Device management system, method for estimating the cause of device failure, and program

Abstract

To provide a technology for accurately estimating a failure cause of a device which is used in combination with a computer.SOLUTION: A device management system for managing a device includes: log data acquisition means which acquires a log, which is operation records of software, related to control of the device; cluster information extraction means which extracts, from a set of acquired logs, cluster information indicating the contents of processes related to operation of the device and inter-cluster transition information related to a transition between one process and another process; anomaly degree calculation means which calculates an anomaly degree of each of the extracted inter-cluster transition information; and failure cause estimation means which estimates a failure cause of the device, on the basis of the anomaly degree calculated by the anomaly degree calculation means.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a device management system, a method for estimating the cause of a device failure, and a program. [Background technology]

[0002] When maintenance work on industrial equipment (or facilities) involves a malfunction such as a shutdown of the equipment or a drop in performance, the cause of the malfunction must be analyzed. Such malfunction analysis is typically performed by an operator cross-referencing a variety of information, such as software operation records (logs), the operating status of the equipment's mechanical components (measurements from various sensors, motor rotation speed, etc.), and the operating status of the control device (computer) (CPU usage, memory usage, network transmission / reception volume, board temperature, etc.).

[0003] However, this method of analyzing by collating diverse information has problems such as placing a heavy burden on the operator and the analysis results being heavily dependent on the experience and knowledge of the individual.

[0004] In response to these problems, various methods have been proposed in recent years to improve the efficiency of maintenance work, including automation. For example, efforts are being made to accumulate data on the status of equipment and use it to automate countermeasures against failures. In particular, for equipment that repeats certain simple operations, it is effective to detect abnormal values ​​and change points (so-called outliers) by learning signal data obtained from sensors, and it has been proposed to use this information to estimate the cause of a fault or predict a failure (for example, Non-Patent Document 1).

[0005] However, for devices that perform complex operations in combination with control devices (computers), such as inspection devices and processing equipment, it is difficult to obtain satisfactory results using conventional techniques that use simple data. In light of this, research has been conducted in recent years into utilizing large amounts of data obtained from multiple sensors using techniques such as deep learning (for example, Non-Patent Document 2).

[0006] It has also been proposed to use text data such as software logs and maintenance records of control devices instead of sensor data, and to use these data for learning to estimate the optimal timing for maintenance (for example, Non-Patent Document 3). [Prior art documents] [Non-patent literature]

[0007] [Non-Patent Document 1] Ferreiro, S., Konde, E., Fernandez, S., and Prado, A., 2016. Industry 4.0: predictive intelligent maintenance for production equipment. European Conference of the Prognostics and Health Management Society, no (pp. 1‐8). researchgate.net. [Non-patent document 2] Ademujimi, TT, Brundage, MP, and Prabhu, VV, 2017. A Review of Current Machine Learning Techniques Used in Manufacturing Diagnosis. Advances in Production Management Systems. The Path to Intelligent, Collaborative and Sustainable Manufacturing (pp. 407‐415). Springer International Publishing. [Non-patent document 3] Patil, RB, Patil, MA, Ravi, V., and Naik, S., 2017. Predictive modeling for corrective maintenance of imaging devices from machine logs. Conference proceedings: ... Annual International Conference of the IEEE Engineering in Medicine and Biology Society. IEEE Engineering in Medicine and Biology Society. Conference, 2017, 1676‐1679. ieeexplore.ieee.org. Summary of the Invention [Problem to be solved by the invention]

[0008] However, when it comes to estimating the cause of a fault in a relatively complex device that is combined with a computer, conventional methods that use only sensor data have the problem of being unable to respond to malfunctions that occur in conjunction with software operation. Furthermore, even with methods that learn and analyze text data such as software logs and maintenance records, while it is possible to record, learn, and analyze known faults and deterioration states, it is difficult to learn from unknown or unexpected faults, and they are therefore unable to respond to such faults.

[0009] The present invention has been made in view of the above-described circumstances, and has an object to provide a technique that enables accurate estimation of the cause of a fault in a device used in combination with a computer. [Means for solving the problem]

[0010] In order to achieve the above object, the present invention employs the following configuration: A device management system, comprising: a log data acquisition means for acquiring a log that is a record of the operation of software related to the control of the device; a cluster information extraction means for extracting, from the acquired set of logs, cluster information that is information indicating the contents of each process related to the operation of the device, and inter-cluster transition information that is information related to the transition between one of the processes and another of the processes; an abnormality degree calculation means for calculating an abnormality degree of each of the extracted inter-cluster transition information; and a fault cause estimation means for estimating a fault cause of the device based on the abnormality degree calculated by the abnormality degree calculation means. It is a device management system.

[0011] With this configuration, it is possible to calculate the degree of abnormality for each detailed behavior related to the operation of a device in which a fault has occurred, and to estimate the cause of the fault based on this degree of abnormality, so that even if the cause of the fault is unknown (or unexpected), it can be estimated that it is the cause of the fault.

[0012] Furthermore, the anomaly degree calculation means may calculate the anomaly degree of each of the extracted inter-cluster transition information based on the inter-cluster transition information when the device is operating normally. With this configuration, the anomaly degree when a failure occurs can be calculated based only on data when the device is operating normally, without using learning data when the device is faulty, and therefore the method can be applied to a variety of devices, from devices with simple configurations to complex devices.

