Monitoring device, monitoring method, and program

Abstract

To provide a monitoring device, a monitoring method, and a program that can accurately detect anomalies by eliminating the effects of external disturbances. [Solution] The monitoring device according to this disclosure comprises: a correction unit that performs a process to subtract the amount of fluctuation due to disturbances from the time series data of the measured values; a conversion unit that performs a process to normalize the histogram of the time series data of the measured values ​​after the subtraction process; a model calculation unit that performs a process to calculate an index that shows the degree of deviation of the time series data from normal values ​​using the time series data of the measured values ​​after the normalization process; and an anomaly detection unit that detects anomalies in the time series data of the measured values ​​based on the index.

Description

Technical Field

[0001] The present disclosure relates to a monitoring device, a monitoring method, and a program. Background Art

[0002] When a sign of an abnormality in a product in a factory, a plant, or the like is detected, it is possible to confirm in which part the sign of the abnormality has occurred, perform an emergency cause analysis, and consider countermeasures. As one of such abnormality diagnosis methods, a method using the Mahalanobis-Taguchi method can be mentioned.

[0003] For example, the following Patent Document 1 discloses an abnormality diagnosis device including: an MD value calculation unit that calculates Mahalanobis distance between collected data from a diagnosis target and normal data of the diagnosis target to generate an MD value; an abnormal waveform pattern storage unit that classifies abnormalities related to the diagnosis target into a plurality of patterns and stores the patterns as abnormal waveform patterns; and a waveform pattern matching unit that matches a waveform of time-series data of the generated MD value with the abnormal waveform patterns stored in the abnormal waveform pattern storage unit during diagnosis of the diagnosis target. Prior Art Document Patent Document

[0004] Patent Document 1 Japanese Unexamined Patent Publication No. 2022-66762 Summary of the Invention Problem to be Solved by the Invention

[0005] However, the abnormality diagnosis device described in the above Patent Document 1 stores an abnormality pattern of a diagnosis target and compares waveforms during diagnosis of the diagnosis target. Abnormality detection using such a statistical method is premised on that data follows a normal distribution, but in practice this premise is often not satisfied, which becomes a disturbance and may cause a decrease in detection accuracy, so a solution to such a problem has been demanded.

[0006] In view of the above issues, this disclosure aims to provide a monitoring device, a monitoring method, and a program that can accurately detect anomalies by eliminating the effects of external disturbances. [Means for solving the problem]

[0007] To solve the above-mentioned problems and achieve the objective, the monitoring device according to this disclosure comprises: a correction unit that performs a process of subtracting the amount of fluctuation due to disturbances from the time series data of the measured values; a conversion unit that performs a process of normalizing the histogram of the time series data of the measured values ​​after the subtraction process; a model calculation unit that performs a process of calculating an index that indicates the degree of deviation of the time series data from normal values ​​using the time series data of the measured values ​​after the normalization process; and an anomaly detection unit that detects anomalies in the time series data of the measured values ​​based on the index.

[0008] To solve the above-mentioned problems and achieve the objectives, the monitoring method relating to this disclosure includes the steps of: subtracting the amount of fluctuation due to disturbances from the time series data of the measured values; normalizing the histogram of the time series data of the measured values ​​after the subtraction process; calculating an index that shows the degree of deviation of the time series data from normal values ​​using the time series data of the measured values ​​after the normalization process; and detecting anomalies in the time series data of the measured values ​​based on the index.

[0009] To solve the above-mentioned problems and achieve the objective, the program relating to this disclosure causes a computer to perform the following steps: subtract the amount of fluctuation due to disturbances from the time series data of measured values; normalize the histogram of the time series data of measured values ​​after the subtraction process; calculate an index that shows the degree of deviation of the time series data from normal values ​​using the time series data of measured values ​​after the normalization process; and detect anomalies in the time series data of measured values ​​based on the index. [Effects of the Invention]

[0010] This disclosure provides a monitoring device, a monitoring method, and a program that can accurately detect anomalies while removing the effects of external disturbances. [Brief explanation of the drawing]

[0011] [Figure 1] Figure 1 is a diagram illustrating the overview of the monitoring system related to this disclosure. [Figure 2] Figure 2 shows an example of the configuration of the monitoring device according to this disclosure. [Figure 3] Figure 3 shows an example of information stored in the measurement value storage unit of the monitoring device according to this disclosure. [Figure 4] Figure 4 shows an example of information stored in the program storage unit of the monitoring device according to this disclosure. [Figure 5] Figure 5 is a diagram illustrating the processing of the correction unit of the monitoring device according to this disclosure. [Figure 6] Figure 6 shows the time-series data of the measured values ​​after processing by the correction unit and the conversion unit of the monitoring device according to this disclosure. [Figure 7] Figure 7 is a diagram illustrating the processing of the disassembly section of the monitoring device according to this disclosure. [Figure 8] Figure 8 is a diagram illustrating the processing of the model calculation unit of the monitoring device according to this disclosure. [Figure 9] Figure 9 is a diagram illustrating the processing of the disassembly section of the monitoring device according to this disclosure. [Figure 10] Figure 10 is a diagram illustrating the processing of the abnormality detection unit of the monitoring device according to this disclosure. [Figure 11] Figure 11 is a flowchart showing the flow of the monitoring method related to this disclosure. [Figure 12] Figure 12 shows an example of the configuration of the measuring device according to this disclosure. [Figure 13]FIG. 13 is a hardware configuration diagram showing an example of a computer that implements the functions of the monitoring device according to the present disclosure. Mode for Carrying Out the Invention

[0012] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. The present invention is not limited to the embodiments described below.

