Anomaly detection device, anomaly detection method, and program

Abstract

Abnormalities in operating data are detected by comparing them with more appropriate normal operating data. [Solution] An abnormality detection device according to one embodiment includes: acquisition means for acquiring target operating data that is subject to abnormality detection, which includes time changes of multiple measured values ​​in factory equipment; access means for accessing a database in which past operating data, which is operating data in a specific past state of the factory equipment, is recorded and classified into multiple groups; identification means for identifying a group among the multiple groups whose similarity to the time changes of the target operating data satisfies a criterion; detection means for detecting an abnormality in the target operating data based on a comparison between the past operating data of the identified group and the target operating data; and notification means for notifying the abnormality detected by the detection means.

Description

Technical Field

[0001] The present disclosure relates to a technique for detecting anomalies in operation data in factory equipment.

Background Art

[0002] Techniques for monitoring operation data of factories are known. For example, Patent Document 1 discloses a system for diagnosing the operation state of an oil refining plant, which extracts normal operation data similar to the operation data and determines the operation state from the Mahalanobis distance between the extracted normal operation data and the operation data. Patent Document 2 discloses a technique for performing abnormality determination of a plant by calculating a modified Mahalanobis distance obtained by excluding factors for reducing the Mahalanobis distance in order to determine the operation state without extracting similar normal operation data in the technique of Patent Document 1.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0004] In the operation of certain factories, it is necessary to monitor operation data of a large number of items. However, in an oil plant, for example, when multiple operation patterns are used in a time series, simply extracting operation data that is temporarily similar as in Documents 1 and 2 may not be appropriate as a criterion for abnormality determination.

[0005] In contrast, the present disclosure provides a technique for detecting anomalies in operation data by comparing it with more suitable normal operation data.

Means for Solving the Problems

[0006] One aspect of this disclosure provides an anomaly detection device comprising: acquisition means for acquiring target operating data that is subject to anomaly detection, which includes time changes of multiple measured values ​​in a factory facility; access means for accessing a database in which past operating data, which is operating data in a specific past state of the factory facility, is recorded and classified into multiple groups; identification means for identifying a group among the multiple groups whose similarity to the time changes of the target operating data satisfies a criterion; detection means for detecting anomalies in the target operating data based on a comparison between the past operating data of the identified group and the target operating data; and notification means for notifying of the anomaly detected by the detection means.

[0007] Another aspect of this disclosure provides an anomaly detection method comprising the steps of: acquiring target operating data which includes time changes of multiple measured values ​​in a factory facility and is subject to anomaly detection; accessing a database in which past operating data, which is operating data in a specific past state of the factory facility, is recorded and classified into multiple groups; identifying a group from the multiple groups whose similarity to the time changes of the target operating data satisfies a criterion; detecting an anomaly in the target operating data based on a comparison between the past operating data of the identified group and the target operating data; and notifying the anomaly detected in the detection step.

[0008] A further aspect of this disclosure provides a program for a computer to perform the following steps: acquire target operating data, which includes time changes in multiple measured values ​​of a factory facility, and is subject to anomaly detection; access a database in which past operating data, which is operating data of the factory facility in a specific past state, is recorded and classified into multiple groups; identify a group among the multiple groups whose similarity to the time changes of the target operating data meets a criterion; detect anomalies in the target operating data based on a comparison between the past operating data of the identified group and the target operating data; and notify the computer of the anomaly detected in the detection step. [Effects of the Invention]

[0009] According to this disclosure, abnormalities in operating data can be detected by comparing them with more suitable normal operating data. [Brief explanation of the drawing]

[0010] [Figure 1] A diagram showing an overview of a factory monitoring system 1 according to one embodiment. [Figure 2] A diagram illustrating the functional configuration of factory monitoring system 1. [Figure 3] A diagram illustrating the hardware configuration of the information processing device 10. [Figure 4] This figure illustrates the initial screen 91 of the anomaly detection program. [Figure 5] A diagram illustrating the secondary screen 92 of an anomaly detection program. [Figure 6] A flowchart illustrating the operation of an anomaly detection program. [Figure 7] This figure illustrates the input screen 93 for setting up anomaly detection. [Figure 8] A diagram illustrating the concept of reference data search. [Figure 9] A diagram illustrating the concept of the improved K-nearest neighbors method. [Figure 10] A diagram illustrating the overview of the anomaly detection phase. [Figure 11] Figure showing an overview of a continuous upward trend. [Figure 12] Figure showing an overview of a continuous downward trend. [Figure 13] Figure showing an overview of an approximate upward trend. [Figure 14] Figure showing an overview of an approximate downward trend. [Figure 15] Figure showing an overview of a no-change trend. [Figure 16] Figure showing an overview of a large maximum-minimum width. [Figure 17] Figure showing an overview of a moving average deviation. [Figure 18] Figure showing an overview of outliers (maximum and minimum). [Figure 19] Figure showing an overview of the outlier (maximum). [Figure 20] Figure showing an overview of the outlier (minimum). [Figure 21] Figure showing an overview of a large maximum-minimum difference. [Figure 22] Figure showing an overview of a large variation in the ratio of past data. [Figure 23] Figure showing an overview of a positive-direction outlier in the ratio of past data. [Figure 24] Figure showing an overview of a negative-direction outlier in the ratio of past data. [Figure 25] Figure showing an overview of a large control deviation. [Figure 26] Figure showing an overview of OP / MV fully open. [Figure 27] Figure showing an overview of OP / MV fully closed. [Figure 28] Figure showing an overview of the continuation of the manual mode. [Figure 29] Figure showing an overview of exceeding the operation range. [Figure 30] Figure illustrating the result display screen.