[0013] The inter-cluster transition information may include information relating to the frequency of occurrence of transitions between the plurality of processes in the device, and the system may further include an inter-cluster transition information evaluation means for weighting each of the extracted inter-cluster transition information based on the frequency of occurrence, and the anomaly degree calculation means may calculate the anomaly degree using the weighting information. In this way, by including a means for weighting based on the frequency of occurrence of transitions between processes, the anomaly degree can be calculated efficiently and accurately.

[0014] The device further includes hardware information acquisition means for acquiring hardware information relating to a hardware state of the device, and the inter-cluster transition information evaluation means evaluates the hardware information The extracted pieces of inter-cluster transition information may further be weighted based on the hardware information acquired by the acquisition means.

[0015] Here, hardware information refers to various sensor data and information related to the operation and status of the hardware aspects of the device obtained from the sensor data. In this way, by further weighting using hardware information, it becomes possible to calculate the degree of anomaly with higher accuracy.

[0016] The fault cause estimation means may also estimate that the cause of the fault in the device is in the process identified by the inter-cluster transition information, where the anomaly degree calculated by the anomaly degree calculation means satisfies a predetermined condition. Specifically, the predetermined condition may be, for example, a case where the anomaly degree exceeds a predetermined threshold. In this case, the threshold may be set in advance by a user, or may be automatically set by learning based on the operation history of the device. In this way, it is possible to efficiently estimate the cause of the fault in the device.

[0017] The device management system may further comprise a display means for displaying information indicating the degree of anomaly calculated by the degree of anomaly calculation means and / or the cause of the failure estimated by the cause of the failure estimation means. With this configuration, a user can easily check the estimated cause of the failure.

[0018] The device management system may further include a directed graph generation means for generating a directed graph showing the relationship between the cluster information and the inter-cluster transition information, with the cluster information as nodes and the inter-cluster transition information as edges, and the display means may be capable of displaying the directed graph.

[0019] With this configuration, the user can check the operation of the software related to the control of the device in the form of a directed graph, and can utilize this information for the management and maintenance of the device.

[0020] Furthermore, the inter-cluster transition information may be weighted by a predetermined method to evaluate the degree of importance, and the digraph generation means may generate the digraph in which the weighting of each piece of inter-cluster transition information is visible. The weighting means here is not particularly limited, but may be weighting based on the frequency of inter-cluster transitions, corresponding hardware information (sensor data), or the like, as described above. With this configuration, the user can view the digraph in which the weighting is reflected, thereby obtaining more detailed information from the digraph.

[0021] The directed graph generating means may generate a directed graph in which the weighting is visually represented by displaying a numerical value indicating the weighting in the inter-cluster transition information near the edge.

[0022] The digraph generating means may generate a digraph in which the weighting is visually expressed by varying the clarity of the edges indicating the inter-cluster transition information. Here, varying the clarity may mean, for example, making the thickness of the edge line thicker according to the weight, or increasing the brightness or luminance of the edge line according to the weight, etc.

[0023] Furthermore, the cluster information includes words as text information extracted from the log, and the directed graph generating means outputs the words included in each of the cluster information. The cluster information may be extracted from the plurality of words in descending order of appearance frequency, and the directed graph may be generated using the extracted words as information indicating the content of the cluster information. With this configuration, the user can easily understand the content of each node of the directed graph based on the words.

[0024] In addition, the device management system may further include an extracted log display image generation means for extracting logs corresponding to the inter-cluster transition information that satisfies a predetermined condition from the collection of logs as information indicating the content of the inter-cluster transition information that satisfies the predetermined condition, and generating an extracted log display image indicating the content of the extracted log, and the display means may be capable of displaying the extracted log display image.

[0025] Here, "satisfying a predetermined condition" may mean that the degree of anomaly exceeds a predetermined value, that the user selects an edge in the directed graph that corresponds to the inter-cluster transition information, etc. With this configuration, the user can quickly check the log that corresponds to the inter-cluster transition information.

[0026] The extraction log display image may be displayed as a pop-up near the edge indicating the inter-cluster transition information corresponding to the extraction log indicated by the display image. With this display, the relationship between the pop-up displayed extraction log display image and the edge indicating the corresponding inter-cluster transition information can be easily grasped. The display location of the extraction log display image is not particularly limited, and a specific display area may be provided regardless of the pop-up display.

[0027] The present invention also provides a method for estimating a cause of a fault in a device, comprising: a log data acquisition step of acquiring a log that is operation history information of software related to control of the device; a cluster information extraction step of extracting, from the acquired set of logs, cluster information that is information indicating the content of each process of the processing performed by the device, and inter-cluster transition information that is information related to transitions between the plurality of processes in the device; an abnormality degree calculation step of calculating an abnormality degree of each of the extracted inter-cluster transition information; The present invention can also be applied as a method for estimating the cause of a fault in an apparatus, including a fault cause estimation step of estimating the cause of a fault in the apparatus based on the degree of abnormality calculated in the degree of abnormality calculation step.

[0028] The present invention can also be understood as a program for causing a computer to execute the above-described method, or a computer-readable recording medium on which such a program is non-transitoryly recorded.