[0013] (Configuration of Monitoring System) First, an overview of a monitoring system 1 according to the present disclosure will be described with reference to FIG. 1. FIG. 1 is a diagram illustrating an overview of the monitoring system according to the present disclosure. As shown in FIG. 1, the monitoring system 1 according to the present disclosure includes a monitoring device 100, measuring devices 200 (200A, 200B, 200C), monitoring targets 10 (10A, 10B, 10C), and a network N. An administrator terminal 300 is connected to the monitoring device 100 of the monitoring system 1 so as to be able to exchange information with each other. These configurations will be briefly described below in order.

[0014] The monitoring device 100 is a device that monitors the operational state of a product. The monitoring device 100 executes processing for detecting an abnormality in the monitoring target 10 based on, for example, time-series data of measurement values transmitted via the network N from the measuring device 200 described later. The monitoring device 100 may be implemented by an information processing device such as, for example, a personal computer (PC), a work station (WS), or a computer having server functions.

[0015] The measuring device 200 acquires time-series data of various measurement values. The measuring device 200 is connected to the monitoring target, and acquires time-series data of various measurement values from measuring instruments provided in the monitoring target. That is, the measuring device 200 may have a configuration including a measuring instrument provided in the monitoring target. Further, the measuring device 200 may be a data logger connected to a tester and storing time-series data of measurement values.

[0016] Note that the time-series data of measured values refers to measured values that can be detected from the monitored object 10 and whose values may change as time elapses. The time-series data of measured values can also be said to be data indicating the state of the monitored object 10, which is detected by a sensor of the monitored object 10 and acquired by the measuring device 200.

[0017] The monitored object 10 is a device or equipment that is monitored by the monitoring apparatus 100. The monitored object 10 may be, for example, a boiler, a gas turbine, a compressor, a steam turbine, a motor, or the like. As shown in FIG. 1, a plurality of sensors are attached to the monitored object 10, and time-series data of various measured values related to temperature, pressure, vibration and the like of various parts such as a bearing, a compressor inlet and a compressor outlet is acquired.

[0018] The network N connects the monitoring apparatus 100 and the measuring apparatus 200 so that they can communicate with each other by wire or wirelessly. When the network N is wired, it may be implemented by Ethernet (registered trademark) (ETHERNET (registered trademark)) specified in IEEE 802.3, or the like. When the network N is wireless, it may be implemented by a wireless LAN (Local Area Network) specified in IEEE 802.11, Bluetooth (registered trademark), or the like. Note that the network N may be implemented by a VPN (Virtual Private Network) from the viewpoint of security.

[0019] According to the monitoring system 1 described above, time-series data of measured values measured by a measuring instrument provided in the monitored object 10 is transmitted to the monitoring apparatus 100, and in the monitoring apparatus 100 that has received the time-series data of measured values, an administrator M1 or the like analyzes the transmitted time-series data of measured values using an administrator terminal 300 connected to the monitoring apparatus 100, whereby an abnormality that has occurred in the monitored object 10 can be detected.

[0020] (Configuration of Monitoring Apparatus) Next, the configuration of the monitoring device 100 according to this disclosure will be explained using Figure 2. Figure 2 is a diagram showing an example of the configuration of the monitoring device according to this disclosure. As shown in Figure 2, the monitoring device 100 according to this disclosure comprises a communication unit 110, a storage unit 120, a control unit 130, an input unit 140, and a display unit 150. These configurations will be explained in order below.

[0021] The communication unit 110 connects the inside and outside of the monitoring device 100 so that they can communicate with each other, and transmits and receives information between the inside and outside of the monitoring device 100. The communication unit 110 may be implemented, for example, by a wireless LAN (Local Area Network) card, a Wi-Fi (registered trademark) module, an antenna, etc., when wireless communication is used. Alternatively, the communication unit 110 may be implemented by, for example, an Ethernet (registered trademark) interface device as defined in IEEE 802.3, or a serial communication interface device, etc., when wired communication is used.

[0022] The memory unit 120 is a storage device that stores various types of information. The memory unit 120 comprises a main memory and an auxiliary storage device. The main memory may be implemented using semiconductor memory elements such as RAM (Random Access Memory), ROM (Read Only Memory), or flash memory. The auxiliary storage device may be implemented using a hard disk or an SSD (Solid State Drive), for example.

[0023] As shown in Figure 2, the storage unit 120 comprises a measured value storage unit 121 and a program storage unit 122. These configurations will be described below.

[0024] The measurement value storage unit 121 stores information related to time-series data of measurement values. Here, an example of the information stored in the measurement value storage unit 121 will be explained using Figure 3. Figure 3 is a diagram showing an example of the information stored in the measurement value storage unit of the monitoring device according to this disclosure.

[0025] As shown in Figure 3, the measurement value storage unit 121 stores information related to items such as "measurement source device ID," "measurement time," "first measurement value," "second measurement value," and "third measurement value" in an associated manner.

[0026] The "Measurement Source Device ID" is an identifier that identifies the device from which the measurement value was taken, and is represented by, for example, a string of characters or a number. The "Measurement Time" is information indicating the time when the measurement value was taken by the device identified by the "Measurement Source Device ID". The "First Measurement Value" is information indicating the time-series data of the first measurement value measured for the device identified by the "Measurement Source Device ID", and is, for example, a numerical value of the temperature or pressure of a predetermined part of the monitored object 10. The "Second Measurement Value" is information indicating the time-series data of the second measurement value measured for the device identified by the "Measurement Source Device ID", and is, for example, a numerical value of the temperature or pressure of a predetermined part of the monitored object 10. The "Third Measurement Value" is information indicating the time-series data of the third measurement value measured for the device identified by the "Measurement Source Device ID", and is, for example, a numerical value of the temperature or pressure of a predetermined part of the monitored object 10.

[0027] In other words, Figure 3 shows an example in which the first measurement value "MS1#1-1", the second measurement value "MS2#1-1", and the third measurement value "MS3#1-1", all measured at the measurement time "TIME#1-1", are stored in the measurement source device identified by the measurement value ID "DVID#1".

