Detection device, detection method, and detection program

Abstract

To improve the accuracy of a learning model.SOLUTION: A server device 10 collects measurement data measured by a field device 20, inputs the collected measurement data into a learned detection model that predicts a predetermined event in response to the input of the measurement data, and obtains an output result of the learned detection model. When the output result of the learned detection model differs from a determination result made by a worker W who has checked the field device 20 in which the predetermined event is predicted, the server device re-learns the learned detection model using a label value input by the worker W and the collected measurement data, and generates a re-learning model.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a detection device, a detection method, and a detection program. [Background Art]

[0002] A technique is known in which unsupervised machine learning is performed based on normal data collected in advance, a normal state model is created by extracting features of the normal data, and an abnormal state of a plant is detected based on the trained normal state model and input data. [Prior Art Documents] [Patent Documents]

[0003] [Patent Document 1] Japanese Unexamined Patent Publication No. 11-338848 [Summary of the Invention] [Problem to be Solved by the Invention]

[0004] However, with the above technique, it is difficult to improve the accuracy of a machine learning model (referred to as a "learning model" where appropriate) that detects a sign of an abnormal state (referred to as an "abnormality sign" where appropriate). For example, in the above technique, since data collected in advance is not labeled, an evaluation index for the learning model cannot be calculated, and it is difficult to determine whether the learning model to be used is appropriate.

[0005] The present invention has been made in view of the above, and an object of the present invention is to improve the accuracy of a learning model that detects a sign of occurrence of an abnormality. [Means for Solving the Problem]

[0006] The present invention provides a detection device comprising: a collection unit that collects measurement data measured by a measuring device; a detection unit that inputs the collected measurement data to a trained learning model that predicts a predetermined event in response to the input of measurement data and obtains a detection result which is the output of the trained learning model; and an execution unit that, when the output result of the trained learning model differs from the determination result made by a user who has confirmed the measuring device in which the predetermined event was predicted, retrains the trained learning model using a label value input by the user and the collected measurement data to generate a retrained model.

[0007] Furthermore, the present invention provides a detection method in which a computer collects measurement data measured by a measuring device, inputs the collected measurement data into a trained model that predicts a predetermined event in response to the input of the measurement data, obtains the output result of the trained model, and if the detection result, which is the output of the trained model, differs from the judgment result made by a user who has confirmed the measuring device in which the predetermined event was predicted, the computer retrains the trained model using the label value input by the user and the collected measurement data to generate a retrained model.

[0008] Furthermore, the present invention provides a detection program that causes a computer to perform a process in which it collects measurement data measured by a measuring device, inputs the collected measurement data into a trained learning model that predicts a predetermined event in response to the input of the measurement data, obtains a detection result which is the output of the trained learning model, and if the output result of the trained learning model differs from the judgment result made by a user who has confirmed the measuring device in which the predetermined event was predicted, it retrains the trained learning model using the label value input by the user and the collected measurement data to generate a retrained model. [Effects of the Invention]

[0009] According to the present invention, there is an effect that the accuracy of the learning model can be improved. [Brief explanation of the drawing]

[0010] [Figure 1] This figure shows an example configuration and processing example of an anomaly prediction detection system according to the embodiment. [Figure 2] This is a block diagram showing an example of the configuration of each device in the abnormality prediction detection system according to the embodiment. [Figure 3] This is a diagram showing the detection result storage unit of the server device according to the embodiment. [Figure 4] This is a diagram showing the determination result storage unit of the server device according to the embodiment. [Figure 5] This is a diagram showing the evaluation index storage unit of the server device according to the embodiment. [Figure 6] This is a diagram showing the detection model storage unit of the server device according to the embodiment. [Figure 7] This figure shows an example of a detection model according to the present invention. [Figure 8] This figure shows a specific example 1 of the display screen of a worker terminal according to the embodiment. [Figure 9] This figure shows a specific example 2 of the display screen of a worker terminal according to the embodiment. [Figure 10] This figure shows a specific example 3 of the display screen of a worker terminal according to the embodiment. [Figure 11] This flowchart shows an example of the overall processing flow of the anomaly prediction detection system according to the embodiment. [Figure 12] This flowchart shows an example of the process flow for constructing a detection model for an anomaly prediction detection system according to the embodiment. [Figure 13] This flowchart shows an example of the abnormality prediction output processing flow of the abnormality prediction detection system according to the embodiment. [Figure 14] This figure shows an example of a hardware configuration according to the embodiment. [Modes for carrying out the invention]

[0011] Hereinafter, a detection device, a detection method, and a detection program according to an embodiment of the present invention will be described in detail with reference to the drawings. The present invention is not limited to the embodiments described below.

[0012] [Embodiment] Hereinafter, the configuration and processing of the anomaly sign detection system 100 according to the embodiment, the configuration and processing of each device of the anomaly sign detection system 100, and the flow of processing of the anomaly sign detection system 100 will be described in order, and finally the effects of the embodiment will be described.

[0013] [1. Configuration and Processing of Anomaly Sign Detection System 100] The configuration and processing of the anomaly sign detection system 100 according to the embodiment will be described in detail with reference to FIG. 1. FIG. 1 is a diagram showing a configuration example and a processing example of the anomaly sign detection system 100 according to the embodiment. Hereinafter, an overall configuration example of the anomaly sign detection system 100, an overall processing example of the anomaly sign detection system 100, and problems of the anomaly sign detection system 100P according to a reference technique will be described in order, and finally the effects of the anomaly sign detection system 100 will be described. In the embodiment, remote factory production monitoring using plant equipment, which is a device installed in a plant, is described as an example, but the device and field of application are not limited, and the present invention can also be applied to environmental measurement and remote monitoring such as power monitoring, wind power generation, water and sewage monitoring, and river monitoring.

[0014] (1-1. Overall Configuration Example of Anomaly Sign Detection System 100) An overall configuration example of the anomaly sign detection system 100 will be described with reference to FIG. 1. The anomaly sign detection system 100 includes a server device 10, a field device 20, and a worker terminal 30. Here, the server device 10, the field device 20, and the worker terminal 30 are communicably connected by wire or wirelessly via a predetermined communication network not shown. Various communication networks such as the Internet and dedicated lines can be employed as the predetermined communication network.

[0015] (1-1-1. Server Device 10) Server device 10 is a detection device installed in a cloud environment. Note that the anomaly prediction detection system 100 shown in Figure 1 may include multiple server devices 10. Furthermore, server devices 10 may be implemented in an on-premises environment, an edge environment, etc.

[0016] (1-1-2. Field Equipment 20) Field equipment 20 is plant equipment that makes up the plant. In the example in Figure 1, field equipment 20 is shown to be implemented by a Coriolis flow meter.

[0017] (1-1-3. Worker terminal 30) The worker terminal 30 is used by worker W, who performs maintenance, inspection, etc., of the plant and field equipment 20, and accepts operations from worker W. The worker terminal 30 can be implemented as, for example, a smartphone, a tablet, a desktop PC (Personal Computer), a notebook PC, a smartwatch, a mobile phone, or a PDA (Personal Digital Assistant). In the example in Figure 1, the worker terminal 30 is implemented as a smartphone.

[0018] (1-2. Example of the overall processing of the anomaly prediction detection system 100) Figure 1 illustrates an example of the overall processing of the anomaly prediction detection system 100. Note that the processes in steps S1 to S11 below can be executed in a different order. Also, some of the processes in steps S1 to S11 below may be omitted.

[0019] (1-2-1. Measurement data acquisition process) The field device 20 acquires measurement data (step S1). For example, the field device 20 acquires sensor data such as phase difference data, frequency data, temperature data, drive current data, fluid pressure data, and density data as measurement data.

[0020] (1-2-2. Measurement data transmission process) The field device 20 transmits measurement data to the server device 10 (step S2). For example, the field device 20 transmits sensor data such as phase difference data, frequency data, temperature data, drive current data, fluid pressure data, and density data to the server device 10 as acquired measurement data.

[0021] (1-2-3. Anomaly Prediction Detection Process) The server device 10 detects signs of plant abnormalities (or, as appropriate, "anomalies") from the measurement data (step S3). For example, the server device 10 detects signs of plant abnormalities using a trained detection model DM, which is an unsupervised learning model that outputs signs of plant abnormalities in response to the input of measurement data.

[0022] Here, an abnormality warning is a state in which there is a possibility of an abnormal condition occurring, which has a negative impact on the plant, such as equipment failure or abnormal values. In addition to the abnormality warnings mentioned above, the server device 10 can also detect periods of normal conditions, improvement warnings that indicate the transition from an abnormal state to a normal state, and other such indicators.

[0023] Furthermore, the server device 10 may detect anomaly signs using one detection model DM, or it may detect anomaly signs using multiple detection models DM.

[0024] (1-2-4. Detection result transmission process) The server device 10 transmits the detection results to the worker terminal 30 (step S4). For example, the server device 10 transmits the detection results, such as the plant abnormality prediction, the detection time, and the identification information of the detected field device 20, to the worker terminal 30.