Mode for Carrying Out the Invention

[0011] 1. Configuration Figure 1 is a diagram illustrating an overview of a factory monitoring system 1 according to one embodiment. The factory monitoring system 1 is a system that monitors the operating status of factory F. The factory monitoring system 1 has a plurality of instruments 51, a DSC 30, a DMZ 20, and an information processing device 10. The plurality of instruments 51 are devices that measure the status of factory equipment 5 within factory F, and include various instruments or sensors. Factory equipment 5 refers to the production equipment or production apparatus of the factory. As an example, factory equipment 5 is one of the following: a distillation column, a heating furnace, a reactor, a heat exchanger, a compressor, a cooling tower, a separator, a storage tank, a condenser, and a pump. Multiple pieces of factory equipment 5 are installed within one factory F. One or more instruments 51 are attached to one piece of factory equipment 5. In Figure 1, the i-th piece of factory equipment is called factory equipment 5[i], and the j-th instrument attached to factory equipment 5[i] is called instrument 51[i, j]. Each instrument 51 is, for example, a flow meter, pressure gauge, thermometer, vibration sensor, ammeter, voltmeter, hygrometer, position sensor, weighing scale, or gas sensor. The data output from these instruments 51 is processed as operating data indicating the status of the factory equipment.

[0012] In related technologies, so-called boardmen (i.e., humans) visually inspected this large amount of operational data to detect abnormal conditions. For example, in oil refining or petrochemical processes, hundreds to thousands of types of operational data are used. Visually inspecting this data is a very difficult task; for example, it would take a skilled boardman about an hour to check 800 to 900 types of operational data, and several times longer for an unskilled boardman. Factory monitoring system 1 uses AI (Artificial Intelligence) to assist boardmen in the task of checking operational data.

[0013] DSC30 is an automated system for monitoring and controlling various processes in Factory F. DSC30 efficiently manages large-scale processes and the entire factory by assigning control to multiple distributed controllers (not shown). DMZ20 is a network segment that functions as a security layer between IT and OT (Operational Technology) networks. DMZ20 is designed to prevent the factory's control systems and production equipment from directly contacting external networks, particularly the internet. The purpose of DMZ20 is to isolate the factory's OT network (control systems and equipment) from the normal IT network (Internet or business network) while ensuring that necessary data and communications are secure. A database is located within DMZ20 where various types of data are recorded.

[0014] In this embodiment, the information processing device 10 is an anomaly detection device that monitors operating data and detects abnormalities. In this example, the information processing device 10 is installed on the company's internal network. Software for monitoring operating data is installed on the information processing device 10.

[0015] Figure 2 is a diagram illustrating the functional configuration of the factory monitoring system 1. The factory monitoring system 1 includes a storage means 11, an acquisition means 12, an access means 13, an identification means 14, a detection means 15, a notification means 16, a receiving means 17, and a control means 19. Of these, the storage means 11 is implemented on a server in the company's internal network. The other elements are implemented on the information processing device 10. The storage means 11 stores various types of data and programs. In this example, the data stored by the storage means 11 includes a database 111. The database 111 is a database in which operating data (hereinafter referred to as "past operating data") for specific past states of factory equipment is recorded. A specific state is, for example, a normal state, i.e., a state in which no abnormalities have occurred. In the database 111, past data is classified into several groups. The acquisition means 12 acquires operating data (hereinafter referred to as "target operating data") that is the target of abnormality detection. As mentioned above, the operating data is data that shows the time change of multiple measured values ​​in the factory equipment. The access means 13 accesses the database 111. The identification means 14 identifies a group from among several groups whose similarity to the time-dependent changes in the target operating data meets the criteria. The detection means 15 detects anomalies in the target operating data based on a comparison between the past operating data of the identified group and the target operating data. The notification means 16 notifies the detection means 15 of the anomaly detected.

[0016] The receiving means 17 accepts the setting of criteria for detecting abnormalities for each of the multiple abnormality criteria for each of the multiple abnormality criteria. The control means 19 performs various controls.

[0017] Figure 3 illustrates the hardware configuration of the information processing device 10. The information processing device 10 is a computer device having a CPU 101, memory 102, storage 103, communication IF 104, input device 105, and output device 106. The CPU 101 is a processing device that performs various processes according to a program. The memory 102 is a main memory that functions as a work area when the CPU 101 executes a program. The storage 103 is a non-volatile auxiliary storage device that stores various data and programs. The communication IF 104 is a device that communicates with other information processing devices according to a predetermined communication standard (e.g., Ethernet®). The input device 105 is a device for the user to input instructions or information to the information processing device 10, and includes at least one of a keyboard, touchscreen, pointing device, and microphone. The output device 106 is a device that presents information to the user, and includes at least one of a display and speaker. In this example, the information processing device 10 is a so-called client device that can access a server on the company network and acquire various data.

[0018] In this example, the program stored in the storage 103 includes a program (hereinafter referred to as the "anomaly detection program") that causes the computer to function as an information processing device 10 in the factory monitoring system 1. When the CPU 101 is executing the anomaly detection program, at least one of the memory 102 and the storage 103 is an example of a storage means 11, and the CPU 101 is an example of an acquisition means 12, an access means 13, an identification means 14, a detection means 15, a notification means 16, an acceptance means 17, and a control means 19.