[0029] The present invention can be achieved by combining the above-described configurations and processes as long as no technical contradiction occurs. [Effects of the Invention]

[0030] According to the present invention, it is possible to provide a technique that enables accurate estimation of the cause of a fault in a device used in combination with an information processing device. [Brief explanation of the drawings]

[0031] [Figure 1] FIG. 1 is a schematic diagram showing an overview of a device management system according to the first embodiment. [Figure 2] FIG. 2 is an explanatory diagram showing an example of a software log. [Figure 3] FIG. 3 is a flowchart showing the flow of processing performed in the device management system according to the first embodiment. [Figure 4] FIG. 4 is a flowchart showing a subroutine of processing in the device management system according to the first embodiment. [Figure 5] FIG. 5 is an explanatory diagram illustrating the software log separation process. [Figure 6]FIG. 6 is an explanatory diagram illustrating the clustered log lines. [Figure 7] FIG. 7 is an explanatory diagram illustrating a log cluster sequence generated by the device management system according to the first embodiment. [Figure 8] Fig. 8A is a first diagram illustrating a directed graph generated by the device management system according to embodiment 1. Fig. 8B is a second diagram illustrating a directed graph generated by the device management system according to embodiment 1. [Figure 9] FIG. 9 is a diagram illustrating an example of a directed graph generated by the device management system according to the first embodiment. [Figure 10] Fig. 10A is a diagram showing an example of a directed graph displayed on a screen in a modified example of embodiment 1. Fig. 10B is a diagram showing another example of a directed graph displayed on a screen in a modified example of embodiment 1. [Figure 11] FIG. 11 is a schematic diagram showing an outline of a device management system according to another modification of the first embodiment. [Figure 12] FIG. 12 is a diagram illustrating an example of a screen displayed in a device management system according to another modification of the first embodiment. [Figure 13] FIG. 13 is a schematic diagram showing an overview of a device management system according to the second embodiment. [Figure 14] FIG. 14 is a flowchart showing the flow of processing performed by the device management system according to the second embodiment. [Figure 15] FIG. 15 is a flowchart showing a subroutine of processing in the device management system according to the second embodiment. [Figure 16] FIG. 16 is an explanatory diagram showing the relationship between the sensor data and the change score. [Figure 17] FIG. 17 is an explanatory diagram illustrating an example of a log cluster sequence to which change scores are mapped, which is generated by the device management system according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0032] The following describes examples of the present invention with reference to the drawings. However, unless otherwise specified, the dimensions, materials, shapes, relative positions, etc. of the components described in each example are not intended to limit the scope of the present invention.

[0033] <Application example> (Configuration of application examples) The present invention can be applied, for example, as a management system for a visual inspection device that inspects an object to be inspected by processing an image captured by an imaging means of the object to be inspected. Fig. 1 is a schematic diagram showing an overview of an apparatus management system 1 according to this application example.

[0034] The device management system 1 is configured to include an information processing terminal 100 and an appearance inspection device 120. The information processing terminal 100 may be configured integrally with the appearance inspection device 120, or may be a separate device communicably connected to the appearance inspection device 120, and may be configured by, for example, a general-purpose computer. The information processing terminal 100 may be configured by a single computer, or may be configured by multiple computers that cooperate with each other. The appearance inspection device 120 is a device that automatically inspects an inspection object, such as a component-mounted board, by capturing an image of the inspection object and processing the image.

[0035] The information processing terminal 100 includes functional units such as a log data acquisition unit 101, a cluster information extraction unit 102, an inter-cluster transition information evaluation unit 103, a directed graph generation unit 104, a reference data generation unit 105, an abnormality degree calculation unit 106, a fault cause estimation unit 107, a display unit 108, and a storage unit 109. In addition, although not shown, various input means such as a mouse and a keyboard, communication means, etc. may be provided.

[0036] The appearance inspection device 120 is configured to include a conveyor 124 that transports the inspection object O to an imaging position, a camera 121 that images the inspection object O, and an X stage 122 and a Y stage 123 that move the camera 121 in the horizontal direction. Although not shown, the appearance inspection device 120 also includes an image processing unit that processes the captured image, an inspection processing unit that performs inspection based on the image, an output processing unit that outputs the inspection results, and the like.

[0037] (Method for estimating the cause of a failure) The device management system 1 of this application example prepares reference data that has been learned (modeled) in advance using multiple pieces of data from the visual inspection device 120 when it is operating normally, and when a failure occurs in the visual inspection device 120, it estimates the cause of the failure based on the reference data.

[0038] Specifically, first, a software log (hereinafter simply referred to as a log) related to control during normal operation of the visual inspection apparatus 120 is acquired by the log data acquisition unit 101. The log is configured as text information as shown in Fig. 2, and the cluster information extraction unit 102 processes the text information to extract cluster information indicating the content of each process related to the operation of the visual inspection apparatus 120. Furthermore, inter-cluster transition information, which is information related to the transition between one process and another process related to the operation of the visual inspection apparatus 120, is extracted.

[0039] Furthermore, a directed graph generation unit 104 creates a directed graph showing the relationship between each of the extracted cluster information and inter-cluster transition information. This process is repeated multiple times as many times as necessary to create the reference data, thereby obtaining multiple directed graphs. Furthermore, a reference data generation unit 105 converts the obtained multiple directed graphs into a matrix representation, calculates the mean and variance for each element of the matrix, and saves this as reference data.