[0025] (1-2-5. Alert notification processing) The worker terminal 30 notifies worker W of an alert (step S5). For example, when the worker terminal 30 receives a detection result from the server device 10, it displays the plant abnormality indication, detection time, identification information of the detected field device 20, etc. on the monitor screen, prompting worker W to check for any abnormality indications in the plant.

[0026] (1-2-6. Detection result determination process) Operator W determines the truthfulness of the detection result (step S6). For example, Operator W visually checks for the presence or absence of abnormal signs in the field device 20 notified as a detection result and determines the truthfulness of the detection result. At this time, for example, if the field device 20 is a Coriolis flow meter, Operator W determines that the abnormal sign is "true" if the fluid being measured contains slug that is not found in normal conditions, and determines that the abnormal sign is "false" if no difference from the normal condition is observed.

[0027] (1-2-7. Inputting the judgment result) Worker W inputs the judgment result into the worker terminal 30 (step S7). For example, worker W inputs the truth or falsity of the detection result by operating the input screen displayed on the monitor screen of the worker terminal 30.

[0028] (1-2-8. Processing to send judgment results) The worker terminal 30 transmits the judgment result to the server device 10 (step S8). For example, the worker terminal 30 transmits the truth value of each detection result entered by worker W to the server device 10 as the judgment result.

[0029] (1-2-9. Evaluation Metric Calculation Process) The server device 10 calculates evaluation metrics from the judgment results (step S9). For example, the server device 10 calculates evaluation metrics for each detection model DM within a predetermined period and transmits the calculated evaluation metrics to the operator terminal 30. Here, the evaluation metrics are numerical values ​​that indicate the accuracy of the machine learning model, such as accuracy, precision, recall, specificity, F-score, etc.

[0030] Furthermore, the server device 10 generates a time-series graph showing output data, measurement data, etc., of abnormality predictions within a predetermined period for each detection model DM, and transmits the generated time-series graph to the operator terminal 30.

[0031] (1-2-10. Model retraining process) The server device 10 retrains the detection model DM (step S10). For example, the server device 10 retrains the detection model DM that has been determined to have an untrue detection result from among multiple detection models DM using measurement data and updates various parameters. At this time, if the evaluation index of the detection model DM is below a predetermined value, the server device 10 may retrain the detection model DM using measurement data and update various parameters.

[0032] (1-2-11. Model determination process) The server device 10 determines the detection model DM (step S11). For example, if the evaluation index of multiple detection model DMs is above a predetermined value, the server device 10 determines that detection model DM to be used in subsequent anomaly prediction processing, for example, the model that detects anomalies in Figure 13 described later (as appropriate, the "adopted model"). At this time, the server device 10 may determine one or more detection model DMs from among the multiple detection model DMs whose evaluation index is above a predetermined value as the adopted model. Also, if there are multiple detection model DMs that have been determined as adopted models, the server device 10 may notify the worker W of all the detection results, which are the outputs of the multiple detection model DMs, in the anomaly prediction detection processing and detection result transmission processing in Figure 13, or it may notify the worker W of only the detection result, which is the output of the detection model DM with the highest evaluation index among the multiple detection model DMs.

[0033] Furthermore, the server device 10 may decide to adopt one or more detection models DM selected by the worker W from among multiple detection models DM based on evaluation indicators and time-series graphs.

[0034] (1-3. Effects of the Anomaly Prediction Detection System 100) The following section will describe the overview and problems of the anomaly prediction detection system 100P related to the reference technology, and then explain the effects of the anomaly prediction detection system 100.

[0035] (1-3-1. Overview of the Anomaly Prediction Detection System 100P) The anomaly prediction detection system 100P, which is based on the reference technology, performs the following processes. First, the anomaly prediction detection system 100P performs unsupervised learning based on pre-collected normal data to extract features of the normal data and store them as a normal state model. Second, the anomaly prediction detection system 100P dynamically detects a normal judgment criterion value that allows the input data to be considered normal, based on the unknown input data and the normal state model. Third, the anomaly prediction detection system 100P calculates a judgment value for determining anomalies in the input data, based on the input data and the normal state model. Fourth, the anomaly prediction detection system 100P detects anomalies in the input data by detecting an abnormal state that deviates from the normal state based on the normal judgment criterion value and the judgment value.

[0036] (1-3-2. Problems with the Anomaly Prediction Detection System 100P) The Anomaly Prediction Detection System 100P, which is a reference technology, has the following problems. Firstly, in the Anomaly Prediction Detection System 100P, the pre-collected data is not labeled, making it impossible to calculate evaluation metrics for the machine learning model. Secondly, in the Anomaly Prediction Detection System 100P, the machine learning model cannot be easily changed in the initial stages of implementation, so a lot of time is required to consider the machine learning model before introducing it to the plant.

[0037] (1-3-3. Overview of the Anomaly Prediction Detection System 100) In the anomaly prediction detection system 100 according to the embodiment, the following processes are performed. First, the server device 10 collects measurement data transmitted by the field device 20 and detects anomalies in the plant by inputting the measurement data into the detection model DM. At this time, the server device 10 prepares multiple unsupervised learning models obtained in advance from a training dataset, learns time-series data for retraining the models based on the obtained trained models, and notifies the worker W of the outputted anomaly prediction. Second, the server device 10 receives the judgment result for the detection result input by the worker W. At this time, when an anomaly prediction is notified, the worker W inputs whether the above anomaly prediction, i.e., the feeling of unease, is correct (true anomaly: true positive, false anomaly: false positive) using an application on the worker terminal 30 such as a smartphone or PC. Here, "true positive" means that an anomaly prediction is detected by the server device 10 (feeling of unease), and the worker W confirms the anomaly prediction (feeling of unease: correct). Furthermore, a "false positive" refers to a situation where the server device 10 detects an abnormality (something feels off), but worker W fails to confirm the abnormality (something feels off: incorrect).

[0038] (1-3-4. Effects of the Anomaly Prediction Detection System 100) The anomaly prediction detection system 100 has the following advantages. Firstly, by calculating evaluation indicators, the anomaly prediction detection system 100 can compare which of multiple detection models DM is preferable, allowing for the selection of an appropriate trained detection model DM even when changes occur in the normal range or work process. Secondly, the anomaly prediction detection system 100 can use multiple detection models DM simultaneously to detect anomalies and update the detection models DM by comparing them with on-site judgment results from the worker W, eliminating the need for thorough review before introduction into the plant.

[0039] As described above, the anomaly prediction detection system 100 can update the detection model DM obtained through unsupervised learning to construct an optimal detection model DM, thereby improving the accuracy of the detection model DM for detecting anomalies in the plant. Furthermore, the anomaly prediction detection system 100 can select the optimal model from among multiple models.

[0040] Furthermore, the Anomaly Prediction Detection System 100 has the following advantages: The Anomaly Prediction Detection System 100 is easy and intuitive to operate by worker W, making it easy for plant users to introduce the Anomaly Prediction Detection System 100 into their plants. In addition, while selecting a learning model requires a lot of domain knowledge and rules of thumb, and this knowledge and rules of thumb are required from the vendor of the learning model, the Anomaly Prediction Detection System 100 uses on-site data from the plant user as the basis for model selection, so the plant user can keep their data and domain knowledge confidential from the vendor. Also, while changes in work processes or the introduction of different equipment require changes to the learning model, the Anomaly Prediction Detection System 100 allows the learning model to be rebuilt by performing the same work, so the plant user does not need to consult with the vendor again to rebuild the learning model. In addition, the Anomaly Prediction Detection System 100 can model the basis for judgments made by experienced workers regarding what constitutes an anomaly, so it can be used to address the shortage of successors and to educate less experienced workers W. Furthermore, with the anomaly prediction detection system 100, the vendor does not need to consult on or provide anomaly prediction detection solutions tailored to the application or plant users, thus enabling the solution to be made more generalized.

[0041] [2. Configuration and Processing of Each Device in the Anomaly Prediction Detection System 100] Using Figure 2, the configuration and processing of each device in the anomaly prediction detection system 100 shown in Figure 1 will be explained. Figure 2 is a block diagram showing an example configuration of each device in the anomaly prediction detection system 100 according to the embodiment. Below, an example configuration of the entire anomaly prediction detection system 100 according to the embodiment will be explained, followed by a detailed explanation of the configuration and processing examples of the server device 10, the field device 20, and the worker terminal 30 according to the embodiment.

[0042] (2-1. Example of the overall configuration of the anomaly prediction detection system 100) Using Figure 2, an example of the overall configuration of the anomaly prediction detection system 100 shown in Figure 1 will be explained. As shown in Figure 2, the anomaly prediction detection system 100 includes a server device 10, field devices 20, and worker terminals 30. The server device 10 is connected to the field devices 20 and worker terminals 30 via a communication network N, which is implemented via the internet or a dedicated line. The server device 10 is installed in a cloud environment. The field devices 20 are installed in the plant. The server device 10 may also be installed in an on-premise environment, an edge environment, etc.