[0028] Furthermore, the information stored in the measurement value storage unit 121 is not limited to information relating to the items "measurement source device ID," "measurement time," "first measurement value," "second measurement value," and "third measurement value," but may also store other information related to arbitrary measurement values.

[0029] The program storage unit 122 stores information related to various programs used for monitoring measured values, etc. Here, an example of the information stored in the program storage unit 122 will be explained using Figure 4. Figure 4 is a diagram showing an example of information stored in the program storage unit of the monitoring device according to this disclosure.

[0030] As shown in Figure 4, the program storage unit 122 stores information related to items such as "program ID" and "program data" in an associated manner.

[0031] The "Program ID" is an identifier that identifies a program, and can be represented by a string, a number, or other means. The "Program Data" is the data of the program identified by the "Program ID," and can be compiled from a program written in a language such as FORTRAN, Python, or C.

[0032] In other words, Figure 4 shows an example in which the program data "PRDT#1" of a program identified by the program ID "PRID#1" is stored.

[0033] Furthermore, the information stored in the program storage unit 122 is not limited to information related to the items "Program ID" and "Program Data," but may also store any other information related to the program.

[0034] The control unit 130 is a controller that manages and controls the monitoring device 100. The control unit 130 is implemented by a CPU (Central Processing Unit) or MPU (Micro Processing Unit), etc., which executes various programs stored in the memory unit 120 using RAM as the working area. Alternatively, the control unit 130 may be implemented by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0035] As shown in Figure 2, the control unit 130 includes an acquisition unit 131, a correction unit 132, a conversion unit 133, a model calculation unit 134, a decomposition unit 135, an anomaly detection unit 136, and an output control unit 137. The control unit 130 realizes these functions and performs these processes by reading and executing a program (software) from the storage unit 120. Note that these functions of the control unit 130 may be realized by electronic circuits. Furthermore, the control unit 130 may execute these processes with a single CPU, or it may have multiple CPUs and execute these processes in parallel with the multiple CPUs.

[0036] (Processing by monitoring device) The following describes the processing performed by the monitoring device 100.

[0037] (Acquisition of time-series data) The acquisition unit 131 acquires various types of information. For example, the acquisition unit 131 acquires time-series data of measured values ​​related to the monitored object 10 from the measuring device 200. For example, once the acquisition unit 131 has acquired time-series data of measured values ​​related to the monitored object 10 from the measuring device 200, it stores the acquired time-series data of measured values ​​in the measured value storage unit 121, associating it with the identifier of the monitored object 10 from which the measurement was taken. The acquisition unit 131 may acquire measured values ​​sequentially, or it may acquire measured values ​​all at once after a predetermined amount has been accumulated. The measured values ​​acquired by the acquisition unit 131 may be, for example, temperature, pressure, rotation speed, flow rate, etc., at a predetermined part of the monitored object 10.

[0038] The acquisition unit 131 acquires time-series data of multiple types of measured values. In other words, in the example shown in Figure 3, the acquisition unit 131 acquires the time-series data of the first measured value, the time-series data of the second measured value, and the time-series data of the third measured value as multiple types of time-series data.

[0039] (Subtraction process) The correction unit 132 removes fluctuations in the time-series data of the measured values ​​due to disturbances. Specifically, the correction unit 132 performs a process of subtracting the amount of fluctuation due to disturbances from the time-series data of the measured values. For example, the correction unit 132 may express the amount of fluctuation due to disturbances in the time-series data of the measured values ​​using a linear polynomial and subtract the amount of fluctuation expressed by the linear polynomial from the time-series data of the measured values. The coefficients of the linear polynomial may be the correlation coefficients between the disturbance parameters, such as temperature and humidity, and the time-series data of the measured values.

[0040] The correction unit 132 may set a linear polynomial representing the amount of fluctuation due to disturbance in any way. For example, the correction unit 132 may calculate a correlation between time series data and disturbance values ​​based on time series data of previously measured values ​​and actual measured values ​​of disturbance parameters at the time the time series data was measured. Then, the correction unit 132 may set a linear polynomial based on this correlation.

[0041] Here, the correlation coefficient between the disturbance parameters and the time-series data of the measured values ​​will be explained using Figure 5. Figure 5 is a diagram illustrating the processing of the correction unit of the monitoring device according to this disclosure. As shown in Figure 5, a correlation exists between the disturbance parameters and the time-series data of the measured values ​​(model signals). Therefore, the correlation coefficient between them is set as the coefficient of a linear polynomial. Here, the first to eighth model signals shown in Figure 5 are, for example, measured values ​​such as thrust bearing temperature and pressure provided at multiple locations on the monitored object 10. That is, a linear polynomial is set with disturbance parameters such as temperature and rotational speed as variables and the correlation coefficient between these and the MD model signals as coefficients. Then, the correction unit 132 subtracts the amount of fluctuation represented by the linear polynomial from the time-series data of the measured values.

[0042] Hereafter, time series data that has been processed by the correction unit 132 to subtract the amount of fluctuation due to disturbances will be referred to as the first corrected time series data.

[0043] Furthermore, the correction unit 132 performs the subtraction process described above for each of the multiple types of time-series data of measurement values ​​acquired by the acquisition unit 131. In other words, the correction unit 132 generates first corrected time-series data for each of the multiple types of time-series data.

[0044] (Process to normalize distribution) The conversion unit 133 performs a process to normalize the histogram of the first corrected time series data (time series data of measured values ​​after the subtraction process by the correction unit 132). That is, the conversion unit 133 converts the first corrected time series data into a histogram that shows the relationship between the values ​​of the first corrected time series data and the frequency of those values. The conversion unit 133 then normalizes the histogram of the first corrected time series data. Here, normalization is not limited to making the histogram of the first corrected time series data a strict normal distribution, but may also refer to making the histogram of the first corrected time series data approximate a normal distribution.