[0040] If a failure occurs in the visual inspection device 120, a log related to control at the time of the failure is acquired, a directed graph is created using the same process as when creating the reference data, and this is converted into a matrix representation. Next, the anomaly degree calculation unit 106 compares each element of the acquired matrix data at the time of the failure with each element of the matrix of the reference data, and calculates an anomaly degree indicating the magnitude of deviation from the reference data for each element. Then, the failure cause estimation unit 107 determines that the process (or transition between processes) corresponding to an element whose anomaly degree is equal to or greater than a predetermined threshold is highly likely to be the cause of the failure, and estimates that this process is the cause of the failure.

[0041] As described above, the device management system 1 according to this application example creates reference data based only on data during normal operation, and can estimate the cause of a failure by comparing the data during a failure with the reference data. This makes it possible to accurately estimate the cause of a failure even for unknown causes.

[0042] <Embodiment 1> Next, an embodiment of the present invention will be described in more detail with reference to Figures 1 to 9. First, the functional units included in the information processing terminal 100 of the device management system 1 according to this embodiment will be described.

[0043] (Functions of information processing terminals) The log data acquisition unit 101 acquires logs that are operation records of software related to the control of the visual inspection device 120. The cluster information extraction unit 102 extracts, from the acquired set of logs, cluster information that is information indicating the contents of each process related to the operation of the visual inspection device 120, and inter-cluster transition information that is information related to the transition between one process and another process. will be explained in detail later.

[0044] The inter-cluster transition information includes information relating to the frequency of occurrence of transitions between multiple processes in the visual inspection device 120, and the inter-cluster transition information evaluation unit 103 weights each piece of extracted inter-cluster transition information using at least the information on the frequency of occurrence.

[0045] Furthermore, the directed graph generation unit 104 generates a directed graph showing the relationship between each piece of cluster information and inter-cluster transition information, with the extracted cluster information as nodes and the inter-cluster transition information as edges. The reference data generation unit 105 generates reference data that serves as a reference for estimating the cause of a fault. Specifically, the unit 105 converts multiple directed graphs obtained by sampling multiple pieces of log data during normal operation of the visual inspection device 120 into a matrix representation, calculates the mean and variance for each element of the matrix, and stores this as reference data in the storage unit 109.

[0046] The anomaly degree calculation unit 106 converts the directed graph generated from the log data at the time of the failure into a matrix representation, and compares each element of the matrix with the above-mentioned reference data to calculate the anomaly degree indicating the magnitude of deviation from the reference data for each element. Since each element of the matrix corresponds to each piece of inter-cluster transition information extracted from the log, the anomaly degree of each element of the matrix is ​​the anomaly degree of each corresponding piece of inter-cluster transition information.

[0047] The fault cause estimation unit 107 estimates that a process indicated by a software log corresponding to inter-cluster transition information whose calculated abnormality level is equal to or greater than a predetermined threshold is likely to be the cause of the fault, and estimates that the process is the cause of the fault.

[0048] The display unit 108 is an image display device such as a liquid crystal display, and displays various information including the above-mentioned directed graph, the estimated cause of the failure, the abnormality level of the inter-cluster transition information, etc. The storage unit 109 may include a main storage unit such as a read-only memory (ROM) or a random access memory (RAM), and an auxiliary storage unit such as an EPROM, a hard disk drive (HDD), or a removable medium.

[0049] The auxiliary storage unit can store various information such as the operating system (OS), various programs, the above-mentioned reference data, the operation history and maintenance records of the managed devices, etc. The programs stored in the auxiliary storage unit are loaded into the working area of ​​the main storage unit and executed, and the components are controlled through the execution of the programs, thereby realizing the functional units that fulfill the predetermined purposes described above. Some or all of the functional units may be realized by hardware circuits such as ASICs and FPGAs.

[0050] (Flow of the fault cause estimation process) Next, a description will be given of the flow of the fault cause estimation process for the visual inspection device 120 in the device management system 1 according to this embodiment. Fig. 3 is a flowchart showing an example of the fault cause estimation process in the device management system 1. As shown in Fig. 3, the device management system 1 first generates reference data based on data acquired from the visual inspection device 120 during normal operation (S101).

[0051] Here, the reference data generation process in step S101 will be described in detail with reference to FIG. 4. FIG. 4 is a flowchart showing the flow of a subroutine of the reference data generation process in this embodiment. As shown in FIG. 4, first, the log data acquisition unit 101 acquires log data during normal operation (S201). Next, the cluster information extraction unit 102 performs a process of separating the log information based on a predetermined rule (S202). FIG. 5 is an explanatory diagram of such a log information separation process. As shown in FIG. 5, each line of the log data is made up of a time data portion indicating the time and a message character string, and the cluster information extraction unit 102 Each line of the log is broken down into timestamps and a message string. The message string is then further broken down into words, with numbers and symbols removed.

[0052] Next, the cluster information extraction unit 102 performs a process of vectorizing the set of words in each line of the log using, for example, the TF-IDF method. TF-IDF is a well-known method and will not be described in detail here, but it is a method of determining the importance of words based on two indices: TF (Term Frequency: word frequency) and IDF (Inverse Document Frequency).

[0053] The cluster information extraction unit 102 further clusters the vector set of all rows into, for example, 200 clusters using, for example, the K-means method (S203), as shown in Figure 6. Figure 6 is an explanatory diagram illustrating the clustered log lines. Note that the K-means method is a well-known clustering method, so a detailed description will be omitted.