[0043] (2-2. Example configuration and processing of server device 10) Using Figure 2, an example of the configuration and processing of the server device 10 will be described. The server device 10 has an input unit 11, an output unit 12, a communication unit 13, a storage unit 14, and a control unit 15. The following describes an example of the configuration and processing of the server device 10, but the field device 20 can also perform similar processing. In other words, the anomaly prediction detection system 100 can be realized with only the field device 20.

[0044] (2-2-1. Input section 11) The input unit 11 is responsible for inputting various types of information to the server device 10. For example, the input unit 11 can be implemented using a mouse or keyboard, and it accepts various types of information input to the server device 10.

[0045] (2-2-2. Output section 12) The output unit 12 is responsible for outputting various types of information from the server device 10. For example, the output unit 12 is implemented as a display or the like and displays various types of information stored in the server device 10.

[0046] (2-2-3. Communications Section 13) The communication unit 13 is responsible for data communication with other devices. For example, the communication unit 13 communicates data with each communication device via a router or the like. The communication unit 13 can also communicate data with an operator's terminal (not shown).

[0047] (2-2-4. Storage section 14) The storage unit 14 stores various information that the control unit 15 refers to when it operates, and various information acquired when the control unit 15 operates. The storage unit 14 includes a detection result storage unit 14a, a judgment result storage unit 14b, an evaluation index storage unit 14c, and a detection model storage unit 14d. Here, the storage unit 14 can be implemented as, for example, a semiconductor memory element such as RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or optical disc. In the example in Figure 2, the storage unit 14 is installed inside the server device 10, but it may be installed outside the server device 10, or multiple storage units may be installed.

[0048] (2-2-4-1. Detection result storage unit 14a) The detection result storage unit 14a stores the detection results. For example, the detection result storage unit 14a stores the detection results detected by the detection unit 15b of the control unit 15, which will be described later. Here, an example of the data stored by the detection result storage unit 14a will be explained using Figure 3. Figure 3 is a diagram showing an example of the detection result storage unit 14a of the server device 10 according to the embodiment. In the example in Figure 3, the detection result storage unit 14a has items such as "plant", "detection result", "detection model", "detection time", and "field device".

[0049] "Plant" refers to identification information for identifying the plant being monitored, such as the plant's identification number or identification code. "Detection Result" refers to identification information for identifying the detection result, such as the identification number or identification code of the anomaly prediction detected by the detection unit 15b. "Detection Model" refers to identification information for identifying the machine learning model, such as the identification number or identification code of the detection model DM that output the anomaly prediction. "Detection Time" refers to the time the detection result was detected, such as year, month, day, hour, minute, and second. "Field Device" refers to identification information for identifying the field device 20 that acquired the measurement data, such as the device name, model number, or other identification number or identification code of the field device 20.

[0050] In other words, Figure 3 shows an example in which, for a plant identified by "Plant PS001", the following data is stored in the detection result storage unit 14a: "Detection Result #1" is {Detection Model: "Detection Model DM001", Detection Time: "10:10:00", Field Device: "FI001"}, "Detection Result #2" is {Detection Model: "Detection Model DM002", Detection Time: "10:10:00", Field Device: "FI001"}, "Detection Result #3" is {Detection Model: "Detection Model DM003", Detection Time: "14:30:00", Field Device: "FI001"}, ...

[0051] (2-2-4-2. Judgment result storage unit 14b) The judgment result storage unit 14b stores the judgment result. For example, the judgment result storage unit 14b stores the judgment result input by the worker W and transmitted from the worker terminal 30. Here, an example of the data stored by the judgment result storage unit 14b will be explained using Figure 4. Figure 4 is a diagram showing an example of the judgment result storage unit 14b of the server device 10 according to the embodiment. In the example in Figure 4, the judgment result storage unit 14b has items such as "plant", "detection result", and "judgment result".

[0052] "Plant" refers to identification information used to identify the plant being monitored, such as the plant's identification number or identification code. "Detection Result" refers to identification information used to identify the detection result, such as the identification number or identification code of the abnormality indicator detected by the detection unit 15b. "Judgment Result" refers to the judgment result corresponding to the detection result, such as the judgment of whether the abnormality indicator was true or false as confirmed by the worker W.

[0053] In other words, Figure 4 shows an example in which, for a plant identified by "Plant PS001", the determination result storage unit 14b stores data such that the determination of whether an abnormality indicator corresponding to "Detection Result #1" is "Determination Result #1", the determination of whether an abnormality indicator corresponding to "Detection Result #2" is "Determination Result #2", the determination of whether an abnormality indicator corresponding to "Detection Result #3" is "Determination Result #3", and so on.

[0054] (2-2-4-3. Evaluation Index Storage Unit 14c) The evaluation index storage unit 14c stores evaluation indices. For example, the evaluation index storage unit 14c stores evaluation indices for each detection model DM calculated by the execution unit 15c of the control unit 15, which will be described later. Here, an example of the data stored by the evaluation index storage unit 14c will be explained using Figure 5. Figure 5 is a diagram showing an example of the evaluation index storage unit 14c of the server device 10 according to the embodiment. In the example in Figure 5, the evaluation index storage unit 14c has items such as "detection model", "evaluation index", and "calculation time".

[0055] "Detection Model" refers to identification information used to identify the learning model, such as the identification number or symbol of the detection model DM that output anomaly predictions. "Evaluation Metric" refers to an evaluation metric that is a numerical value indicating the accuracy of the learning model, such as the accuracy, precision, recall, specificity, and F-score of the detection model DM. "Calculation Time" indicates the time when the evaluation metric was calculated, for example, expressed as year, month, day, hour, minute, and second.

[0056] In other words, Figure 5 shows an example in which data is stored in the evaluation index storage unit 14c, with the following characteristics: for the detection model DM identified by "detection model DM001", {evaluation index 1 (accuracy): "80%", evaluation index 2 (precision): "75%", calculation time: "10:30:00", ...}; for the detection model DM identified by "detection model DM002", {evaluation index 1 (accuracy): "75%", evaluation index 2 (precision): "70%", calculation time: "10:30:00", ...}; and for the detection model DM identified by "detection model DM003", {evaluation index 1 (accuracy): "90%", evaluation index 2 (precision): "85%", calculation time: "15:00:00", ...}.

[0057] (2-2-4-4. Detection model storage unit 14d) The detection model storage unit 14d stores the detection model DM. For example, the detection model storage unit 14d stores the detection model DM used by the detection unit 15b of the control unit 15, which will be described later. Here, an example of the data stored by the detection model storage unit 14d will be explained using Figure 6. Figure 6 is a diagram showing an example of the detection model storage unit 14d of the server device 10 according to the embodiment. In the example in Figure 6, the detection model storage unit 14d has an item such as "detection model".

[0058] A "detection model" is model data for a machine learning model, and includes data such as model parameters and hyperparameters, which are execution data for running the algorithm of a detection model DM.

[0059] In other words, Figure 6 shows an example in which the detection model storage unit 14d stores data such as "detection model DM001", "detection model DM002", "detection model DM003", etc., as model data for the detection model DM used by the detection unit 15b.

[0060] Here, using Figure 7, we will explain a specific example of a detection model DM in binary classification, where measurement data collected from a Coriolis flow meter is used as input data and anomaly prediction data is used as output data. Note that while Figure 7 uses an example of a detection model DM using a neural network, it could also use an isolation forest or a one-class SVM (Support-Vector Machine), and is not particularly limited to these.

[0061] In the example shown in Figure 7, the detection model DM receives sensor data such as phase difference data, frequency data, temperature data, drive current data, fluid pressure data, and density data in the input layer, performs analysis of the received sensor data in the intermediate layer, and outputs anomaly prediction data such as "anomaly detected" or "no anomaly detected" in the output layer.

[0062] The detection model DM is constructed using a learning model that learns normal data through unsupervised learning of Hotelling's T2 theory, local outlier factor analysis, neural networks such as autoencoders, self-organizing maps, one-class support vector machines, classification trees such as isolation forests, change point detection, k-nearest neighbors, k-means clustering, and density-referenced clustering, and outputs results that classify different behaviors as anomaly predictions, i.e., abnormalities. Furthermore, the detection model DM uses one or more of the sensor data obtained inside the field device 20 in its input layer.

[0063] (2-2-5. Control Unit 15) Returning to Figure 2, the control unit 15 is responsible for controlling the entire server device 10. The control unit 15 includes an acquisition unit 15a, a detection unit 15b, and an execution unit 15c. Here, the control unit 15 can be implemented by, for example, an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0064] (2-2-5-1. Collection Section 15a) The collection unit 15a collects various types of information. The collection unit 15a may also store the collected information in the storage unit 14. For example, the collection unit 15a collects measurement data measured by a measuring device.