[0019] 2.Operation Next, the operation of the factory monitoring system 1, particularly the information processing device 10, will be explained. Boardman starts the anomaly detection program in the information processing device 10. Once started, the anomaly detection program displays an initial screen. In the following explanation, the anomaly detection program, which is software, will be described as the main processing unit. This means that hardware elements such as the CPU 101 that executes the anomaly detection program will perform the processing in cooperation with other hardware elements. As already explained, operating data is data that shows the time changes of multiple measured values ​​in the factory equipment. In the following explanation, each item will be called a "tag," and the data for each item will be called "tag data." Each tag data includes measured values ​​at multiple time points (hereinafter referred to as "sample time," that is, sampling points on the time axis).

[0020] Figure 4 illustrates the initial screen 91 of an anomaly detection program. In this example, the initial screen 91 has area 81, area 82, button 83, and button 84. Area 81 is an area for inputting the setting value for the period to be judged. Area 82 is an area for inputting the setting value for the process of checking the trend for any tag over any period (hereinafter referred to as the "detailed trend display process"). Button 83 is a UI object that instructs the start of the anomaly detection process. Button 84 is a UI object that instructs the execution of the detailed trend display process. The initial screen 91 includes a tab or button (not shown) as a UI object that instructs the transition to the secondary screen, and the user transitions to the secondary screen by operating this tab or button.

[0021] Figure 5 illustrates a secondary screen 92 of an anomaly detection program. In this example, the secondary screen 92 has an area 85, a button 86, and a button 87. Area 85 is an area that displays the results of the most recent anomaly detection process. Button 86 is a UI object that instructs the user to start the anomaly detection process. Button 87 is a UI (User Interface) object that instructs the user to execute the detailed trend display process.

[0022] Figure 6 is a flowchart illustrating the operation of an anomaly detection program. The flow in Figure 6 is initiated, for example, when Boardman instructs the anomaly detection program to start.

[0023] In step S11, the anomaly detection program accepts input for pre-preparation settings. Pre-preparation settings include, for example, settings related to data acquisition and settings related to anomaly detection. Settings related to data acquisition include, for example, (1) database server name, (2) device name or section name, and (3) judgment criterion period. Settings related to data acquisition are entered via an input screen for these settings (not shown). The database server name is the identification information of the server where the tag data subject to anomaly detection, i.e., judgment, is stored. The device name and section name are the identification information of the device and section, respectively. A section is the identification information of a group of devices in a factory. If judgment is to be made for multiple devices, the device name or section name can be specified. The judgment criterion period is the period that serves as the basis for judgment, i.e., a period that is considered appropriate to use as past operating data. It is preferable that the judgment criterion period satisfies the following (a) to (d): (a) It does not include a period that includes device trouble or equipment failure data. (b) It does not include a period in which tag data is not registered in the PIMS (Plant Information Management System). (c) The period includes multiple operating patterns (e.g., different feed amounts or different specifications). (d) The period includes patterns with good unit consumption. From the above points (a) to (d), it is expected that better results will be obtained as the variety of operating patterns is more comprehensively included.

[0024] Figure 7 illustrates an example of the input screen 93 for setting anomaly detection. The input screen 93 has input fields 88 and 89. Input field 88 is an area for entering the normal operating range for each tag. The normal operating range indicates the allowable range of numerical fluctuation in the tag data (for example, the range of upward and downward deviation from the reference value; the range of upward and downward deviation may be the same). Input field 89 is an area for entering the setting value for the hide setting for each tag. The hide setting is a setting that considers a pattern to occur frequently and does not detect an anomaly if its occurrence frequency is above the setting value. Note that the normal operating range and hide setting are optional, and the process will operate even if they are left blank. These settings are also examples of settings related to the sub-algorithms described later.

[0025] Refer to Figure 6 again. In step S12, the anomaly detection program accepts the specification of the target operating data. Specifically, the boardman inputs the setting value for the period to be judged in area 81 of the initial screen 91. The setting value for the period to be judged includes the start and end dates of the period. The start and end dates of the period are specified in units of hours, minutes, and seconds, in addition to the date.

[0026] In step S13, the anomaly detection program receives an instruction to execute the anomaly detection process. Specifically, Boardman instructs the execution of the anomaly detection process by pressing button 84 on the initial screen 91. Upon receiving the instruction to execute the anomaly detection process, the anomaly detection program executes the anomaly detection process (step S14). The anomaly detection process in step S14 is referred to as the main algorithm in contrast to the sub-algorithms described later.

[0027] A concrete example of the anomaly detection algorithm is shown in Figure 6. In step S141, the anomaly detection program preprocesses the tag data. In this example, Z-standardization is used as the preprocessing method for the tag data. Z-standardization is a process that standardizes the data according to the following equation (1).

number

[0028] Here, we will explain the purpose of preprocessing the tag data. For example, even if the measured value changes by "1", its rarity, or meaning, differs greatly depending on what the tag data represents. For instance, if the tag data is the flow rate of a raw material typically used at several hundred to several thousand kL / d, a change of "1 kL / d" is merely an event comparable to instrument white noise and does not pose much of a problem. On the other hand, if the tag data is the tray temperature, a change of "1°C" can be a critical event that could determine whether or not the process stops. Thus, if the raw values ​​of the tag data (i.e., the measured values ​​as they are) are statistically processed directly, the influence of tags with large absolute values ​​of change will become dominant. The preprocessing in step S141 is a process to ensure that each tag (i.e., each variable) can be treated uniformly. Unprocessed data is called "raw value," while Z-standardized data is called "Z score." From step S142 onward, the Z score is used for processing.

[0029] In step S142, the anomaly detection program searches for reference data. Reference data refers to data belonging to the group with the highest similarity to the target operating data, i.e., the group that is most similar, in a situation where past operating data for the factory equipment 5 has been classified into multiple groups. In this example, the similarity between the target operating data and the past operating data is defined based on the distance in a vector space consisting of values ​​based on the measured values ​​of the target operating data at each sampling point.