[0054] Next, the cluster information extraction unit 102 generates a log cluster sequence in which cluster numbers are consecutive based on the time at which each log line is output, as shown in Fig. 7. By arranging the cluster numbers in chronological order in this way, it is possible to obtain information related to transitions between clusters. That is, it is possible to extract cluster information indicating the content of each process related to the operation of the visual inspection apparatus 120 obtained from the text messages (words) of the log in this way, and inter-cluster transition information, which is information related to the transition between one cluster (process) and another cluster. That is, in this embodiment, the processes of steps S202 and S203 correspond to the cluster information extraction step.

[0055] Next, the directed graph generation unit 104 creates a directed graph in which each cluster information is a node and the inter-cluster transition information is an edge (S204). At this time, each node may be displayed with the cluster number of the corresponding cluster.

[0056] Next, the inter-cluster transition information evaluation unit 103 weights each edge of the directed graph based on the transition frequency between nodes of the directed graph (i.e., between corresponding clusters) (S205). FIG. 8 is an explanatory diagram illustrating the weighting performed in S205. FIG. 8A is a diagram in which the cluster numbers of the clusters corresponding to each log line are arranged in chronological order from left to right based on the time the log line was output. FIG. 8B is a diagram showing the directed graph reflecting the weighting. Numerical values ​​are written near the edges of the directed graph in FIG. 8B, and these numbers represent the occurrence frequency of the edge (i.e., the transition between clusters). Referring to FIG. 8A, there are two transitions from cluster number 2 to cluster number 2, two transitions from cluster number 2 to cluster number 0, three transitions from cluster number 0 to cluster number 6, one transition from cluster number 6 to cluster number 0, and one transition from cluster number 6 to cluster number 2. In the directed graph of FIG. 8B, the number of transitions is displayed near the edge, and the thickness of the edge is displayed thicker according to the frequency of occurrence of the transition.

[0057] In this way, by performing the processes from step S201 to step S205, a series of processes for one log data during normal operation is completed. Fig. 9 shows an example of a directed graph generated when a series of processes for one log data during normal operation is completed.

[0058] Next, the reference data generation unit 105 performs a process of determining whether a predetermined number (e.g., 100) of digraphs weighted as described above required for generating reference data have been acquired (S206). If the predetermined number of digraph data has not been acquired, the process returns to step S201 to acquire new log data during normal operation, and the subsequent processes are repeated.

[0059] On the other hand, if it is determined in step S206 that a predetermined number of pieces of digraph data have been acquired, the process proceeds to step S207, where the reference data generation unit 105 performs a process of converting all of the acquired digraphs into a matrix representation. Specifically, as shown in the following formula (1), a process of converting into an edge weight matrix W in which the weight of an edge transitioning from one node to another node in the digraph is used as each element of the matrix is ​​performed. As in the above example, if the number of clusters is 200, the edge weight matrix W will be a 200 x 200 matrix.

number

[0060] Here, the matrix element W 00 represents the weight of the edge (i.e., inter-cluster transition information) transitioning from node 0 (hereinafter simply referred to as node 0) indicating cluster number 0 to node 0, and W n0 represents the weight of the edge transitioning from node n to node 0. That is, W ij denotes the weight of the edge transitioning from node i to node j.

[0061] After completing the process of replacing all directed graphs with the matrix representation, the reference data generation unit 105 performs a process of calculating the mean and variance for each element of the matrix (S208). For example, when using 100 pieces of data during normal operation, the reference data generation unit 105 calculates, as the result of integrating the matrix data for 100 pieces, one mean weight matrix indicating the mean for 100 pieces and one variance weight matrix indicating the variance for 100 pieces, as reference data (S209). Note that, in the following, each element of the mean weight matrix is ​​calculated using the W of 100 pieces. ij μ, which indicates the average ij For each element of the distribution weight matrix, we use 100 W ij σ, which indicates the variance of ij It is described as follows.

[0062] Then, when the process of step S209 is completed, the series of subroutines of the reference data generation process (S101) is completed. Returning to the explanation of the flowchart showing the fault cause estimation process in Fig. 3, when the process of step S101 is completed, the reference data generation unit 105 stores the generated reference data in the storage unit 109 (S102).

[0063] Next, when a failure occurs in the visual inspection device 120, the log data acquisition unit 101 acquires log data at the time of the failure (S103). Then, a series of processes are executed to extract cluster information from the log data at the time of the failure, generate a weighted directed graph based on the cluster information, and acquire data obtained by matrix transforming the directed graph (S104). The specific process contents performed in step S104 are the same as the processes performed in steps S202 to S205 and step S207 described above. Therefore, a description thereof will be omitted here.

[0064] Next, the abnormality degree calculation unit 106 compares the matrix data at the time of occurrence of the fault acquired in step S104 with the reference data, thereby calculating the abnormality degree a for each matrix element at the time of occurrence of the fault. ij Specifically, the abnormality degree is calculated based on the following formula (2).

number

[0065] Then, the fault cause estimation unit 107 estimates the matrix element of the abnormality degree that satisfies a predetermined condition (for example, exceeds a threshold) as the cause of the fault (S106). ij If is estimated to be the cause of the failure, then the matrix element W ij has the cluster information of node i and the cluster information of node j, the cluster information (or the corresponding log line) is displayed on the display unit 108 as information indicating the estimated cause of the failure (S107).