[0065] To give a specific example, the collection unit 15a collects measurement data transmitted by the field instrument 20, which is a Coriolis flow meter, in chronological order, such as "measurement data 001" {phase difference data: "phase difference data 001", frequency data: "frequency data 001", temperature data: "temperature data 001", drive current data: "drive current data 001", fluid pressure data: "fluid pressure data 001", density data: "density data 001"}, "measurement data 002" {phase difference data: "phase difference data 002", frequency data: "frequency data 002", temperature data: "temperature data 002", drive current data: "drive current data 002", fluid pressure data: "fluid pressure data 002", density data: "density data 002"}, ...

[0066] (2-2-5-2. Detection unit 15b) The detection unit 15b performs processing related to the detection result. The detection unit 15b stores various information in the storage unit 14. The detection unit 15b also retrieves the various information stored in the storage unit 14. Furthermore, the detection unit 15b retrieves the various information collected by the collection unit 15a. The event prediction detection process and the detection result transmission process will be described below.

[0067] (Event prediction and detection processing) The detection unit 15b acquires the output result of the detection model DM and detects the prediction of an event. The detection unit 15b stores the detection result in the detection result storage unit 14a. For example, the detection unit 15b inputs the collected measurement data into the detection model DM, which is a trained model that predicts a predetermined event in response to the input measurement data, acquires the detection result which is the output of the trained detection model DM, and detects this detection result as the prediction of an event. In addition, the detection unit 15b acquires the detection result which is the output of each of multiple trained detection models DM that predict a predetermined event, and detects this detection result as the prediction of an event.

[0068] Here, the trained detection model DM is a learned model trained through unsupervised learning, using each measurement data point that represents a normal value from among multiple measurement data points collected over a predetermined period as training data.

[0069] Furthermore, event predictions include "anomaly predictions," which are precursors to abnormal states of the monitored object; "normality predictions," which are precursors to normal states of the monitored object; and "improvement predictions," which are precursors to the improvement of the monitored object, i.e., the intermediate state in which it is transitioning from an abnormal state to a normal state.

[0070] The detection unit 15b, as an "anomaly prediction," detects signs of abnormal conditions such as "anomaly detected" based on measurement data acquired by the plant's field equipment 20, which correspond to signs of failure or abnormal values ​​in the field equipment 20. At this time, the detection unit 15b may also detect signs of normal conditions, such as "no abnormality detected," which is described later.

[0071] Furthermore, the detection unit 15b can also detect signs of a normal state, such as "normal signs" indicating that the field equipment 20 will transition to normal operation in the future, based on measurement data acquired by the field equipment 20 of the plant, as a "normal prediction."

[0072] Furthermore, the detection unit 15b can also detect signs of improvement, such as "signs of improvement present," based on measurement data acquired by the plant's field equipment 20, indicating a transition from the current abnormal or abnormal warning state of the field equipment 20 to an improvement in future abnormal values. At this time, the detection unit 15b may also detect that there are no signs of improvement, such as "no signs of improvement present."

[0073] To give a specific example, the detection unit 15b receives "Measurement Data 001" {Phase difference data: "Phase difference data 001", Frequency data: "Frequency data 001", Temperature data: "Temperature data 001", Drive current data: "Drive current data 001", Fluid pressure data: "Fluid pressure data 001", Density data: "Density data 001"} as input data for each of the "Detection Model DM001", "Detection Model DM002", and "Detection Model DM003", respectively, which are measurement data collected from the field device 20, which is a Coriolis flow meter. The output data obtained is {Detection Model DM001: "Anomaly detected", Detection Model DM002: "Anomaly detected", Detection Model DM003: "No anomaly detected"}. Furthermore, the detection unit 15b receives "Measurement Data 002" {Phase difference data: "Phase difference data 002", Frequency data: "Frequency data 002", Temperature data: "Temperature data 002", Drive current data: "Drive current data 002", Fluid pressure data: "Fluid pressure data 002", Density data: "Density data 002"} as input data for each of the "Detection Model DM001", "Detection Model DM002", and "Detection Model DM003", respectively, which is measurement data collected from the field instrument 20, which is a Coriolis flow meter, and obtains {Detection Model DM001: "No abnormality warning", Detection Model DM002: "No abnormality warning", Detection Model DM003: "Abnormality warning"} as output data.

[0074] (Detection result transmission process) When the detection unit 15b acquires the output result of the detection model DM, it transmits the acquired output result as the detection result to the terminal used by the user and notifies the user of the detection result.

[0075] The detection unit 15b notifies the user if the output result of the trained detection model DM corresponds to a sign of an abnormal condition. For example, if the detection unit 15b detects an abnormality prediction based on measurement data acquired by the plant's field equipment 20, it sends the detection result regarding the abnormality prediction to the worker terminal 30 and notifies the plant worker W by displaying the detection result, such as "Sign of abnormality detected."

[0076] Furthermore, the detection unit 15b notifies the user if the output result of the trained detection model DM corresponds to an indication of a normal state. For example, when the detection unit 15b detects a normal prediction based on the measurement data acquired by the plant's field equipment 20, it transmits the detection result related to the normal prediction to the worker terminal 30 and notifies the plant worker W by displaying the detection result, such as "indication of normal state."

[0077] Furthermore, the detection unit 15b notifies the user if the output result of the trained detection model DM corresponds to an indication of improvement. For example, if the detection unit 15b detects an improvement prediction based on the measurement data acquired by the plant's field equipment 20, it transmits the detection result regarding the improvement prediction to the worker terminal 30 and notifies the plant worker W by displaying the detection result, such as "Indicators of improvement detected."

[0078] To give a specific example, the detection unit 15b transmits the detection results of "Detection Model DM001" {Detection Result: "Detection Result #1", Detection Time: "10:10:00", Field Device: "FI001"}, "Detection Model DM002" {Detection Result: "Detection Result #2", Detection Time: "10:10:00", Field Device: "FI001"}, and "Detection Model DM003" {Detection Result: "Detection Result #3", Detection Time: "14:30:00", Field Device: "FI001"} to the worker terminal 30 used by the plant worker W, and displays them on the input / output unit 31, which is the monitor screen of the worker terminal 30.

[0079] (2-2-5-3. Execution section 15c) The execution unit 15c performs processing related to the adoption or retraining of the detection model DM. The execution unit 15c also acquires various information stored in the storage unit 14. Furthermore, the execution unit 15c acquires various information collected by the collection unit 15a. Furthermore, the execution unit 15c acquires various information output by the detection unit 15b. The following describes the retraining execution process, score calculation process, time series graph generation process, and detection model determination.

[0080] (Retraining execution process) The execution unit 15c retrains the trained detection model DM using the label values ​​input by the worker W and the collected measurement data if the detection result of the trained learning model, detection model DM, differs from the judgment result made by the user, worker W, who confirmed the device in which a predetermined event was predicted. The execution unit 15c also retrains the trained detection model DM using supervised learning, where the collected measurement data is assigned label values ​​based on the judgment result as training data. Furthermore, if the detection result, which is the output of the trained learning model, corresponds to a sign of an abnormal state, and the worker W has not confirmed an abnormal state or sign of an abnormal state in the measuring device, the execution unit 15c retrains the trained detection model DM using training data in which the collected measurement data is assigned label values ​​indicating the presence or absence of an abnormal state or sign of an abnormal state based on the judgment result.

[0081] To give a specific example, the execution unit 15c inputs "measurement data 001" collected from the field device 20, which is a Coriolis flow meter, as input data to "detection model DM002," and obtains {detection model DM002: "abnormality detected"} as output data. If the output data is a false positive that differs from the judgment result entered by the worker W, the execution unit 15c retrains "detection model DM002" using training data that has been assigned the label value "no abnormality detected" to the "measurement data 001" used in the above process, and updates the model parameters and hyperparameters.

[0082] Furthermore, the execution unit 15c retrains the trained detection model DM based on the evaluation metrics. For example, the execution unit 15c retrains the trained detection model DM if the evaluation metrics are below a predetermined value.

[0083] To give a specific example, the execution unit 15c calculates precision as an evaluation index for the "detection model DM002" through the evaluation index calculation process described later. If the precision is less than "75%", it retrains the "detection model DM002" using the "measurement data 001" used in the above process as training data, and updates the model parameters and hyperparameters.

[0084] (Evaluation indicator calculation process) The execution unit 15c calculates evaluation metrics for the trained detection model DM based on the output results of the trained detection model DM and the judgment results of the worker W who confirmed the measuring device in which a predetermined event was predicted. The execution unit 15c also calculates at least one of the following evaluation metrics: accuracy, precision, recall, specificity, and F-score, based on the detection results of each of the multiple trained detection models DM and the judgment results of the worker W who confirmed the device in which a predetermined event was predicted. The execution unit 15c also displays the calculated evaluation metrics on the worker terminal 30 used by the worker W.