[0045] For example, the transformation unit 133 may perform a Yeo-Johnson transformation on the histogram of the first corrected time series data to normalize it. Here, the Yeo-Johnson transformation, like the Box-Cox transformation, is a method that transforms the overall distribution of the data so that it becomes a normal distribution. Unlike the Box-Cox transformation, it can be performed even if the data contains values ​​less than or equal to 0. Furthermore, it is a robust transformation to the data distribution, and can be performed without further processing of the data even if the data distribution contains outliers or non-normalities. The Yeo-Johnson transformation is expressed by equation (1) when λ≠0 and x≧0, by equation (2) when λ≠2 and x<0, and by equation (3) otherwise.

[0046]

number

number

number

[0047] Here, x' represents the value of the data after transformation, x represents the value of the data before transformation, and λ represents the transformation parameter estimated by the likelihood method.

[0048] Furthermore, since the Yeo-Johnson transform's distribution changes depending on the parameter λ, λ is learned from the data and adjusted to obtain a transform result that is closer to a normal distribution.

[0049] Here, the processing of the conversion unit 133 will be explained using Figure 6. Figure 6 is a diagram illustrating the processing of the conversion unit of the monitoring device according to this disclosure. Graph GR1 in Figure 6 shows an example of a histogram of the first corrected time series data before normalization by the conversion unit 133, and graph GR2 in Figure 6 shows an example of a histogram of the first corrected time series data after normalization by the conversion unit 133. As shown in Figure 6, by performing the processing of the conversion unit 133, the first corrected time series data can be transformed so that the histogram of the first corrected time series data follows a normal distribution.

[0050] The conversion unit 133 converts the histogram of the normally distributed first corrected time series data back into time series data (i.e., data showing the relationship between the values ​​of the time series data and time). Hereafter, the first corrected time series data after the normalization process by the conversion unit 133 (i.e., the time series data whose histogram has been normalized and converted back into time series data) will be referred to as the second corrected time series data as appropriate.

[0051] Furthermore, the conversion unit 133 performs the normalization described above on each of the first corrected time series data. In other words, the conversion unit 133 generates second corrected time series data for each of the multiple types of time series data.

[0052] While many anomaly detection methods using statistical techniques, such as the Mahalanobis Taguchi method (MT), assume that the data follows a normal distribution, this assumption is often not met in reality. This can lead to noise and a decrease in detection accuracy. However, the accuracy of anomaly detection can be improved by normalizing the histogram of the time-series data of the measured values.

[0053] (Calculation of indicators) The model calculation unit 134 performs a process to calculate an index using the second corrected time series data (time series data of measured values ​​after processing to normalize them). The index here is time series data that shows the degree of deviation of the time series data from the normal value (degree of abnormality of the time series data). In other words, the index is data that shows the degree of deviation of the time series data from the normal value for each time period.

[0054] The model calculation unit 134 calculates an index based on multiple types of second-corrected time series data. Specifically, the model calculation unit 134 calculates multidimensional time series data (third-corrected time series data) using multiple types of second-corrected time series data, with the parameters of each type of time series data as dimensions. The model calculation unit 134 then calculates the degree of deviation of this third-corrected time series data from the normal value (degree of abnormality of the third-corrected time series data) as an index.

[0055] For example, the model calculation unit 134 calculates the Mahalanobis distance using the Mahalanobis-Taguchi method as an indicator. Specifically, the model calculation unit 134 uses normal time series data to create a multidimensional unit space (reference data set) corresponding to the third-corrected time series data. Then, the model calculation unit 134 uses the third-corrected time series data to calculate the Mahalanobis distance as an indicator, which indicates the degree of deviation of the third-corrected time series data from the unit space. Note that the Mahalanobis distance increases as the distance from the unit space increases. In other words, the Mahalanobis distance as an indicator represents the degree of deviation from the unit space, which is a collection of data in the standard state.

[0056] (Extension of unit space) The unit space expansion unit 1341 performs a process to expand the unit space of the Mahalanobis-Taguchi method. In other words, in this embodiment, the index (Mahalanobis distance) is calculated using the unit space expanded by the unit space expansion unit 1341. Specifically, the unit space expansion unit 1341 performs a process to broaden the range of the unit space. For example, considering the annual fluctuations due to the influence of ambient temperature, the unit space may be expanded so that the maximum value for the year is included in the unit space.

[0057] Note that the unit space expansion process performed by the unit space expansion unit 1341 is not mandatory.

[0058] (Decomposition of indicators) The decomposition unit 135 decomposes the index calculated by the model calculation unit 134 into several different components. Specifically, the decomposition unit 135 decomposes the time-series data of the index (original signal) into periodic components to generate multiple index components that have different periodic components. The index components here are time-series data that show the degree of deviation from the normal value of the time-series data, separated by periodic components, over time.

[0059] In this embodiment, the decomposition unit 135 decomposes the indicator into multiple components, including a periodic component, a trend component, and an irregular component. For example, the decomposition unit 135 performs STL (Seasonal and Trend Decomposition using Loess) decomposition. That is, it decomposes the indicator into a trend component, which is a medium- to long-term component; an irregular component, which is a short-term component, or in other words, a mutation amount; and an irregular component remaining after subtracting the periodic component and the trend component from the original signal.

[0060] Here, the processing of the decomposition unit 135 will be explained using Figure 7. Figure 7 is a diagram illustrating the processing of the decomposition unit of the monitoring device according to this disclosure. As shown in Figure 7, the decomposition unit 135 decomposes the original signal, such as the Mahalanobis distance signal input to the decomposition unit 135, into a periodic component, a trend component, and an irregular component. The periodic component represents periodic fluctuations due to disturbances such as ambient temperature of a predetermined period. The trend component shows the signal after leveling by local neighborhood regression. The irregular component is the signal after subtracting the periodic component and the trend component from the original signal.