[0066] In this way, the series of steps in the fault cause estimation process is completed. Note that it is not necessary to execute the processes of steps S101 and S102 every time a fault cause is estimated; once the reference data is created and saved, the fault cause estimation process may start from the process of step S103. Of course, the processes of steps S101 and S102 may be executed as appropriate, and the reference data may be updated as needed.

[0067] According to the device management system 1 described above, reference data is created based only on data during normal operation, and by comparing data when a fault occurs with the reference data, the degree of anomaly of elements representing each process can be calculated and the cause of the fault can be estimated. This makes it possible to accurately estimate the cause of a fault even for unknown causes. In addition, by weighting based on the frequency of transitions between clusters, the degree of anomaly can be calculated appropriately for items of high importance.

[0068] (Variation 1) In the first embodiment, the cluster information indicating the estimated cause of the failure is displayed on the display unit 108. However, various information can be displayed on the display unit 108. FIG. 10 shows a digraph as an example of information displayed on the display unit 108. FIG. 10A shows a normal digraph in which a cluster number corresponding to each node is displayed. FIG. 10B shows a modified display example of the digraph. The digraph generation unit 104 may extract words included in the cluster information corresponding to each node in descending order of frequency of appearance, and generate a digraph using the extracted words as information indicating the content of the cluster corresponding to each node (see FIG. 10B), and display the digraph on the display unit 108. This allows the user to easily understand the content of each node of the digraph based on the words.

[0069] (Variation 2) Fig. 11 is a schematic diagram showing the schematic configuration of a device management system 2 according to yet another modification of the first embodiment. Note that, hereinafter, the same components and processes as those described in the above-mentioned examples are denoted by the same reference numerals, and redundant explanations will be omitted. As shown in Fig. 11, the device management system 2 according to this modification differs from the device management system 1 of the first embodiment only in that the information processing terminal 200 is provided with an extracted log display image generation unit 201, and the other points are the same.

[0070] The extracted log display image generating unit 201 extracts logs corresponding to edges that satisfy a predetermined condition from the collection of logs as information indicating the content of the edge (inter-cluster transition information) that satisfies the predetermined condition, generates an extracted log display image indicating the content of the extracted logs, and displays it on the display unit 108. Fig. 12 shows an example of a display screen in which an extracted log display image relating to the content of the edge is displayed as a pop-up near the edge of the directed graph.

[0071] Here, "satisfying a predetermined condition" means that when the degree of abnormality exceeds a predetermined value, the user operates the mouse to move the edge corresponding to the inter-cluster transition information in the directed graph. The extracted log display image can be displayed in any manner, not just near the edge of the directed graph, and can also be a user interface with a dedicated display area on the screen. With this configuration of this modified example, the user can quickly check the log corresponding to the inter-cluster transition information.

[0072] <Embodiment 2> Next, another embodiment of the present invention will be described with reference to Figs. 13 to 17. Fig. 13 is a schematic diagram showing the general configuration of an device management system 3 according to this embodiment. As shown in Fig. 13, the device management system 3 according to this embodiment differs from the device management system 1 in that an information processing terminal 300 is provided with a sensor data acquisition unit 301. Furthermore, the inter-cluster transition information evaluation unit 303 according to this embodiment differs from the inter-cluster transition information evaluation unit 103 of the first embodiment in that it performs some different processing, as will be described later. In other respects, the system is the same as the inspection management system 1 according to the first embodiment.

[0073] The sensor data acquisition unit 301 acquires sensor data that detects information related to the status of the hardware of the appearance inspection device 120 (for example, the conveyor 124, the camera 121, the X stage 122, the Y stage 123, the output device, etc.). The sensor data is time-series numerical data that records the status of the hardware, and is acquired from devices such as various sensors, motors, and position control systems that the appearance inspection device 120 is equipped with. Whether the sensor data is recorded in text format or binary format depends on the specifications of the device, but any format may be used as long as the correspondence between time and numerical values ​​can be acquired. In this embodiment, the various sensors, the sensor data acquisition unit 301, etc. correspond to hardware information acquisition means.

[0074] The automatic inspection process by the visual inspection device 120 is roughly composed of six processes for one inspection object. Specifically, the processes are divided into carrying in the inspection object O, capturing an image of the inspection object O, image processing, pass / fail judgment, output of the inspection result, and carrying out the inspection object O. The hardware operation differs for each process, and the length and number of repetitions of each process are not constant. For this reason, the sensor data that records the hardware status also varies greatly depending on the object. In other words, it is not easy to infer the cause of a device failure by learning about the hardware operation (the sensor data that indicates it).

[0075] Next, a description will be given of the flow of the fault cause estimation process of the visual inspection device 120 in the device management system 3 according to this embodiment. Fig. 14 is a flowchart showing an example of the fault cause estimation process of the device management system 3. As shown in Fig. 14, the overall flow is almost the same as the process in the first embodiment.

[0076] In the device management system 3 according to this embodiment, first, reference data is generated based on data acquired from the visual inspection device 120 during normal operation (S301). Here, the subroutine of step S301 will be described with reference to Fig. 15. Fig. 15 is a flowchart showing the flow of the subroutine of the reference data generation process in this embodiment.