[0085] The execution unit 15c calculates evaluation indicators such as accuracy, precision, recall, specificity, and F-score within a predetermined period. For example, the execution unit 15c calculates precision as an evaluation indicator for detection model DM that outputs only "abnormality detected" (positive), calculates accuracy, recall, and F-score as evaluation indicators for detection model DM that outputs both "abnormality detected" (positive) and "abnormality not detected" (negative), and calculates specificity as an evaluation indicator for detection model DM that outputs only "abnormality not detected" (negative).

[0086] In the following, the evaluation indicators calculated by the execution unit 15c will be explained in the following order: accuracy, precision, recall, specificity, and F-score. In the following explanation of each evaluation indicator, the detection of the existence of a predetermined event such as an anomaly warning by the detection unit 15b is defined as "positive," the detection of the absence of a predetermined event by the detection unit 15b is defined as "negative," the determination that the existence of a predetermined event is correct by the operator W is defined as "true positive," the determination that the existence of a predetermined event is incorrect by the operator W is defined as "false positive," the determination that the absence of a predetermined event is correct by the operator W is defined as "true negative," and the determination that the absence of a predetermined event is incorrect by the operator W is defined as "false negative."

[0087] (Accuracy rate) The execution unit 15c calculates "90%" as the evaluation index for "Detection Model DM003" if, out of 200 output results of "Anomaly Prediction Present" and "No Anomaly Prediction" from "Detection Model DM003", 85 were true positives, 15 were false positives, 75 were true negatives, and 25 were false negatives. The accuracy rate is calculated as follows: Accuracy = (True Positive + True Negative) / (True Positive + False Positive + True Negative + False Negative) = 85 + 75 / 200 = 0.90.

[0088] (precision rate) The execution unit 15c calculates "85%" as the evaluation index for "Detection Model DM003" if, out of 100 output results of "Anomaly Prediction Found" from "Detection Model DM003", 85 were true positives and 15 were false positives, then the precision = (True Positives) / (True Positives + False Positives) = 85 / 100 = 0.85.

[0089] (recall rate) The execution unit 15c calculates "78%" as the evaluation index for "Detection Model DM002" if, out of 200 output results of "Anomaly Prediction Present" and "No Anomaly Prediction" from "Detection Model DM002", 70 were true positives, 30 were false positives, 80 were true negatives, and 20 were false negatives. The recall rate is calculated as (True Positive) / (True Positive + False Negative) = 70 / 70 + 20 = 0.777.

[0090] (specificity) The execution unit 15c calculates "85%" as the evaluation index for "Detection Model DM001" if, out of 100 output results of "No abnormality warnings" from "Detection Model DM001", 85 were true negatives and 15 were false negatives, then the specificity = (True negatives) / (True negatives + False negatives) = 85 / 100 = 0.85.

[0091] (F-number) The execution unit 15c calculates "74%" as the evaluation index for "Detection Model DM002" if, out of 200 output results of "Anomaly Prediction Present" and "No Anomaly Prediction" from "Detection Model DM002", 70 were true positives, 30 were false positives, 80 were true negatives, and 20 were false negatives. The F-value (β=1) = (True Positive) / {True Positive + (False Positive + False Negative) / 2} = 70 / {70 + (30 + 20) / 2} = 0.736.

[0092] (Time-series graph generation process) The execution unit 15c generates time-series graphs showing the output results of each of the multiple trained detection models DM, as well as the history of the collected measurement data. The execution unit 15c also displays the evaluation indicators and time-series graphs on the worker terminal 30 used by the worker W.

[0093] To give a specific example, the execution unit 15c generates a time-series graph of the "detection model DM001" by displaying the "measurement data 001", "measurement data 002", "measurement data 003", etc., collected from the field device 20, which is a Coriolis flow meter, as a line graph, and also displays the detection time when the "detection model DM001" output "anomaly detected" in color. The generated time-series graph data is then transmitted to the operator terminal 30, and the time-series graph is displayed on the input / output unit 31, which is the monitor screen of the operator terminal 30.

[0094] Furthermore, the execution unit 15c generates a screen (normal state screen) showing the normal state, which is the detection result. The execution unit 15c also displays the generated screen on the worker terminal 30 used by the worker W, in a form that can be switched on or off by the worker W's operation.

[0095] To give a specific example, the execution unit 15c generates a time-series graph showing the current or future normal operation of the field device 20, which is a Coriolis flow meter, as the normal state screen for the "detection model DM001". The generated time-series graph data is transmitted to the operator terminal 30, and the time-series graph is displayed on the input / output unit 31, which is the monitor screen of the operator terminal 30. At this time, the execution unit 15c may also generate time-series graph data that includes buttons such as "Normal state notification ON" and "Normal state notification OFF", and display it on the operator terminal 30 so that the operator W can switch the display or hiding of the normal state screen.

[0096] (Model determination process) The execution unit 15c decides to adopt a trained detection model DM from among multiple trained detection models DM whose evaluation index is equal to or greater than a predetermined value. The execution unit 15c also decides to adopt a trained detection model DM selected by the operator W from among multiple trained detection models DM.

[0097] To give a specific example, if the evaluation index for "Detection Model DM001" is "80%", the evaluation index for "Detection Model DM002" is "75%", and the evaluation index for "Detection Model DM003" is "85%", and the criterion value for adopting the evaluation index is set to "80%", then the execution unit 15c will decide that "Detection Model DM001" and "Detection Model DM003" are the models to be adopted and will use them in the processing of the detection unit 15b thereafter.

[0098] Furthermore, the execution unit 15c displays the evaluation indicators for "Detection Model DM001," "Detection Model DM002," and "Detection Model DM003," as well as time-series graphs of "Detection Model DM001," "Detection Model DM002," and "Detection Model DM003," on the operator terminal 30. If the operator W selects "Detection Model DM001" on the display screen, "Detection Model DM003" is determined as the adopted model and used in the processing of the detection unit 15b thereafter.

[0099] (2-3. Example configuration and processing of field device 20) Using Figure 2, an example of the configuration and processing of the field device 20 will be explained. The field device 20 is a sensor device such as a thermometer, pressure gauge, or flow meter, and has an acquisition unit 21 and a communication unit 22.

[0100] (2-3-1. Acquisition part 21) The acquisition unit 21 acquires measurement data. For example, the acquisition unit 21 acquires sensor data such as phase difference data, frequency data, temperature data, drive current data, fluid pressure data, and density data as measurement data. Here, measurement data includes sensor data acquired from each sensor, or calculated data secondarily calculated from sensor data. For example, if the field device 20 is a Coriolis flow meter, the acquisition unit 21 processes and outputs mass flow data, density data, etc., but in the calculation process, it measures or calculates temperature data, phase difference data, frequency data, drive current data, fluid pressure data, etc.

[0101] (2-3-2. Communications Section 22) The communication unit 22 is responsible for data communication with other devices. For example, the communication unit 22 performs data communication with various communication devices via a router or the like. The communication unit 22 can also perform data communication with an operator's terminal (not shown).

[0102] (2-4. Example configuration and processing of the worker terminal 30) Using Figure 2, an example of the configuration and processing of the worker terminal 30 will be explained. The worker terminal 30 is a terminal used by worker W who performs maintenance, inspection, etc. of the plant and field equipment 20, and has an input / output unit 31, a transmitting / receiving unit 32, and a communication unit 33.

[0103] (2-4-1. Input / output section 31) The input / output unit 31 is responsible for inputting various types of information to the worker terminal 30. For example, the input / output unit 31 can be implemented as a mouse, keyboard, touch panel, etc., and accepts input such as setting information to the worker terminal 30. The input / output unit 31 also displays various types of information from the worker terminal 30. For example, the input / output unit 31 can be implemented as a display, etc., and displays setting information etc. stored in the worker terminal 30.

[0104] The input / output unit 31 displays a confirmation result input screen where the worker W inputs the judgment result. Details of the confirmation result input screen will be described later in (2-4-4. Specific Example 1 of the Display Screen of the Worker Terminal 30). The input / output unit 31 also displays a detection model determination screen that allows the worker W to select a detection model DM. Details of the detection model determination screen will be described later in (2-4-5. Specific Example 2 of the Display Screen of the Worker Terminal 30) and (2-4-6. Specific Example 3 of the Display Screen of the Worker Terminal 30).

[0105] (2-4-2. Transceiver Unit 32) The transmitting / receiving unit 32 transmits various types of information. For example, the transmitting / receiving unit 32 transmits the judgment result entered by the worker W on the confirmation result input screen to the server device 10. The transmitting / receiving unit 32 also transmits the identification information of the detection model DM selected by the worker W on the detection model determination screen to the server device 10.

[0106] The transmitting / receiving unit 32 receives various types of information. For example, the transmitting / receiving unit 32 receives detection results, evaluation indicators, time-series graphs, etc., from the server device 10 to be notified to the worker W.

[0107] (2-4-3. Communications Section 33) The communication unit 33 is responsible for data communication with other devices. For example, the communication unit 33 communicates data with each communication device via a router or the like. The communication unit 33 can also communicate data with an operator's terminal (not shown).