[0061] In the STL decomposition described above, LOESS (Locally Estimated Scatterplot Smoothing), a local data smoothing technique, may be used to extract the trend component and the periodic component. This allows for the extraction of the overall trend of the data. Furthermore, the STL algorithm, which applies LOESS smoothing multiple times, may be used to extract the irregular component. The STL algorithm is a method that sequentially extracts the trend component, periodic component, and irregular component. This algorithm allows for the detailed decomposition of the time series data structure and the clarification of the characteristics of each element.

[0062] As a result, the operating conditions of the monitored compressors and steam turbines, etc., include transient medium- to long-term fluctuations in response to demand, such as fluctuations in rotational speed. By decomposing and removing components from the data, the accuracy of abnormality detection in the abnormality detection unit 136, described later, can be improved.

[0063] Note that the decomposition process of the indicator by the decomposition unit 135 is not mandatory.

[0064] (Detection of anomalies) The anomaly detection unit 136 detects anomalies in the measured value based on the index. The anomaly detection unit 136 may determine that an index is abnormal if it is above a predetermined threshold, and that it is not abnormal (normal) if it is below the threshold. Furthermore, in this embodiment, the anomaly detection unit 136 determines whether each of the indexes (index components) decomposed by the decomposition unit 135 is abnormal or not. That is, the anomaly detection unit 136 may determine that each index component is abnormal if it is above a predetermined threshold, and that it is not abnormal (normal) if it is below the threshold. By determining anomalies for each index component in this way, the details of the anomaly can be grasped more accurately.

[0065] Here, to explain the detection of anomalies, Figure 8 will be used to describe the processing of the model calculation unit 134 according to this disclosure. Figure 8 is a diagram illustrating the processing result (deviation index) of the model calculation unit of the monitoring device according to this disclosure. Graph GR7 in Figure 8 shows the time-series data of the processing result (deviation index) of the model calculation unit 134 of the monitoring device 100 when this disclosure is not applied, and graph GR8 in Figure 8 shows the time-series data of the processing result (deviation index) of the model calculation unit 134 of the monitoring device 100 when this disclosure is applied. As shown in graph GR8 in Figure 8, it can be seen that the index indicating the degree of deviation has decreased significantly after the application of this disclosure. Therefore, it is possible to lower and set the threshold used for detecting anomalies. This reduces undetected and false detections and improves the accuracy of anomaly detection.

[0066] Next, the processing of the decomposition unit 135 according to this disclosure will be explained using Figure 9. Figure 9 is a diagram illustrating the processing of the decomposition unit of the monitoring device according to this disclosure. Graph GR9 in Figure 9 shows the trend component after applying the processing of the decomposition unit 135 to the monitoring device 100 according to this disclosure, and graph GR10 in Figure 9 shows the irregular component after applying the processing of the decomposition unit 135 to the monitoring device 100 according to this disclosure. In this way, by using the decomposition unit 135 to decompose an index indicating the degree of deviation into components, it becomes possible to judge abnormalities for each component. In other words, it is possible to individually observe and detect abnormalities that occur gradually over the medium to long term and short-term abnormalities that occur as mutations.

[0067] The anomaly detection unit 136 may detect anomalies in the measured values ​​using, for example, the Mahalanovistaguchi method (MT method). The MT method defines a normal state as a "unit space" and detects any deviation from this as an anomaly. The processing of the anomaly detection unit 136 will now be explained using Figure 10. Figure 10 is a diagram illustrating the processing of the anomaly detection unit of the monitoring device according to this disclosure.

[0068] The anomaly detection unit 136 may, for example, detect an index as abnormal if the Mahalanobis distance exceeds a predetermined threshold, based on the Mahalanobis distance which indicates the degree of deviation from the unit space. Graph GR11 in Figure 10 shows the unit space and data values ​​(A, B, C, D) at different time points in the time-series data of the measured values. Graph GR12 in Figure 10 shows the Mahalanobis distances MDA, MDB, MDC, MDD for the data values ​​at different time points in the time-series data of the measured values. In the example shown in graph GR12, the anomaly detection unit 136 detects that the data for the Mahalanobis distance MDC is abnormal because the Mahalanobis distance MDC exceeds a predetermined threshold TH.

[0069] (Output of anomaly detection results) The output control unit 137 controls the output of the abnormality detection result. For example, the output control unit 137 performs output control to notify the monitored object 10, which has detected an abnormality in the measured value, via the communication unit 110. The output control unit 137 may also send a control signal to the monitored object 10 indicating that it will stop operation or reduce the output, depending on the detected abnormality. The content of the control signal may be set according to the specific nature of the abnormality.

[0070] (Input section) The input unit 140 receives various types of information from the user. For example, the input unit 140 may receive various types of information from the user via various switches, a keyboard, a mouse, etc. Alternatively, the input unit 140 may receive various types of information from the user via a touch panel display.

[0071] (Display) The display unit 150 displays various types of information. The display unit 150 may also display, for example, the results of various processes, graphs of time-series data of measured values, or the results of anomaly detection. The display unit 150 may be implemented using, for example, a liquid crystal display, an organic EL (Electro-Luminescence) display, a micro-LED (Light Emitting Diode) display, or the like. Furthermore, the display unit 150 may be a touch panel using various methods, such as a capacitive touchscreen.

[0072] As described above, the monitoring device 100 removes fluctuations due to disturbances from the time-series data of the measured values, then normalizes the histogram of the time-series data of the measured values, and uses the normally distributed time-series data of the measured values ​​to calculate an index used for anomaly detection. Therefore, it is possible to provide a monitoring device 100 that can accurately detect anomalies by removing the effects of disturbances.

[0073] (Regarding monitoring methods) Next, the monitoring method related to this disclosure will be explained using Figure 11. Figure 11 is a flowchart of the monitoring method related to this disclosure. The monitoring method related to this disclosure will be explained in accordance with the flow shown in Figure 11.