[0077] 15, the subroutine for generating reference data in this embodiment is generally similar to that in embodiment 1, and steps S201 to S205 are the same as those in embodiment 1. That is, log data during normal operation is acquired (S201), the log information is separated (S202), the separated log information is clustered (S203), a directed graph is generated using the clustered data (S204), and edges are weighted based on the frequency of transitions between clusters (S205).

[0078] In this embodiment, as the next step, the sensor data acquisition unit 301 acquires sensor data during normal operation of the visual inspection device 120 (S401). Subsequently, the inter-cluster transition information evaluation unit 303 performs processing to further weight the edges of the directed graph based on the sensor data output in step S401 (S402).

[0079] Specifically, the inter-cluster transition information evaluation unit 303 uses the Change-Finder algorithm to convert sensor data (time-series numerical data) acquired from the hardware into data (change scores) that indicate the magnitude of change at each time in a time series. Fig. 16 shows an explanatory diagram illustrating the relationship between sensor data and change scores. Note that the Change-Finder algorithm is a well-known technique, so a detailed description will be omitted.

[0080] In this case, as shown in Figure 16, the numerical range of the sensor data that is the basis of the change score differs depending on the target hardware, etc., and the change score also reflects these differences, resulting in a variation in the numerical range. For this reason, all change scores are normalized between 0 and 1.

[0081] Next, the inter-cluster transition information evaluation unit 303 maps the change scores to the log cluster sequence (see FIG. 7) generated by the cluster information extraction unit 102, and associates the change scores with the transitions between clusters. FIG. 17 shows an example of a log cluster sequence with the change scores mapped.

[0082] Then, the inter-cluster transition information evaluation unit 303 weights each edge of the directed graph based on the hardware information by reflecting the magnitude of the change score on each edge of the directed graph (each inter-cluster transition).

[0083] In this way, when the processing of step S402 is completed, the process proceeds to step S206. However, since the subsequent processing related to the subroutine of the reference data generation processing (S301) is the same as that described in embodiment 1, the description here is omitted.

[0084] 14, when the processing of step S301 is completed, the reference data generation unit 105 stores the generated reference data in the storage unit 109 (S102). When a failure occurs in the visual inspection device 120, the log data acquisition unit 101 acquires log data at the time of the failure (S103), and the sensor data acquisition unit 301 acquires sensor data indicating the hardware state at the time of the failure (S302).

[0085] Then, the information processing terminal 300 extracts cluster information from the log data at the time of the failure occurrence, generates a weighted directed graph based on the extracted cluster information, weights the directed graph using sensor data, and executes a series of processes to obtain data obtained by matrix transforming the directed graph (S303). Note that the specific processing content performed in step S303 is the same as the processing performed in steps S202 to S205, step S402, and step S207 in the subroutine of step S301 described above. Therefore, a repeated explanation will be omitted.

[0086] Furthermore, the processing from step S105 onwards in this embodiment is the same as that in the first embodiment, and therefore a description thereof will be omitted here.

[0087] According to the device management system 3 of this embodiment, it is possible to further weight the edges of the directed graph (i.e., inter-cluster transition information) using sensor data indicating the hardware status of the visual inspection device 120. In a directed graph weighted only by the frequency of occurrence of inter-cluster transitions, there is a possibility that important inter-cluster transition information (although infrequent) corresponding to process switching in the visual inspection device 120 or changes in the hardware status may be underestimated. In contrast, the device management system 3 according to this embodiment detects important change points in the sensor data and further weights the edges based on the detected change points, thereby preventing important inter-cluster transition information from being underestimated and enabling more accurate estimation of the cause of the fault to be obtained.

[0088] <Other> The above-described embodiments merely exemplify the present invention, and the present invention is not limited to the specific embodiments described above. Various modifications and combinations of the present invention are possible within the scope of the technical concept thereof. For example, in the above-described embodiments, a management system for visual inspection equipment was described, but the devices managed by the equipment management system are not limited to this. As described above, the cause of a failure is estimated using reference data learned only from data during normal operation, without using abnormal data when a failure occurs. This allows operation using only data that can be collected on the equipment's actual operating line, and therefore the present invention can be applied to a variety of equipment.

[0089] Furthermore, as data during normal operation, it is possible to collect data from processing multiple objects (objects of inspection or processing) without limiting the number of objects processed by the equipment to one, and then mix this data to generate reference data. In this case, data such as when and what the object was changed to is not required, and reference data can be generated using only software logs and sensor data.

[0090] Furthermore, although the above embodiment is a system including devices to be managed, the information processing terminal alone in the above embodiment can also be regarded as the management system according to the present invention. In other words, the present invention can also be regarded as a device management terminal consisting of an information processing terminal configured separately from the devices to be managed.

[0091] <Appendix 1> A device management system (1, 2, 3), A log data acquisition means (101) for acquiring a log that is a record of the operation of software related to the control of the device; a cluster information extraction means (102) for extracting, from the acquired set of logs, cluster information, which is information indicating the contents of each process related to the operation of the device, and inter-cluster transition information, which is information related to the transition between one of the processes and another of the processes; an abnormality degree calculation means (106) for calculating an abnormality degree of each of the extracted inter-cluster transition information; and a fault cause estimation means (107) for estimating a fault cause of the device based on the abnormality degree calculated by the abnormality degree calculation means, Equipment management system.