[0108] (2-4-4. Specific example of the display screen of the worker terminal 30) Here, using Figure 8, we will describe a specific example 1 of the display screen output by the input / output unit 31 of the worker terminal 30. Figure 8 is a diagram showing a specific example 1 of the display screen of the worker terminal 30 according to the embodiment. Below, we will describe the "detection result judgment screen" displayed on the "anomaly detection system confirmation result input screen".

[0109] (2-4-4-1. Detection result determination screen) As shown in the example in Figure 8, the worker terminal 30 displays "Detection Result," "Detection Time," "Field Equipment," and "Judgment" for each plant. In the example in Figure 8, the worker terminal 30 displays that for "Detection Result #1," the detection time of the abnormality, which is a precursor to an anomaly, was "10:10:00," the field equipment 20 that transmitted the measurement data was "FI001," and checkboxes are displayed for inputting whether "Detection Result #1" is true or false. At this time, if the worker W confirms the result of "Detection Result #1" at the plant site and it is the same as the detection result, "True," the worker W inputs the judgment result by clicking the "True" checkbox in "Judgment." Similarly, if the worker W confirms the result of "Detection Result #2" at the plant site and it is different from the detection result, "False," the worker W inputs the judgment result by clicking the "False" checkbox in "Judgment." If the result of "Detection Result #3" confirms it at the plant site and it is "True," the worker W inputs the judgment result by clicking the "True" checkbox in "Judgment." Then, once worker W has entered all the judgment results, they can send the judgment results to the server device 10 by clicking the "Send" button.

[0110] Furthermore, if worker W cannot determine whether the results confirmed at the plant site are "true" or "false," they can also input a determination by clicking the "Unknown" checkbox under "Determination." In this case, detection results with "Unknown" checked will be excluded from the training data to which label values ​​have been assigned, and will also be excluded from the calculation of evaluation indicators.

[0111] (2-4-4-2. Display format) As shown in the example in Figure 8, the operator terminal 30 can display the detection results in chronological order of anomaly detection. In the example in Figure 8, the operator terminal 30 has "Display in detection order" selected as a pull-down menu, so the detection results are displayed in chronological order of anomaly detection. In this case, the operator terminal 30 may also display the detection results for each detection model DM and field device 20.

[0112] (2-4-5. Specific example of the display screen of the worker terminal 30) Here, using Figure 9, we will describe a specific example 2 of the display screen output by the input / output unit 31 of the worker terminal 30. Figure 9 is a diagram showing a specific example 2 of the display screen of the worker terminal 30 according to the embodiment. Below, we will describe the "evaluation index display screen" that is displayed on the "anomaly detection system detection model determination screen".

[0113] (2-4-5-1. Evaluation Metrics Display Screen) As shown in the example in Figure 9, the worker terminal 30 displays "Selection," "Detection Model," "Evaluation Index 1 (Accuracy)," "Evaluation Index 2 (Precision)," etc., for each plant. In the example in Figure 8, the worker terminal 30 displays a list of evaluation indices, showing that for "Detection Model DM003," "Evaluation Index 1 (Accuracy)" is "90%" and "Evaluation Index 2 (Precision)" is "85%"; for "Detection Model DM001," "Evaluation Index 1 (Accuracy)" is "80%" and "Evaluation Index 2 (Precision)" is "75%"; and for "Detection Model DM002," "Evaluation Index 1 (Accuracy)" is "75%" and "Evaluation Index 2 (Precision)" is "70%." At this time, if worker W selects "Detection Model DM003" and "Detection Model DM001" as the adopted models, since their "Evaluation Index 2 (Precision Rate)" is 75% or higher, W clicks the "Adopt" checkbox for "Detection Model DM003" and the "Adopt" checkbox for "Detection Model DM001". Then, when worker W confirms the adopted models, they can send the selection results to the server device 10 by clicking the "Confirm" button.

[0114] (2-4-5-2. Display format) As shown in the example in Figure 9, the operator terminal 30 can display the detection model DM in descending order of evaluation metrics. In the example in Figure 9, the operator terminal 30 has selected "Display in descending order of highest score" as a pull-down menu, so the evaluation metrics of the detection model DM are displayed in descending order of the values ​​of "Evaluation Metric 1 (Accuracy)" or "Evaluation Metric 2 (Precision)". In this case, the operator terminal 30 may also display the detection results for each type of algorithm of the detection model DM.

[0115] (2-4-6. Specific example of the display screen of the worker terminal 30, part 3) Here, using Figure 10, we will describe a specific example 3 of the display screen output by the input / output unit 31 of the worker terminal 30. Figure 10 is a diagram showing a specific example 3 of the display screen of the worker terminal 30 according to the embodiment. Below, we will describe the "time-series data display screen" displayed on the "anomaly detection system detection model determination screen".

[0116] (2-4-6-1. Detection result determination screen) As shown in the example in Figure 10, the worker terminal 30 displays time-series graphs for each plant, including "Detection Model DM001," "Detection Model DM002," etc. In the example in Figure 10, for "Detection Model DM001," the worker terminal 30 displays line graphs showing the numerical values ​​of the measurement data "Data 1" and "Data 2" from the field device 20, along with graphics indicating the detection of "Anomaly 1," "Anomaly 2," "Anomaly 3," and "Anomaly 4" as signs of an anomaly. Similarly, for "Detection Model DM002," the worker terminal 30 displays line graphs showing the numerical values ​​of the measurement data "Data 1" and "Data 2" from the field device 20, along with graphics indicating the detection of "Anomaly 1" and "Anomaly 2" as signs of an anomaly. At this time, if worker W selects "Detection Model DM001" as the model to adopt, they click the "Adopt" checkbox for "Detection Model DM001." Then, if worker W confirms the adopted model, they can send the selection result to the server device 10 by clicking the "Confirm" button.

[0117] (2-4-6-2. Display format) As shown in the example in Figure 10, the worker terminal 30 can select and display the data necessary to determine the adopted model. In the example in Figure 10, "Display detection results and measurement data" is selected as the pull-down menu on the worker terminal 30, so the detection result "Discrepancy" and the measurement data "Data" are displayed. At this time, the worker terminal 30 can also display only the detection results or only the measurement data. In addition, the worker terminal 30 may overlay the evaluation indicators of the detection model DM onto the time-series graph described above.

[0118] (2-4-6-3. Input of judgment result) Operator W can also input the truth value of the detection result by manipulating the time-series graph described above. For example, Operator W can input that the detection result is "true" by double-clicking the diamond shape representing the detection result "anomaly".

[0119] [3. Processing flow of the Anomaly Prediction System 100] The processing flow of the anomaly prediction detection system 100 according to the embodiment will be explained using Figures 11 to 13. Below, the overall processing flow of the anomaly prediction detection system 100 will be explained, followed by the detection model construction process and the anomaly prediction output process.

[0120] (3-1. Overall processing of the anomaly prediction detection system 100) The overall processing flow of the anomaly prediction detection system 100 according to the embodiment will be explained using Figure 11. Figure 11 is a flowchart showing an example of the overall flow of the information processing system 100 according to the embodiment. Note that the processes in steps S101 to S102 below can be executed in a different order. Also, some of the processes in steps S101 to S102 below may be omitted.

[0121] (3-1-1. Detection Model Construction Process) Firstly, the server device 10 executes the detection model construction process (step S101). For example, the server device 10 obtains a highly accurate detection model DM by repeatedly executing the processes described in steps S201 to S209.

[0122] (3-1-2. Abnormality Prediction Output Processing) Secondly, the server device 10 performs anomaly prediction output processing (step S102). For example, the server device 10 uses the highly accurate detection model DM constructed in step S101 to perform the processes described later in steps S301 to S303, thereby achieving highly accurate anomaly prediction detection.

[0123] (3-2. Detection Model Construction Process) The flow of the detection model construction process of the anomaly prediction detection system 100 according to the embodiment will be explained using Figure 12. Figure 12 is a flowchart showing an example of the flow of the detection model construction process of the anomaly prediction detection system 100 according to the embodiment. Note that the processes in steps S201 to S209 below can be executed in a different order. Also, some of the processes in steps S201 to S209 below may be omitted.

[0124] (3-2-1. Measurement data collection process) Firstly, the server device 10 performs measurement data acquisition processing (step S201). For example, the server device 10 collects the measurement data acquired by the field device 20.

[0125] (3-2-2. Anomaly Prediction Detection Process) Secondly, the server device 10 performs anomaly prediction detection processing (step S202). For example, the server device 10 detects anomalies by inputting the collected measurement data into the detection model DM.

[0126] (3-2-3. Detection result transmission process) Thirdly, the server device 10 performs the detection result transmission process (step S203). For example, the server device 10 transmits the detection result to the worker terminal 30 used by worker W and displays it on the monitor screen.

[0127] (3-2-4. Detection result determination process) Fourth, the server device 10 performs detection result determination processing (step S204). For example, the server device 10 receives the determination of whether the abnormality indicator confirmed by the worker W is true or false via the worker terminal 30. If the detection result is true (step S204: Yes), the server device 10 proceeds to the process in step S205. On the other hand, if the detection result is false (step S204: No), the server device 10 proceeds to the process in step S206.