[0074] First, the time series data of the measured values ​​is corrected using a linear polynomial that represents the amount of variation due to disturbances to generate the first corrected time series data (step S101). Next, the histogram of the first corrected time series data is transformed into a normal distribution to obtain the second corrected time series data (step S102). Next, an index indicating the degree of deviation of the time series data from normal values ​​is calculated based on multiple types of second corrected time series data (including extending the unit space of the Mahalano-Vistaguchi method) (step S103). Next, the time series data of the index indicating the degree of deviation is decomposed into multiple components (step S104). Next, anomaly detection is performed using the Mahalano-Vistaguchi method (step S105).

[0075] According to this method, after removing fluctuations due to disturbances from the time-series data of measured values, the histogram of the time-series data of measured values ​​can be normalized, and an index used for anomaly detection can be calculated using the normally distributed time-series data of measured values. Therefore, it is possible to provide a monitoring method that can accurately detect anomalies by removing the effects of disturbances.

[0076] (Configuration of the measuring device) Next, the configuration of the measuring device 200 according to this disclosure will be explained using Figure 12. Figure 12 is a diagram showing an example of the configuration of the measuring device according to this disclosure. As shown in Figure 12, the measuring device 200 according to this disclosure comprises a communication unit 210, a storage unit 220, a control unit 230, and a measuring unit 240. These configurations will be explained in order below.

[0077] The communication unit 210 connects the inside and outside of the measuring device 200 so that they can communicate with each other, and transmits and receives information between the inside and outside of the measuring device 200. The communication unit 210 may be implemented by, for example, a wireless LAN card, a Wi-Fi® module, an antenna, etc., when wireless communication is used. The communication unit 210 may be implemented by, for example, an Ethernet® interface device as defined in IEEE 802.3, or a serial communication interface device, etc.

[0078] The memory unit 220 is a storage device that stores various types of information. The memory unit 220 comprises a main memory and an auxiliary storage device. The main memory may be implemented using semiconductor memory elements such as RAM, ROM, or flash memory. The auxiliary storage device may be implemented using a hard disk or SSD, for example.

[0079] As shown in Figure 12, the storage unit 220 includes a measured value storage unit 221.

[0080] The measurement value storage unit 221 stores information about the measurement values ​​measured by the measuring device 200. The items of information stored in the measurement value storage unit 221 may be the same as the items of information stored in the measurement value storage unit 121 of the monitoring device 100, so a description of an example of the information stored in the measurement value storage unit 221 will be omitted.

[0081] The control unit 230 is a controller that manages and controls the measuring device 200. The control unit 230 is implemented by a CPU, MPU, etc., which executes various programs stored in the memory unit 220 using RAM as the working area. Alternatively, the control unit 230 may be implemented by an integrated circuit such as an ASIC or FPGA.

[0082] As shown in Figure 12, the control unit 230 includes an acquisition unit 231, a measured value transmission unit 232, a command receiving unit 233, and an operation control unit 234. The control unit 230 realizes these functions and performs these processes by reading and executing a program (software) from the storage unit 220. These functions of the control unit 230 may also be realized by electronic circuits. Furthermore, the control unit 230 may perform these processes with a single CPU, or it may have multiple CPUs and perform these processes in parallel with the multiple CPUs.

[0083] The acquisition unit 231 acquires the measured value. For example, the acquisition unit 231 acquires the measured value measured by the measurement unit 240, which will be described later. Once the acquisition unit 231 has acquired the measured value measured by the measurement unit 240, it stores the acquired measured value in the measured value storage unit 221.

[0084] The measurement value transmission unit 232 transmits the measured values ​​to the monitoring device 100. For example, it transmits measured values ​​such as the temperature measurement location, bearing temperature, and rotational speed of the monitored object 10 via the communication unit 210. The data may be transmitted sequentially, or a predetermined amount of measured data may be transmitted in a batch after a predetermined amount of data has been obtained.

[0085] The command receiving unit 233 receives control commands from the monitoring device 100. For example, the command receiving unit 233 receives a control command via the communication unit 210 that includes information indicating the detection result of an anomaly from the monitoring device 100.

[0086] The operation control unit 234 generates control signals to control the operation of the monitored device 10. For example, when an abnormality is detected, the operation control unit 234 controls the operation of the monitored device 10 according to the nature of the abnormality. For example, it generates control signals to stop operation or to reduce output, and controls the monitored device 10 according to these control signals.

[0087] The measurement unit 240 measures various values ​​related to the monitored object 10. That is, the measurement unit 240 may be connected to a measuring instrument of the monitored object 10 and acquire the measured values ​​measured by the said measuring instrument, or the measurement unit 240 may be a measuring instrument and measure values ​​related to the monitored object 10. The measurement unit 240 may be, for example, a thermometer, a pressure gauge, a tachometer, a flow meter, etc.

[0088] The thermometer may be, for example, a thermocouple. Specifically, it may be a Chromel®-Alumel® thermocouple (symbol K for thermocouple type as defined in JIS C 1602), a Chromel®-Constantan thermocouple (symbol E for thermocouple type as defined in JIS C 1602), a Nicrosil-Nisil thermocouple (symbol N for thermocouple type as defined in JIS C 1602), a copper-Constantan thermocouple (symbol T for thermocouple type as defined in JIS C 1602), etc.

[0089] The pressure gauge may be a Bourdon tube pressure gauge that mechanically magnifies the deformation of a Bourdon tube due to pressure and directly measures the gauge pressure. Alternatively, the pressure gauge may be a diaphragm pressure gauge such as a semiconductor strain gauge type or a capacitance type. The semiconductor strain gauge type measures pressure by detecting the strain of the diaphragm using an electrical conversion element. The capacitance type measures the displacement of the diaphragm as capacitance by placing electrodes on the opposite side of the diaphragm.

[0090] The gas flow meter may be, for example, an insertable type that is inserted into a pipe, or an in-line type mass flow meter that measures directly. The mass flow meter may be implemented using Coriolis flow meters, vortex flow meters, thermal flow meters, etc.