[0092] <Appendix 2> A method for estimating a cause of a fault in a device, comprising: a log data acquisition step (S201, S103) for acquiring a log that is operation history information of software related to control of the device; a cluster information extraction step (S202, S203) of extracting, from the acquired set of logs, cluster information that is information indicating the content of each process of the processing performed by the device, and inter-cluster transition information that is information related to transitions between the multiple processes in the device; an abnormality degree calculation step (S105) of calculating an abnormality degree of each of the extracted inter-cluster transition information; a fault cause estimation step (S106) of estimating a fault cause of the device based on the abnormality degree calculated by the abnormality degree calculation means, A method for estimating the cause of equipment failure. [Explanation of symbols]

[0093] 1, 2, 3... Equipment Management System 100, 200, 300... Information processing terminal 120... Appearance inspection device 121···Camera 122···X Stage 123 Y Stage 124···Conveyor O...Inspection object

Claims

1. A device management system, comprising: a log data acquisition means for acquiring a log that is a record of the operation of software related to the control of the device; a cluster information extraction means for extracting, from the acquired set of logs, cluster information, which is information indicating the contents of each process related to the operation of the device, and inter-cluster transition information, which is information related to transitions between one of the processes and another of the processes, and includes information related to the frequency of occurrence of transitions between a plurality of the processes in the device; an inter-cluster transition information evaluation means for weighting each of the extracted inter-cluster transition information based on the occurrence frequency; an anomaly degree calculation means for calculating an anomaly degree of each of the extracted inter-cluster transition information by using at least the weighting information; and a fault cause estimation means for estimating a fault cause of the device based on the abnormality degree calculated by the abnormality degree calculation means. Equipment management system.

2. The abnormality degree calculation means calculating an abnormality degree of each of the extracted inter-cluster transition information based on the inter-cluster transition information when the device is normal; 2. The device management system according to claim 1.

3. further comprising a hardware information acquisition means for acquiring hardware information relating to a hardware status of the device; the inter-cluster transition information evaluation means further weights each of the extracted inter-cluster transition information based on the hardware information acquired by the hardware information acquisition means.

2. The device management system according to claim 1.

4. The fault cause estimation means It is estimated that the cause of the failure of the device is in a process specified by the inter-cluster transition information in which the abnormality degree calculated by the abnormality degree calculation means satisfies a predetermined condition.

4. The device management system according to claim 1, wherein the device management system is a device management system for managing a device.

5. further comprising a display means capable of displaying information indicating the degree of abnormality calculated by the degree of abnormality calculation means and / or the cause of the failure estimated by the cause of failure estimation means, 5. The device management system according to claim 1, wherein the device management system is a device management system for managing a device.

6. a directed graph generating means for generating a directed graph showing a relationship between each of the cluster information and the inter-cluster transition information, with the cluster information as nodes and the inter-cluster transition information as edges; the display means is capable of displaying the directed graph.

6. The device management system according to claim 5.

7. the inter-cluster transition information is weighted by a predetermined method to evaluate the degree of importance, the directed graph generating means generates the directed graph in which the weighting in each of the inter-cluster transition information can be visually recognized.

7. The device management system according to claim 6.

8. The directed graph generation means generating a directed graph in which the weightings are visually represented by displaying the numerical values ​​indicating the weightings in the inter-cluster transition information near the edges; The device management system according to claim 7 .

9. The directed graph generation means generating a directed graph in which the weighting is visually represented by varying the clarity of the edges indicating the inter-cluster transition information; 9. The device management system according to claim 7 or 8.

10. the cluster information includes words as text information extracted from the log, The directed graph generation means extracting the words included in each piece of cluster information in descending order of frequency of appearance, and generating the directed graph using the extracted words as information indicating the contents of the cluster information; 10. A device management system according to claim 6, wherein the device management system is a device management system for managing a device.

11. The system further comprises an extracted log display image generating means for extracting, from the set of logs, logs corresponding to the inter-cluster transition information that satisfies a predetermined condition as information indicating the content of the inter-cluster transition information that satisfies the predetermined condition, and generating an extracted log display image indicating the content of the extracted logs, the display means is capable of displaying the extracted log display image.

11. A device management system according to claim 6, wherein the device management system is a device management system for managing a device.

12. the extracted log display image is popped up near the edge indicating the inter-cluster transition information corresponding to the extracted log indicated by the display image; 12. The device management system of claim 11.

13. A method for estimating the cause of a fault in a device by a computer, comprising: The computer a log data acquisition step of acquiring a log that is operation history information of software related to control of the device; a cluster information extraction step of extracting, from the acquired set of logs, cluster information, which is information indicating the content of each process of the processing performed by the device, and inter-cluster transition information, which is information regarding transitions between the plurality of processes in the device and includes at least information regarding the frequency of occurrence of transitions between the plurality of processes in the device; an inter-cluster transition information evaluation step of weighting each of the extracted inter-cluster transition information based on the occurrence frequency; an anomaly degree calculation step of calculating an anomaly degree of each of the extracted inter-cluster transition information using at least the weighting information; a fault cause estimation step of estimating a fault cause of the device based on the degree of abnormality calculated in the degree of abnormality calculation step, A method for estimating the cause of equipment failure.

14. A program for causing a computer to execute each step of the method according to claim 13.

Images