[0128] (3-2-5. Evaluation Metric Calculation Process) Fifth, the server device 10 performs the evaluation index calculation process (steps S205, S206). For example, the server device 10 calculates the precision of the detection model DM as the evaluation index.

[0129] (3-2-6. Retraining execution process) Sixth, the server device 10 executes the retraining process (step S207) and returns to the process in step S202. For example, the server device 10 retrains the detection model DM whose detection result was determined to be false and updates its parameters.

[0130] (3-2-7. Learning continuation determination process) Seventh, worker W performs a learning continuation determination process (step S208). For example, worker W determines to terminate learning if the evaluation indicator reaches a predetermined value or if they determine that there are no problems with the work situation. If the server device 10 decides to continue learning (step S208: Yes), it returns to the process in step S202. On the other hand, if the server device 10 decides not to continue learning (step S208: No), it proceeds to the process in step S209.

[0131] (3-2-8. Detection Model Determination Process) Eighth, the server device 10 executes the detection model determination process (step S209) and terminates the detection model construction process. For example, if the server device 10 automatically selects a detection model DM whose evaluation index is a predetermined value, or if it accepts a detection model DM selected by the operator W, it uses the selected detection model DM as the adopted model for the anomaly prediction detection process.

[0132] (3-3. Anomaly Prediction Output Processing) The flow of the abnormality prediction output processing of the abnormality prediction detection system 100 according to the embodiment will be explained using Figure 13. Figure 13 is a flowchart showing an example of the flow of the abnormality prediction output processing of the abnormality prediction detection system 100 according to the embodiment. Note that the processes in steps S301 to S303 below can be executed in a different order. Also, some of the processes in steps S301 to S303 below may be omitted.

[0133] (3-3-1. Measurement data collection process) Firstly, the server device 10 performs measurement data acquisition processing (step S301). For example, the server device 10 collects the measurement data acquired by the field device 20.

[0134] (3-3-2. Anomaly Prediction Detection Process) Secondly, the server device 10 performs anomaly prediction detection processing (step S302). For example, the server device 10 detects anomalies by inputting the collected measurement data into the adopted detection model DM. In this case, if there are multiple detection model DMs that have been decided as adopted models, the server device 10 may use multiple detection model DMs to detect anomalies, or it may use the detection model DM with the highest evaluation index among the multiple detection model DMs to detect anomalies.

[0135] (3-3-3. Detection result transmission process) Thirdly, the server device 10 executes the detection result transmission process (step S303) and terminates the abnormality prediction output process. For example, the server device 10 transmits the detection result to the worker terminal 30 used by the worker W and displays it on the monitor screen. In this case, if there are multiple detection model DMs that have been decided as the adopted model, the server device 10 may transmit all of the multiple detection results to the worker terminal 30, or it may notify the worker terminal 30 only of the detection result that is the output of the detection model DM with the highest evaluation index among the multiple detection model DMs.

[0136] [4. Effects of the Embodiment] Finally, the effects of the embodiment will be described. Below, effects 1 to 10 corresponding to the processing according to the embodiment will be described.

[0137] (4-1. Effect 1) Firstly, in the process according to the embodiment described above, the server device 10 collects measurement data measured by the field device 20, inputs the collected measurement data to a trained detection model DM that predicts a predetermined event in response to the input of the measurement data, and obtains the output result of the trained detection model DM. If the output result of the trained detection model DM differs from the confirmation result by the worker W who confirmed the field device 20 in which the predetermined event was predicted, the server device 10 retrains the trained detection model DM using the label value input by the worker W and the collected measurement data to generate a retrained model. Therefore, the accuracy of the trained model can be improved in this process.

[0138] (4-2. Effect 2) Secondly, in the process according to the embodiment described above, the trained detection model DM is a detection model DM trained by unsupervised machine learning using each measurement data that is a normal value from among multiple measurement data collected over a predetermined period as training data. Furthermore, the server device 10 performs retraining of the trained model by supervised learning, in which label values ​​based on the judgment result are assigned as training data to the collected measurement data. Therefore, in this process, the accuracy of the unsupervised learning model can be improved.

[0139] (4-3. Effect 3) Thirdly, in the processing according to the embodiment described above, if the output result of the trained detection model DM corresponds to a sign of an abnormal state, and the worker W's judgment result does not confirm an abnormal state or a sign of an abnormal state in the field device 20, the server device 10 retrains the trained detection model DM using training data in which the presence or absence of an abnormal state or a sign of an abnormal state based on the judgment result is assigned as a label value to the collected measurement data. Therefore, this process can improve the accuracy of the trained model for detecting signs of abnormalities.

[0140] (4-4. Effect 4) Fourth, in the process according to the embodiment described above, the server device 10 calculates an evaluation index for the trained detection model DM based on the detection result, which is the output of the trained detection model DM, and the judgment result by the worker W who confirmed the field device 20 in which a predetermined event was predicted. Therefore, in this process, the accuracy of the trained model can be improved by evaluating the trained model obtained through unsupervised learning.

[0141] (4-5. Effect 5) Fifth, in the process according to the embodiment described above, the server device 10 performs retraining of the trained model based on the calculated evaluation index. Therefore, in this process, the accuracy of the trained model can be improved by retraining the trained model with a low evaluation index.

[0142] (4-6. Effect 6) Sixth, in the process according to the embodiment described above, the server device 10 acquires the output results of each of the multiple trained detection models DM that predict a predetermined event, calculates an evaluation index for each of the multiple trained detection models DM based on the output results of each of the multiple trained detection models DM and the judgment result by the worker W who confirmed the field equipment 20 in which the predetermined event was predicted, and decides to select a trained detection model DM from among the multiple trained detection models DM whose evaluation index is equal to or greater than a predetermined value. Therefore, in this process, the accuracy of the trained model can be improved by automatically selecting a trained model with high accuracy.

[0143] (4-7. Effect 7) Seventh, in the process according to the embodiment described above, the server device 10 decides to adopt the trained detection model DM selected by the operator W from among a plurality of trained detection models DM. Therefore, in this process, the accuracy of the machine learning model can be improved by the operator W selecting a machine learning model with high accuracy.

[0144] (4-8. Effect 8) Eighth, in the process according to the embodiment described above, the server device 10 calculates at least one of the following evaluation indicators: accuracy, precision, recall, specificity, and F-score, based on the detection result which is the output of the trained detection model DM and the judgment result made by the worker W who confirmed the field equipment 20 in which a predetermined event was predicted, and displays the evaluation indicator on the worker terminal 30 used by the worker W. Therefore, in this process, the accuracy of the trained model can be improved by the worker W selecting a trained model with high accuracy according to the type of output result.

[0145] (4-9. Effect 9) Ninth, in the process according to the embodiment described above, the server device 10 generates a time-series graph showing the history of the collected measurement data, displays the generated time-series graph on the worker terminal 30 used by the worker W, and decides to adopt a learning model based on the displayed time-series graph. Therefore, in this process, the accuracy of the machine learning model can be improved by the worker W selecting a machine learning model with high accuracy while referring to the time-series data.

[0146] (4-10. Effect 10) Tenth, in the processing according to the above embodiment, the server device 10 generates a normal state screen showing the period of the normal state which is the detection result, and displays the generated normal state screen on the worker terminal 30 used by the worker W in a form that can be switched on or off by the worker W's operation.

[0147] 〔system〕 Unless otherwise specified, the processing procedures, control procedures, specific names, and various data and parameters shown in the above documents and drawings may be changed at will.

[0148] Furthermore, the components of each illustrated device are functionally conceptual and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown. That is, all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions.

[0149] Furthermore, each processing function performed by each device may be implemented, in whole or in part, by a CPU and a program executed for analysis by that CPU, or by hardware using wired logic.

[0150] [Hardware] Next, an example of the hardware configuration of the server device 10, which is an alarm detection device, will be described. Note that other devices can also have a similar hardware configuration. Figure 14 is a diagram showing an example of the hardware configuration according to the embodiment. As shown in Figure 14, the server device 10 has a communication device 10a, an HDD (Hard Disk Drive) 10b, memory 10c, and a processor 10d. Also, each part shown in Figure 14 is interconnected by a bus or the like.

[0151] The communication device 10a is a network interface card or the like, and communicates with other servers. The HDD 10b stores programs and databases that operate the functions shown in Figure 2.

[0152] The processor 10d operates a process that performs the functions described in Figure 2 by reading a program that performs the same processing as each processing unit shown in Figure 2 from the HDD 10b or the like and loading it into memory 10c. For example, this process performs the same functions as each processing unit of the server device 10. Specifically, the processor 10d reads a program that has the same functions as the collection unit 15a, detection unit 15b, execution unit 15c, etc. from the HDD 10b or the like. Then, the processor 10d executes a process that performs the same processing as the collection unit 15a, detection unit 15b, execution unit 15c, etc.