[0030] Figure 8 illustrates the concept of reference data search. For ease of illustration, a three-dimensional space is considered using three variables (i.e., tags): pressure, flow rate, and temperature. In reality, operating data may have four or more dimensions. In this example, four groups of historical operating data—dataset 71, dataset 72, dataset 73, and dataset 74—and target operating data 79 are illustrated. In this example, each dataset is grouped based on the criteria that (a) the tags relate to the same (single) plant equipment, and (b) the tag data was acquired during the same period. Regarding (a), the tag data belonging to one dataset is data obtained from multiple instruments or sensors attached to a single plant piece of equipment, such as a single reactor. For example, tag data obtained from multiple instruments or sensors attached to a reactor installed in a plant on the same site or building is classified into different groups than tag data obtained from multiple instruments or sensors attached to a distillation column. Regarding (b), the tag data belonging to one dataset is data acquired during a period when the plant equipment was in a specific single operating state. For example, if a single piece of factory equipment operates differently in the morning and afternoon on a given day, the tag data acquired in the morning and the tag data acquired in the afternoon will be classified into different groups. The classification of groups in historical operating data is based, for example, on data labeling by a skilled boardman or data analyst. That is, a skilled boardman or data analyst reviews historical operating data and labels it. This label includes identification information for the factory equipment and identification information for its operating state. Although a detailed explanation is omitted, the function for performing this labeling and the UI for labeling are provided, for example, by an anomaly detection program.

[0031] Database 111 records historical operation data labeled in this manner. In one example, the format of the historical operation data is standardized. Standardization means, for example, that the start and end times for acquiring tag data are standardized (e.g., from 9 a.m. to 5 p.m. every day), and that the data sampling interval is standardized (e.g., every 5 minutes).

[0032] In one example, the anomaly detection program accepts the specification of past operating data to be used as the population for the reference data search. In this case, the anomaly detection program presents the boardman with a list of past operating data (for example, a list of groups based on labels). The boardman selects a group from this list to be used as the population for the reference data search. The anomaly detection program then performs the reference data search using the specified group as the population. Alternatively, the anomaly detection program may process all past operating data recorded in database 111 as the population for the reference data search.

[0033] In this example, a method based on the K-nearest neighbors method is used for finding the reference data. The K-nearest neighbors method is a machine learning technique. More specifically, a modified version of the K-nearest neighbors method that takes into account the time series nature of the data is used. Specifically, the anomaly detection program searches for the nearest neighbor data from past operating data at each sample time of the target operating data. The anomaly detection program decides to use the group of past operating data that contains the most nearest neighbor data from among several groups as the nearest neighbor dataset, i.e., the reference data.

[0034] Figure 9 illustrates the concept of the improved K-nearest neighbors method. For illustrative purposes, we consider a one-dimensional approach (i.e., one variable (tag)). In Figure 9, the horizontal axis represents the sampling time, and the vertical axis represents the Z-score of a given tag. To simplify the diagram, we consider only historical operating data from two groups, dataset 71 and dataset 72. In Figure 9, the target operating data at each sampling time is represented by white circles, and the nearest neighbor data is represented by black circles. In this example, dataset 71 has more nearest neighbor data than dataset 72, so the anomaly detection program decides to use dataset 71 as the reference dataset.

[0035] Refer to Figure 6 again. In step S143, the anomaly detection program performs anomaly detection. In this example, anomaly detection is performed using a distance learning (metric learning) method. This is based on the fact that feature vectors point in the same direction and have the same vector quantity under normal conditions, but the feature vectors change under abnormal conditions. More specifically, the MT (Mahalanobis-Taguchi) method is used for anomaly detection. In this embodiment, the MT method is referred to as the main algorithm. The MT method is known as a data analysis method for pattern recognition and anomaly detection of multidimensional data. The MT method uses the Mahalanobis distance. The Mahalanobis distance is an index that represents how far a data point is from a standard dataset (or cluster) in multidimensional data with different scales or correlations. A feature of the Mahalanobis distance is that it takes into account the correlation of the data, enabling a more accurate assessment of the degree of anomaly than simple Euclidean distance. This makes it possible to detect anomalous data points even in multidimensional data.

[0036] This section outlines the MT method. The MT method is broadly divided into a criterion generation phase and an anomaly detection phase. In the criterion generation phase, the anomaly detection program calculates the correlation coefficients between variables in the reference dataset. For simplicity, considering a three-dimensional (i.e., three-tag) Z-score space for temperature, flow rate, and pressure, the anomaly detection program calculates the correlation coefficients between temperature and flow rate, flow rate and pressure, and pressure and temperature. The anomaly detection program generates a criterion vector from these correlation coefficients.

[0037] Figure 10 shows an overview of the anomaly detection phase. Next, in the anomaly detection phase, the anomaly detection program determines whether the data at each sample time in the target operating data fits the judgment criterion vector. Specifically, the anomaly detection program calculates the Mahalabinous distance of a data point at a certain sample time in the target operating data from a unit space defined based on the reference dataset. Note that this explanation is purely conceptual; in reality, a mathematical formula known as the MT method is used to perform the process mathematically.

[0038] Refer to Figure 6 again. In step S15, the anomaly detection program performs anomaly detection based on a sub-algorithm. In this example, a sub-algorithm refers to anomaly detection by an algorithm other than the main algorithm. Sub-algorithms include, for example, at least one of the following: (1) continuous upward trend, (2) continuous downward trend, (3) approximate upward trend, (4) approximate downward trend, (5) no change trend, (6) large maximum / minimum range, (7) moving average deviation, (8) outlier (maximum / minimum), (9) outlier (maximum), (10) outlier (minimum), (11) large maximum / minimum difference, (12) large fluctuation compared to past data, (13) positive outlier compared to past data, (14) negative outlier compared to past data, (15) large control deviation, (16) OP / MV fully open, (17) OP / MV fully closed, (18) manual mode continued, and (19) exceeding operating range. These are all examples of anomaly criteria defined in the factory monitoring system 1. By using these multiple sub-algorithms in combination, the comprehensiveness of anomaly detection can be improved. The following is an overview of each sub-algorithm.