[0091] A tachometer can be implemented, for example, by an eddy current displacement sensor, which measures rotational speed by detecting changes in displacement values ​​as rotational pulses occur when passing a gear-shaped target, keyway, or the like, provided on the rotating shaft.

[0092] This allows for the appropriate acquisition of measured values ​​indicating the operating status of the monitored object 10 and transmission to the monitoring device 100. Furthermore, the monitoring device 100 can receive the results of detecting an anomaly in the measured values ​​and appropriately control the operation of the monitored object 10 based on those results. Therefore, it is possible to provide a monitoring method that can accurately detect anomalies while eliminating the influence of external disturbances.

[0093] (Hardware configuration) The monitoring device 100 according to the above-described embodiment is implemented by a computer 1000 having a configuration such as that shown in Figure 13. Figure 13 is a hardware configuration diagram showing an example of a computer that implements the functions of the monitoring device according to this disclosure. The computer 1000 is connected to an output device 1010 and an input device 1020, and has a configuration in which an arithmetic unit 1030, a primary storage device 1040, a secondary storage device 1050, an output IF (Interface) 1060, an input IF 1070, and a network IF 1080 are connected by a bus 1090.

[0094] The arithmetic unit 1030 operates based on programs stored in the primary storage device 1040 and the secondary storage device 1050, as well as programs read from the input device 1020, and executes various processes. The primary storage device 1040 is a memory device, such as RAM, that temporarily stores data used by the arithmetic unit 1030 for various calculations. The secondary storage device 1050 is a storage device that stores data used by the arithmetic unit 1030 for various calculations and various databases, and is implemented using ROM, HDD, flash memory, etc.

[0095] Output IF1060 is an interface for transmitting information to be output to output devices 1010, such as monitors and printers, and is implemented using connectors of standards such as USB (Universal Serial Bus), DVI (Digital Visual Interface), and HDMI (High Definition Multimedia Interface). Input IF1070 is an interface for receiving information from various input devices 1020, such as mice, keyboards, and scanners, and is implemented using, for example, USB.

[0096] The input device 1020 may also be a device that reads information from, for example, an optical recording medium such as a CD (Compact Disc), DVD (Digital Versatile Disc), or PD (Phase Change Rewritable Disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), tape media, magnetic recording media, or semiconductor memory. Furthermore, the input device 1020 may also be an external storage medium such as a USB memory stick.

[0097] Network IF1080 receives data from other devices via network N and sends it to the arithmetic unit 1030, and also transmits data generated by the arithmetic unit 1030 to other devices via network N.

[0098] The arithmetic unit 1030 controls the output device 1010 and the input device 1020 via the output IF 1060 and the input IF 1070. For example, the arithmetic unit 1030 loads a program from the input device 1020 or the secondary storage device 1050 onto the primary storage device 1040 and executes the loaded program.

[0099] For example, if computer 1000 functions as a monitoring device 100, the arithmetic unit 1030 of computer 1000 executes a program loaded onto the primary storage device 1040 to realize the functions of the control unit 130 of the monitoring device 100.

[0100] (Structure and effect) The monitoring device 100 according to the first embodiment includes a correction unit 132 that performs a process to subtract the amount of fluctuation due to disturbances from the time series data of the measured values; a conversion unit 133 that performs a process to normalize the histogram of the time series data of the measured values ​​after the subtraction process; a model calculation unit 134 that performs a process to calculate an index that shows the degree of deviation of the time series data from normal values ​​using the time series data of the measured values ​​after the normalization process; and an anomaly detection unit 136 that detects anomalies in the time series data of the measured values ​​based on the index.

[0101] With this configuration, after removing fluctuations due to disturbances from the time-series data of measured values, the histogram of the time-series data of measured values ​​can be normalized, and an index used for anomaly detection can be calculated using the normally distributed time-series data of measured values. Therefore, it is possible to provide a monitoring device 100 that can accurately detect anomalies by removing the effects of disturbances.

[0102] The monitoring device 100 according to the second embodiment is the same as the monitoring device 100 according to the first embodiment, wherein the conversion unit 133 performs a process to normalize each of the multiple types of time series data, the model calculation unit 134 calculates an index using each of the time series data after the normalization process, and further comprises a decomposition unit 135 that decomposes the index into multiple different components, and the anomaly detection unit 136 performs anomaly detection using the index decomposed into components.

[0103] This configuration allows for the decomposition of the indicators used for anomaly detection into different components, and enables anomaly detection using the indicators decomposed into these different components. Therefore, it is possible to provide a monitoring device 100 that can accurately detect anomalies while removing the influence of external disturbances.

[0104] The monitoring device 100 according to the third embodiment is the monitoring device 100 according to the second embodiment, wherein the decomposition unit 135 decomposes the indicator into a plurality of components including a periodic component, a trend component, and an irregular component.

[0105] This configuration allows the time-series data of an indicator to be decomposed into multiple components, including a periodic component, a trend component, and an irregular component. Therefore, it is possible to provide a monitoring device 100 that can accurately detect anomalies by removing the effects of external disturbances.

[0106] The monitoring device 100 according to the fourth embodiment is a monitoring device 100 according to any of the first to third embodiments, wherein the model calculation unit 134 includes a unit space expansion unit 1341 that calculates the Mahalanobis distance between time series data and a unit space as an indicator and performs processing to expand the unit space.

[0107] This configuration allows for the extension of the unit space of the Mahalanobis-Taguchi method and enables anomaly detection using the Mahalanobis distance. Therefore, it is possible to provide a monitoring device 100 that can accurately detect anomalies while eliminating the influence of disturbances.

[0108] The monitoring device 100 according to the fifth embodiment is the monitoring device 100 according to any one of the first to fourth embodiments, and the conversion unit 133 performs a process to normalize the histogram of the time series data of the measured values ​​by Yeo-Johnson transformation.