[0153] Thus, the server device 10 operates as a device that executes various processing methods by reading and executing a program. Furthermore, the server device 10 can also achieve the same functionality as the embodiment described above by reading the program from a recording medium using a media reader and executing the read program. It should be noted that the program referred to in this other embodiment is not limited to being executed by the server device 10. For example, the present invention can be similarly applied when another computer or server executes a program, or when they cooperate to execute a program.

[0154] This program can be distributed via networks such as the Internet. Furthermore, this program can be recorded on computer-readable storage media such as hard disks, flexible disks (FDs), CD-ROMs, MO (Magneto-Optical disks), and DVDs (Digital Versatile Discs), and executed by reading the program from these media using a computer.

[0155] 〔others〕 Some examples of the combinations of technical features that will be disclosed are listed below.

[0156] (1) A detection device comprising: an acquisition unit that collects measurement data measured by a measuring device; a detection unit that inputs the collected measurement data to a trained learning model that predicts a predetermined event in response to the input of measurement data and obtains a detection result which is the output of the trained learning model; and an execution unit that, when the detection result of the trained learning model differs from the determination result by a user who has confirmed the measuring device in which the predetermined event was predicted, retrains the trained learning model using the label value input by the user and the collected measurement data to generate a retrained model.

[0157] (2) The detection device according to (1), wherein the trained model is a model trained by unsupervised learning using each measurement data that is a normal value from among a plurality of measurement data collected over a predetermined period as training data, and the execution unit retrains the trained model by supervised learning in which the label values ​​based on the judgment result are assigned to the collected measurement data as training data.

[0158] (3) The detection device according to (1) or (2), wherein the execution unit, if the detection result which is the output of the trained learning model corresponds to a sign of an abnormal state, and the abnormal state or sign of an abnormal state is not confirmed by the judgment result, retrains the trained learning model using training data in which the presence or absence of the abnormal state or sign of an abnormal state based on the judgment result is assigned as a label value to the collected measurement data.

[0159] (4) The detection device according to any one of (1) to (3), wherein the execution unit calculates an evaluation index for the trained learning model based on the detection result which is the output of the trained learning model and the judgment result.

[0160] (5) The detection device according to (4), wherein the execution unit performs retraining of the learned model based on the evaluation index.

[0161] (6) The detection device according to any one of (1) to (5), wherein the detection unit obtains a detection result which is the output of each of the multiple trained learning models that predict the predetermined event, and the execution unit calculates an evaluation index for each of the multiple trained learning models based on the detection result which is the output of each of the multiple trained learning models and the judgment result, and decides to adopt a trained learning model from among the multiple trained learning models whose evaluation index is equal to or greater than a predetermined value.

[0162] (7) The detection device according to any one of (1) to (6), wherein the execution unit decides to adopt the trained learning model selected by the user from among a plurality of trained learning models.

[0163] (8) The detection device according to any one of (1) to (7), wherein the execution unit calculates at least one of the following as evaluation indicators for the trained model: accuracy, precision, recall, specificity, and F-score, based on the detection result which is the output of the trained model and the judgment result by the user who has confirmed the measurement device in which the predetermined event was predicted, and displays the evaluation indicator on the terminal used by the user.

[0164] (9) The detection device according to any one of (1) to (8), wherein the execution unit generates a time-series graph showing the history of the collected measurement data, displays the time-series graph on a terminal used by the user, and decides to adopt a learning model based on the displayed time-series graph.

[0165] (10) The detection device according to any one of (1) to (9), wherein the execution unit generates a screen showing the period of normal state which is the detection result, and displays the generated screen on a terminal used by the user in a form that can be switched on or off by the user's operation.

[0166] (11) A detection method that performs the following steps: a computer collects measurement data measured by a measuring device, inputs the collected measurement data into a trained model that predicts a predetermined event in response to the input of the measurement data, obtains a detection result which is the output of the trained model, and if the detection result which is the output of the trained model differs from the determination result made by a user who has confirmed the measuring device in which the predetermined event was predicted, the computer retrains the trained model using the label value input by the user and the collected measurement data to generate a retrained model.

[0167] (12) A detection program that causes a computer to perform a process that collects measurement data measured by a measuring device, inputs the collected measurement data into a trained learning model that predicts a predetermined event in response to the input of the measurement data, obtains a detection result which is the output of the trained learning model, and if the detection result which is the output of the trained learning model differs from the judgment result made by a user who has confirmed the measuring device in which the predetermined event was predicted, it retrains the trained learning model using the label value input by the user and the collected measurement data to generate a retrained model. [Explanation of symbols]

[0168] 10 Server devices 11 Input section 12 Output section 13 Communications Department 14 Storage section 14a Detection result storage unit 14b Judgment result storage unit 14c Evaluation Index Memory Unit 14d Detection Model Storage Unit 15 Control Unit 15a Collection Department 15b Detection unit 15c Execution Unit 20 Field Instruments 21 Acquisition Department 22 Communications Department 30 Worker terminals 31 Input / output section 32 Transmitter / Receiver 33 Communications Department 100 Anomaly Prediction Detection Systems

Claims

1. A data collection unit that collects measurement data measured by a measuring device, A detection unit that inputs the collected measurement data into a trained learning model that predicts a predetermined event in response to the input of measurement data, and obtains a detection result which is the output of the trained learning model, A screen is displayed on the user terminal of the user who has confirmed the measurement device in which the predetermined event was predicted, allowing the user to select and input a label value of true, false, or unknown for the detection result. If the detection result differs from the user's judgment result, the execution unit generates a retrained model by retraining the previously trained model using the label value entered by the user and the collected measurement data. A detection device equipped with the following features.

2. The aforementioned trained model is This is a learning model trained through unsupervised learning, using each measurement data point that represents a normal value from multiple measurement data points collected over a predetermined period as training data. The execution unit is, The previously trained model is retrained by supervised learning, in which the collected measurement data is assigned the label values ​​based on the judgment results as training data. The detection device according to claim 1.

3. The execution unit is, If the detection result, which is the output of the trained model, corresponds to a precursor of an abnormal state, and the determination result does not confirm an abnormal state or a precursor of an abnormal state, the trained model is retrained using training data in which the presence or absence of the abnormal state or the precursor of an abnormal state based on the determination result is assigned as a label value to the collected measurement data. The detection device according to claim 1.

4. The execution unit is, Based on the detection result, which is the output of the trained model, and the judgment result, an evaluation index for the trained model is calculated. The detection device according to claim 1.

5. The execution unit is, Based on the aforementioned evaluation metrics, the trained model is retrained. The detection device according to claim 4.

6. The detection unit is The detection results, which are the outputs of each of the multiple trained learning models that predict the predetermined event, are obtained. The execution unit is, Based on the detection results and judgment results, which are the outputs of each of the aforementioned multiple trained models, an evaluation index is calculated for each of the aforementioned multiple trained models. Among the multiple trained models, it is decided to adopt the trained model whose evaluation metric is equal to or greater than a predetermined value. The detection device according to claim 1.

7. The execution unit is, From among the multiple pre-trained models, the user decides to adopt the pre-trained model selected by the user. The detection device according to claim 1.

8. The execution unit is, Based on the detection result, which is the output of the trained model, and the judgment result by the user who confirmed the measurement device in which the predetermined event was predicted, at least one of the following is calculated as an evaluation index for the trained model: accuracy, precision, recall, specificity, and F-score. The evaluation indicator is displayed on the terminal used by the user. The detection device according to claim 1.

9. The execution unit is, A time-series graph showing the history of the collected measurement data is generated. The time-series graph is displayed on the terminal used by the user. Based on the displayed time-series graph, the adoption of the learning model is determined. The detection device according to claim 1.

10. The execution unit is, A screen is generated showing the period of the normal state, which is the detection result. The generated screen is displayed on the terminal used by the user in a form that can be switched on or off by the user's operation. The detection device according to claim 1.

11. Computers We collect measurement data measured by the measuring device. The collected measurement data is input to a trained model that predicts a predetermined event in response to the input measurement data, and the detection result, which is the output of the trained model, is obtained. A screen is displayed on the user terminal of the user who has confirmed the measurement device in which the predetermined event was predicted, allowing the user to select and input a label value of true, false, or unknown for the detection result. If the detection result differs from the user's determination result, the trained model is retrained using the label value entered by the user and the collected measurement data to generate a retrained model. A detection method for executing a process.

12. On the computer, We collect measurement data measured by the measuring device. The collected measurement data is input to a trained model that predicts a predetermined event in response to the input measurement data, and the detection result, which is the output of the trained model, is obtained. A screen is displayed on the user terminal of the user who has confirmed the measurement device in which the predetermined event was predicted, allowing the user to select and input a label value of true, false, or unknown for the detection result. If the detection result differs from the user's determination result, the trained model is retrained using the label value entered by the user and the collected measurement data to generate a retrained model. A detection program that initiates a process.

Images