[0039] (1) Continued upward trend Figure 11 shows an overview of a continuous upward trend. This algorithm aims to detect tags that show a continuous upward trend. This algorithm includes the following processes: (1a) The Z score at each sample time in the target judgment period is compared with the Z score at the immediately preceding sample time (hereinafter referred to as the "previous snapshot value"). This comparison is performed for all sample times. (1b) If the previous snapshot value continues to exceed the previous value through repeated comparisons, the condition is met. (1c) If the pattern occurrence rate is below the set value for that tag, a warning is displayed.

[0040] The pattern occurrence rate refers to the proportion of times a particular tag's pattern (the form of change in measured values ​​over time, for example, a continuous upward trend) appears in past operating data. The pattern each tag exhibits during normal operation differs for each tag. For example, for a tag where a continuous upward trend indicates normal operation, applying this algorithm to past operating data will result in a high probability of meeting this condition. For instance, if the proportion of appearances of this pattern within a unit period (which can be arbitrarily set, such as from 9 AM to 5 PM daily) is high, it can be determined that the pattern is a frequently occurring pattern during normal operation and should not be detected as an anomaly.

[0041] For example, in an anomaly detection program, when an anomaly detection process is performed using a sub-algorithm on past operating data, information about patterns with a high occurrence rate is displayed on the anomaly detection program screen, specifically in area 85. This information about patterns with a high occurrence rate includes, for example, identification information of patterns (i.e., sub-algorithms) with an application rate of a predetermined number (e.g., the top 3) or an occurrence rate of a threshold (e.g., 30%) or higher, and the numerical value of their occurrence rate. Boardman can review this information and set a threshold for the pattern occurrence rate. For example, if the occurrence rate of a continuous upward trend was 95% in past operating data under normal conditions, then it is normal for the tag to show a continuous upward trend, and the continuous upward trend should not be detected as an anomaly. In this case, if the threshold for the pattern occurrence rate is set to 80%, then if the occurrence rate of a continuous upward trend in the target operating data is 80% or higher, it will not be notified as an anomaly. The anomaly detection program will notify an anomaly when the occurrence rate of a continuous upward trend falls below the threshold, for example, to 60%. In this way, by notifying only those anomalies that meet the set criteria among those detected (primitively or potentially) in the sub-algorithm, over-detection can be prevented. This approach makes it possible to provide a more user-friendly system for the boardman, i.e., the user.

[0042] If the threshold for pattern occurrence rate is not set (blank or null), the anomaly detection program will notify an anomaly when it detects that pattern. The setting of the threshold for pattern occurrence rate also applies to the sub-algorithms described below.

[0043] (2) Continued downward trend Figure 12 shows an overview of a continuing downward trend. This algorithm aims to detect tags that show a continuing downward trend. This algorithm includes the following processes: (2a) The Z score at each sample time in the target judgment period is compared with the Z score at the immediately preceding sample time (hereinafter referred to as the "previous snapshot value"). This comparison is performed for all sample times. (2b) If the previous snapshot value continues to be lower than the previous value through repeated comparisons, the condition is met. (2c) If the pattern occurrence rate is below the set value for that tag, a warning is displayed.

[0044] (3) Approximate upward trend Figure 13 shows an overview of the approximate upward trend. This algorithm aims to detect tags that are intermittently increasing and have maintained an upward trend recently. This algorithm includes the following processes: (3a) Divide the Z score for the target period into N intervals. The number of intervals N can be changed by Boardman, etc., and a default value (e.g., 8) is set. (3b) Calculate the average value for each of the N intervals. Multiply the calculated average value by the interval number weighting coefficient (for 8 intervals, -4, -3, ... 3, 4) to obtain a weighted value. (3c) If the sum of the weighted values ​​exceeds the threshold, the latter half of the intervals account for half of the total interval sum, and the average value of the final interval is higher than the average value of the previous interval, the condition is met. Here, the latter half of the interval refers to the second half of the interval when all N intervals are divided into two, i.e., the intervals from the N / 2+1th onwards. The threshold can be changed by Boardman, etc., and a default value (e.g., 20) is set. (3d) If the pattern occurrence rate is less than or equal to the set value for that tag, a warning is displayed. Furthermore, if the above condition 3c is met only in the latter half of the section, the judgment message will change to "Recent sharp upward trend".

[0045] (4) Approximate downward trend Figure 14 shows an overview of the approximate downward trend. This algorithm aims to detect tags that are intermittently declining and have maintained a downward trend in the most recent period. This algorithm includes the following processes: (3a) Divide the Z score for the target period into N intervals. The number of intervals N can be changed by Boardman, etc., and a default value (e.g., 8) is set. (3b) Calculate the average value for each of the N intervals. Multiply the calculated average value by the interval number weighting coefficient (for 8 intervals, -4, -3, ... 3, 4) to obtain a weighted value. (3c) If the sum of the weighted values ​​exceeds the threshold, the latter half of the intervals account for half of the total interval sum, and the average value of the final interval is lower than the average value of the previous interval, the condition is met. Here, the latter half of the interval refers to the second half of the interval when all N intervals are divided into two, i.e., the intervals from N / 2+1 onwards. The threshold can be changed by Boardman, etc., and a default value (e.g., -20) is set. (3d) If the pattern occurrence rate is below the set value for that tag, a warning will be displayed. If the above condition 3c is met only in the latter half of the section, the judgment message will change to "Recent sharp decline trend".