[0109] This configuration allows the histogram of time-series data of measured values ​​to be normalized using the Yeo-Johnson transform. Therefore, it becomes possible to appropriately detect anomalies using the Mahalanovistaguchi method. Thus, a monitoring device 100 can be provided that accurately detects anomalies while removing the effects of external disturbances.

[0110] The monitoring device 100 according to the sixth embodiment is a monitoring device 100 according to any one of the first to fifth embodiments, and the correction unit 132 subtracts the value of a linear polynomial representing the amount of fluctuation of the time series data due to disturbances from the time series data.

[0111] This configuration allows for the appropriate removal of the effects of disturbances from the time-series data of the measured values.

[0112] The seventh aspect of the monitoring method includes the steps of: subtracting the amount of fluctuation due to disturbances from the time series data of the measured values; normalizing the histogram of the time series data of the measured values ​​after the subtraction process; calculating an index that shows the degree of deviation of the time series data from normal values ​​using the time series data of the measured values ​​after the normalization process; and detecting anomalies in the time series data of the measured values ​​based on the index.

[0113] This configuration allows for the removal of disturbance-induced fluctuations from the time-series data of measured values, followed by the normalization of the histogram of the time-series data. This normalized time-series data is then used to calculate an index for anomaly detection. Therefore, this provides a monitoring method that can accurately detect anomalies by removing the effects of disturbances.

[0114] The program according to the eighth embodiment causes the computer to perform the following steps: subtract the amount of fluctuation due to disturbances from the time series data of the measured values; normalize the histogram of the time series data of the measured values ​​after the subtraction process; calculate an index that shows the degree of deviation of the time series data from normal values ​​using the time series data of the measured values ​​after the normalization process; and detect anomalies in the time series data of the measured values ​​based on the index.

[0115] This configuration allows for the removal of disturbance-induced fluctuations from the time-series data of measured values, followed by the normalization of the histogram of the time-series data. This normalized time-series data is then used to calculate an index for anomaly detection. Therefore, a program capable of accurately detecting anomalies by removing the effects of disturbances can be provided.

[0116] Although embodiments of the present disclosure have been described above, the embodiments are not limited to those described herein. Furthermore, the aforementioned components include those that can be easily conceived by those skilled in the art, those that are substantially the same, and those that fall within the so-called equivalent range. Moreover, the aforementioned components can be combined as appropriate. Furthermore, various omissions, substitutions, or modifications of the components can be made without departing from the gist of the embodiments described above. [Explanation of symbols]

[0117] 1. Monitoring System 100 Monitoring devices 110 Communications Department 120 Storage section 121 Measurement Value Storage Unit 122 Program Storage Unit 130 Control Unit 131 Acquisition Department 132 Correction section 133 Conversion section 134 Model Calculation Unit 1341 Unit Space Extension 135 Disassembly section 136 Anomaly detection unit 137 Output Control Unit 140 Input section 150 Display section 200 measuring devices 210 Communications Department 220 Storage section 230 Control Unit 231 Acquisition Department 232 Measurement value transmission unit 233 Command Receiving Unit 234 Operation Control Unit 240 Measurement Unit 1000 computers 1010 Output device 1020 Input device 1030 Arithmetic equipment 1040 Primary storage 1050 Secondary storage 1060 Output Interface 1070 Input IF 1080 Network Interface 1090 Bus N Network

Claims

1. A correction unit that performs processing to subtract the amount of fluctuation due to disturbances from the time series data of the measured values, A transformation unit that performs a process to normalize the histogram of the time-series data of the measured values ​​after the subtraction process, A model calculation unit performs a process to calculate an index indicating the degree of deviation of the time series data from the normal value, using the time series data of the measured values ​​after the processing to normalize the data. The system includes an anomaly detection unit that detects anomalies in the time-series data of the measured values ​​based on the aforementioned indicators. Monitoring device.

2. The conversion unit performs the normal distribution process on each of the multiple types of time series data. The model calculation unit calculates the index using each of the time series data after the normalization process, The system further comprises a decomposition unit that decomposes the aforementioned indicator into multiple different components, The anomaly detection unit performs anomaly detection using the indicators that have been broken down into their respective components. The monitoring device according to claim 1.

3. The decomposition unit decomposes the indicator into a plurality of components, including a periodic component, a trend component, and an irregular component. The monitoring device according to claim 2.

4. The model calculation unit calculates the Mahalanobis distance between the time series data and the unit space as the index, The unit space expansion unit includes a unit space expansion unit that performs processing to expand the aforementioned unit space. A monitoring device according to any one of claims 1 to 3.

5. The conversion unit performs a process to normalize the histogram of the time-series data of the measured values ​​by the Yeo-Johnson transformation. A monitoring device according to any one of claims 1 to 3.

6. The correction unit subtracts the value of a linear polynomial representing the amount of variation in the time series data due to disturbances from the time series data. A monitoring device according to any one of claims 1 to 3.

7. The process involves subtracting the amount of variation due to disturbances from the time-series data of the measured values, The steps include: applying a normal distribution to the histogram of the time-series data of the measured values ​​after the subtraction process; The process involves calculating an index that indicates the degree of deviation of the time series data from the normal value, using the time series data of the measured values ​​after the processing to normalize them. The step of detecting anomalies in the time-series data of the measured values ​​based on the aforementioned indicators, Monitoring methods.

8. The process involves subtracting the amount of variation due to disturbances from the time-series data of the measured values, The steps include: applying a normal distribution to the histogram of the time-series data of the measured values ​​after the subtraction process; The process involves calculating an index that indicates the degree of deviation of the time series data from the normal value, using the time series data of the measured values ​​after the processing to normalize them. The steps include detecting anomalies in the time-series data of the measured values ​​based on the aforementioned indicators, A program that causes a computer to execute something.

Images