnormality type presentation device according to claim 1, wherein the abnormality type represented by the second label and a countermeasure to be taken when an abnormality of the abnormality type occurs are presented based on a countermeasure manual that includes the abnormality type and a countermeasure to be taken when an abnormality of the abnormality type occurs.

5. The response manual further includes an estimated response time for the response method, The presentation unit The anomaly type presentation device according to claim 4 , further presenting the estimated response time.

6. The abnormality event log further includes a countermeasure when an abnormality of the abnormality type occurs, The presentation unit The anomaly type presentation device according to claim 1 , further comprising: a display device that displays an anomaly type indicated by the second label and a countermeasure to be taken when an anomaly of the anomaly type occurs.

7. an acquisition step of acquiring an abnormality period including at least a period based on the date and time of occurrence of a past abnormality that occurred in the target and an abnormality type that indicates the type of the abnormality, based on an abnormality event log that includes the date and time of the occurrence; an assignment step of assigning a first label representing normality or the abnormality type to first sample data obtained by measuring a past state of the object based on the abnormality period and the abnormality type; a creation step of creating a model that predicts the first label when the first sample data is input, based on the first sample data to which the first label has been assigned; an identification step of identifying a second label representing a normal or abnormal type based on the model and the second sample data when second sample data of the subject is given; a presentation step of presenting at least the abnormality type when the second label represents the abnormality type; The computer performs different abnormality presentation methods.

8. an acquisition step of acquiring an abnormality period including at least a period based on the date and time of occurrence of a past abnormality that occurred in the target and an abnormality type that indicates the type of the abnormality, based on an abnormality event log that includes the date and time of the occurrence; an assignment step of assigning a first label representing normality or the abnormality type to first sample data obtained by measuring a past state of the object based on the abnormality period and the abnormality type; a creation step of creating a model that predicts the first label when the first sample data is input, based on the first sample data to which the first label has been assigned; an identification step of identifying a second label representing a normal or abnormal type based on the model and the second sample data when second sample data of the subject is given; a presentation step of presenting at least the abnormality type when the second label represents the abnormality type; A program that causes a computer to execute the following.

Images