[0046] (5) Tendency to remain unchanged Figure 15 shows an overview of the trend of no change. This algorithm aims to detect tags whose values ​​have not changed. This algorithm includes the following processes: (4a) Compare the Z score at each sample time during the target period with the previous snapshot value. This comparison is performed for all sample times. (4b) In repeated comparisons, if there is no change in all snapshot values ​​(if the change is within the threshold), the condition is met. The threshold can be changed by Boardman, etc., and a default value is set. (4c) If the pattern occurrence rate is below the set value for the tag, a warning is displayed.

[0047] (6) Maximum and minimum width large Figure 16 is a diagram illustrating the overview of the maximum and minimum range. This algorithm aims to detect tags whose operating range has changed. The operating range refers to the region in the time-Z score space where the measured value is located. In other words, the operating range here refers to the range of data values ​​in the operating state of the factory (for example, a state such as "the thermometer reading is around 10°C" or "the thermometer reading is around 20°C"). This algorithm includes the following processes: (6a) Divide the Z score for the target period into N intervals. The number of intervals N can be changed by Boardman, etc., and a default value (e.g., 8) is set. (6b) Calculate the average value for each of the N intervals. (6c) Find the maximum and minimum values ​​of the interval average. (6d) If the difference between this maximum and minimum value is greater than or equal to a threshold, it is determined that the condition is met. The threshold can be changed by Boardman, etc., and a default value (e.g., 2) is set. (6e) If the pattern occurrence rate is less than or equal to the set value for that tag, display a warning.

[0048] (7) Moving average deviation Figure 17 shows an overview of the moving average shift. This algorithm aims to detect tags whose operating range has changed abruptly. This algorithm includes the following processes: (7a) Divide the Z score for the target period into N intervals. The number of intervals N can be changed by Boardman, etc., and a default value (e.g., 8) is set. (7b) Calculate the average value for each of the N intervals. (7c) If the difference between the average values ​​of adjacent intervals is greater than or equal to a threshold, it is determined that the condition is met. The threshold can be changed by Boardman, etc., and a default value (e.g., 2) is set. (6e) If the pattern occurrence rate is less than or equal to the set value for that tag, display a warning.

[0049] (8) Outliers (maximum and minimum) Figure 18 shows an overview of outliers (maximum and minimum). This algorithm aims to detect tags that have outliers in both the upper and lower directions during the target period. This algorithm includes the following processes: (8a) Calculate the maximum and minimum Z-score values ​​during the target period. (8b) Determine that the condition is met if the maximum value is greater than or equal to the threshold and the minimum value is less than or equal to the threshold. The threshold can be changed by Boardman, etc., and default values ​​(e.g., 5 for the maximum value and -5 for the minimum value) are set. (8c) If the pattern occurrence rate is less than or equal to the set value for that tag, display a warning.

[0050] (9) Outlier (maximum) Figure 19 shows an overview of the outlier (maximum). This algorithm aims to detect tags with upward outliers during the target period. This algorithm includes the following processes: (9a) Calculate the maximum Z score during the target period. (9b) Determine that the condition is met if this maximum value is greater than or equal to the threshold. The threshold can be changed by Boardman, etc., and a default value (e.g., 5) is set. (9c) If the pattern occurrence rate is less than or equal to the set value for that tag, display a warning.

[0051] (10) Outlier (minimum) Figure 20 shows an overview of the outlier (minimum). This algorithm aims to detect tags that have a downward outlier during the target period. This algorithm includes the following processes: (10a) Find the minimum Z score during the target period. (10b) Determine if the condition is met if this minimum value is less than or equal to the threshold. The threshold can be changed by Boardman, etc., and a default value (e.g., -5) is set. (10c) If the pattern occurrence rate is less than or equal to the set value for that tag, display a warning.

[0052] (11) Large difference between maximum and minimum Figure 21 shows an overview of the maximum-minimum difference large algorithm. This algorithm aims to detect tags with a large difference between their maximum and minimum values ​​during the target period. This algorithm includes the following processes: (11a) Find the maximum and minimum Z-score values ​​during the target period. (11b) Find the difference between these maximum and minimum values. If this difference is greater than or equal to a threshold, the condition is met. The threshold can be changed by Boardman, etc., and a default value (e.g., 6) is set. (11c) If the pattern occurrence rate is less than or equal to the set value for that tag, a warning is displayed.

[0053] (12) Large fluctuations compared to past data Figure 22 is a diagram illustrating the overview of large fluctuations compared to past data. This algorithm aims to detect tags where the fluctuation range is large compared to the reference dataset and the behavior of the target operating data is unknown (non-learned pattern). This algorithm includes the following processes: (12a) Find the minimum value, maximum value, maximum standard deviation, and maximum fluctuation range of all data in the reference dataset. (12b) Determine if the standard deviation of the target operating data exceeds the product of the maximum standard deviation of the reference dataset and a certain multiplier, the fluctuation range of the target operating data exceeds the product of the maximum fluctuation range of the reference dataset and a certain multiplier, and the fluctuation range of the target operating data exceeds the product of the maximum standard deviation of the reference dataset and a certain multiplier, then the condition is met. The certain multiplier can be changed by Boardman, etc., and default values ​​(for example, 5, 5, and 10 in order) are set.

[0054] (13) Positive outliers relative to past data Figure 23 is a diagram illustrating the overview of positive outliers relative to past data. This algorithm aims to detect tags where the target operating data is in the positive direction of the non-learning region compared to a reference dataset. This algorithm includes the following processes: (13a) Find the minimum value, maximum value, maximum standard deviation, and maximum range of all data in the reference dataset. (13b) Determine if the maximum value of the target operating data exceeds the maximum value of the reference dataset, the difference between the maximum value and the mean of the target operating data exceeds the product of the maximum standard deviation of the reference dataset and a certain multiplier, and the difference between the maximum value and the median of the target operating data exceeds the product of the maximum standard deviation of the reference dataset and a certain multiplier, then the condition is met. The certain multiplier can be changed by Boardman, etc., and a default value (for example, 5 and 5 in order) is set.

[0055] (14) Negative outliers compared to past data Figure 24 shows an overview of negative outliers relative to past data. This algorithm aims to detect tags where the target operating data is in the negative direction of the non-learning region compared to a reference dataset. This algorithm includes the following processes: (14a) Find the minimum value, maximum value, maximum standard deviation, and maximum fluctuation range of all data in the reference dataset. (14b) Determine if the maximum value of the target operating data is less than the minimum value of the reference dataset, the difference between the minimum value and the mean of the target operating data exceeds the product of the maximum standard deviation of the reference dataset and a certain multiplier, and the difference between the minimum value and the median of the target operating data exceeds the product of the maximum standard deviation of the reference dataset and a certain multiplier.

[0056] (15) Large control deviation Figure 25 shows an overview of a large control deviation. This algorithm aims to detect control loops with poor controllability or control loops affected by large disturbances. This algorithm includes the following processes: (15a) Calculate the deviation of SP (Set Point) and PV (Process Valuable) in the target operating data. (15b) If the deviation of SP and PV exceeds N times their standard deviation, it is determined that the condition is met. The multiplier N can be changed by Boardman, etc., and a default value (e.g., 5) is set. (15c) If the pattern occurrence rate is less than or equal to the set value for that tag, a warning is displayed.

[0057] (16) OP / MV fully unleashed Figure 26 shows an overview of the OP / MV (Output, Manipulated Valuable) fully open state. This algorithm aims to detect tags where the OP / MV has been fully opened, even temporarily. This algorithm includes the following processes: (16a) If the maximum value of the OP / MV in the target operating data is 100% or more, the condition is met. (16b) If the pattern occurrence rate is less than or equal to the set value for that tag, a warning is displayed.

[0058] (17) OP / MV fully closed Figure 27 shows an overview of the fully closed OP / MV. This algorithm aims to detect tags where the OP / MV has been fully closed, even temporarily. This algorithm includes the following processes: (17a) If the maximum value of the OP / MV in the target operating data is 0% or less, the condition is met. (17b) If the pattern occurrence rate is less than or equal to the set value for that tag, a warning is displayed.

[0059] (18) Continue in manual mode Figure 28 shows an overview of the manual mode continuation process. This algorithm aims to detect tags where the OP / MV has not changed. This algorithm includes the following processes: (18a) In the target operating data, the OP / MV value at each sample time is compared with the previous snapshot value. This comparison is repeated for all sample times. (18b) If there is no change in all snapshot values ​​in the repeated comparison (i.e., if the change is below the threshold), the condition is met. (18c) If the pattern occurrence rate is below the set value for that tag, a warning is displayed.

[0060] (19) Exceeding the operating width Figure 29 shows an overview of exceeding the operating width. This algorithm aims to determine whether there is a risk that the Z score will exceed the operating width ± margin (i.e., safety margin). The operating width and margin can be changed by the boardman, etc. This algorithm includes the following processes: (19a) Calculate the difference between the maximum and minimum values ​​in the target operating data. (19b) If this difference exceeds the product of the set width set for each tag and a predetermined ratio α, it is determined that the condition is met. Note that the ratio α can be changed by the boardman, etc., and a default value (e.g., 0.8) is set. (18c) If the pattern occurrence rate is less than or equal to the set value for that tag, a warning is displayed.

[0061] Refer to Figure 6 again. In step S16, the anomaly detection program displays the result of the determination, i.e., the anomaly detection result.

[0062] Figure 30 illustrates a results display screen. In this example, tags in which anomalies were detected are displayed in a list. This list includes identification information for the tag in which anomalies were detected, an overview of the graph showing the time change (profile or waveform) of the tag data, and information indicating the reason why that tag was extracted. This list allows the boardman to narrow down the tags that require attention.

[0063] When button 84 is pressed on the initial screen 91, the detailed trend display process is executed. The detailed trend display process displays the details of the time transformation for the specified tag, specifically, a graph of the time change. This graph also displays information that identifies the detected anomaly, for example. The information that identifies the detected anomaly includes identification information of the algorithm that detected the anomaly, and information that identifies the point on the time axis where the anomaly was detected.

[0064] 3. Variant The present invention is not limited to the embodiments described above, and various modifications are possible. Several modifications are described below. Two or more of the modifications described below may be used in combination.

[0065] The specific process for searching for a reference dataset from historical data is not limited to those exemplified in the embodiment. Any specific process can be employed as long as it can search for similar (past normal) operating data while considering time changes, i.e., profiles on the time axis. Furthermore, although the operating data was standardized as Z-scores, the specific standardization method is not limited to this. Any standardization method can be used as long as it can be processed as a value based on the measured value of the target operating data at each sampling point.

[0066] The specific method for anomaly detection is not limited to the MT method exemplified in the embodiment. For example, anomaly detection processing may be performed using machine learning techniques such as On-Class SVM (Support Vector Machine) or autoencoder. Furthermore, although the embodiment describes an example in which the main algorithm and sub-algorithms are used in combination, one of them may be omitted. Some of the sub-algorithms exemplified in the embodiment may be omitted, or sub-algorithms other than those described in the embodiment may be adopted.

[0067] The screen of the anomaly detection program shown in the embodiment is merely illustrative, and the present invention is not limited thereto. Any specific UI is acceptable as long as it can input and output the required information. For example, the screen of the judgment result in the anomaly detection program may include, in place of or in addition to, the example in the embodiment, at least one of the following: a graph showing the change in the anomaly index over time, a graph showing the contribution of each tag to the anomaly index, and a Pareto chart of the cumulative anomaly for each tag.

[0068] The settings for anomaly detection in the anomaly detection program are not limited to those exemplified in the embodiments. For example, the anomaly detection program may have a flag to turn off anomaly detection for each tag or for each piece of factory equipment 5. Boardman can set this flag so that anomaly detection is not performed for any piece of factory equipment 5 for which anomalies are known to have occurred by other means.

[0069] The specific system configuration of the factory monitoring system 1 is not limited to those illustrated in the embodiments. For example, each instrument 51 may be connected to the internet, and the information processing device 10 may acquire tag data from the instruments 51 via the internet.

[0070] The relationship between functional elements and hardware elements in the factory monitoring system 1 is not limited to those illustrated in the embodiments. The factory monitoring system 1 may have any hardware configuration as long as it can implement the required functions. For example, multiple physical devices may cooperate to function as the information processing device 10 in the embodiments.

[0071] Some of the functional elements illustrated in Figure 2 may be omitted. These functional elements may be selected and implemented by the management company of the factory monitoring system 1.

[0072] The data and databases described in the embodiments are merely illustrative examples, and the data and databases in the present invention are not limited to these examples.

[0073] The programs executed by processors such as CPU101 may be provided via download over a network such as the Internet, or they may be provided recorded on a computer-readable non-temporary recording medium such as a DVD-ROM. Note that each processor may be replaced by, for example, an MPU (Micro Processing Unit) instead of a CPU. [Explanation of Symbols]

[0074] 1...Factory monitoring system, 5...Factory equipment, 10...Information processing device, 11...Storage means, 12...Acquisition means, 13...Access means, 14...Identification means, 15...Detection means, 16...Notification means, 17...Reception means, 19...Control means, 51...Instrument, 71...Dataset, 72...Dataset, 73...Dataset, 74...Dataset, 79...Target operation data, 81...Area, 82...Area, 83...Button, 84...Button, 85...Area, 86...Button, 87...Button, 88...Input field, 89...Input field, 91...Initial screen, 92...Secondary screen, 93...Input screen, 101...CPU, 102...Memory, 103...Storage, 104...Communication IF, 105...Input device, 106...Output device, 111...Database, F...Factory

Claims

1. An acquisition means for acquiring target operating data that includes the time-dependent changes in multiple measured values ​​of factory equipment, and which is the target operating data for anomaly detection. Access means for accessing a database in which past operating data, which is operating data of the aforementioned factory equipment in a specific past state, is recorded and classified into multiple groups. A means for identifying a group among the aforementioned multiple groups whose similarity to the time change of the target operating data satisfies the criteria, A detection means for detecting anomalies in the target operating data based on a comparison of the past operating data of the identified group with the target operating data, Notification means for notifying of an abnormality detected by the detection means and An anomaly detection device having the following features.

2. The identification means identifies groups in which the similarity between the target operating data and the past operating data of the group of groups at each of the multiple sampling points on the time axis of the target operating data satisfies the criteria. An anomaly detection device according to claim 1.

3. The similarity is defined based on the distance in a vector space consisting of values ​​based on the measured values ​​of the target operating data at each sampling point. An anomaly detection device according to claim 1.

4. The detection means detects the abnormality using the MT (Maharanobis-Taguchi) method. An anomaly detection device according to claim 1.

5. The detection means further detects whether the time change of the measured value of each of the multiple items falls under each of the defined multiple anomaly criteria. An anomaly detection device according to claim 1.

6. For each of the aforementioned multiple items, each of the aforementioned multiple abnormality criteria has a means for receiving the setting of criteria for notifying the abnormality, The notification means notifies only those abnormalities detected by the detection means that meet the set criteria. An anomaly detection device according to claim 5.

7. The notification means notifies of the anomaly using a graph of the time change in the measured value of the item in which the anomaly was detected and a list containing information that identifies the applicable anomaly criterion. An anomaly detection device according to claim 5.

8. A step of acquiring target operating data that includes the time changes of multiple measured values ​​in factory equipment, and which is the target operating data for anomaly detection, The steps include: accessing a database in which past operating data, which is operating data of the aforementioned factory equipment in a specific past state, is recorded and classified into multiple groups; The steps include identifying a group from among the aforementioned multiple groups whose similarity to the time-dependent changes in the target operating data meets the criteria, A step of detecting anomalies in the target operating data based on a comparison of the past operating data of the identified group with the target operating data, The step of notifying the abnormality detected in the detection step, An anomaly detection method having the following characteristics.

9. On the computer, A step of acquiring target operating data that includes the time changes of multiple measured values ​​in factory equipment, and which is the target operating data for anomaly detection, The steps include: accessing a database in which past operating data, which is operating data of the aforementioned factory equipment in a specific past state, is recorded and classified into multiple groups; The steps include identifying a group from among the aforementioned multiple groups whose similarity to the time-dependent changes in the target operating data meets the criteria, A step of detecting anomalies in the target operating data based on a comparison of the past operating data of the identified group with the target operating data, The step of notifying the abnormality detected in the detection step, A program to execute.

Images