Anomaly detection equipment, plant systems, characteristic information production equipment, anomaly detection methods, and characteristic information production methods.

Abstract

Invention details;

Description

Anomaly detection device, plant system, characteristic information generation device, anomaly detection method, characteristic information generation method, and program

[0001] The present disclosure relates to an anomaly detection device that detects process anomalies, a plant system equipped with the anomaly detection device, a feature information generation device that generates feature information used for anomaly detection, an anomaly detection method, a feature information generation method, and a program.

[0002] Conventionally, techniques have been proposed for estimating values ​​of process data acquired during the operation of a plant process. In particular, in processes operated based on the experience or intuition of operators, the state of the process can be grasped more accurately by estimating values ​​of physical quantities that are not measured or values ​​of physical quantities acquired under planned operating conditions. Based on the estimated process state, improvements to the process operation, detection of process anomalies, etc. can be made.

[0003] For example, Patent Document 1 discloses an anomaly sign detection system that detects anomaly signs based on vibration waveform data of target equipment. In order to detect signs of equipment anomalies and identify the causes of the anomaly, the anomaly sign detection system of Patent Document 1 uses non-negative matrix factorization (hereinafter also referred to as "NMF") to decompose a vibration spectrogram obtained from observed vibration waveform data into frequency components of the original signal source, and extracts feature quantities of the vibration spectrum and detects anomalies.

[0004] Japanese Patent Application Laid-Open No. 2020-123229

[0005] In a process in which various operating states exist, process data with different trends may be acquired from various sensors and command signals. In particular, there are processes, such as processes in plants (e.g., steel plants, chemical plants, power plants, and power plants), in which measured values ​​such as temperature and pressure vary significantly even when the same equipment is used, due to differences in product type, raw materials, composition, changes in demand, etc. In such processes, if the same estimation model is used to estimate process data, estimation errors may become large depending on the operating state, and abnormalities occurring in the process may not be correctly detected.

[0006] Furthermore, for data from steelmaking processes, which involve a wide variety of operations, it is necessary to properly link the data to multiple operational states. Simply dividing the data according to operational states results in the estimation model being dominated by local data trends, resulting in large estimation errors. On the other hand, if the data is roughly classified, ignoring the operational states, the estimation model will be dominated by data that lacks characteristic information, resulting in large estimation errors. For this reason, estimation models for steelmaking processes require optimization of data classification that appropriately captures the trends and characteristics of operational states, but traditionally classification has been done by trial and error based on human judgment.

[0007] Therefore, the present disclosure has been made in consideration of the above problems, and an object of the present disclosure is to provide an anomaly detection device, a plant system, a characteristic information generation device, an anomaly detection method, a characteristic information generation method, and a program that are capable of accurately detecting anomalies that occur in a process having multiple process characteristics.

[0008] In order to solve the above problems, according to the present disclosure, there is provided an anomaly detection device including: a process data acquisition unit that acquires process data of a process having a plurality of process characteristics; and an anomaly detection unit that detects an abnormal state of the process based on an abnormality degree indicating a difference between the acquired process data and a normal state of the process represented by feature information that represents the features of normal process data for each process characteristic, wherein the feature information that represents the normal state of the process is optimal feature information for each process characteristic that is searched for by evaluating feature information candidates generated for each process characteristic from a plurality of normal process data acquired when the process is in a normal state, based on an error between estimated process data calculated using the feature information candidates and the normal process data.

[0009] The anomaly detection unit may factorize a matrix representing the acquired process data with a feature matrix representing feature information that represents characteristics of normal process data of the process to acquire a coefficient matrix representing the feature information of the process data, and calculate the degree of anomaly based on the matrix representing the process data, the feature matrix, and the coefficient matrix.

[0010] The degree of abnormality may be the distance between the value of the process data and a hyperplane that represents the normal state of the process using feature information that represents the features of normal process data for each process characteristic.

[0011] The anomaly detection unit may calculate a deviation degree that indicates the degree of anomaly for each operating condition of the process data.

[0012] Furthermore, according to the present disclosure, there is provided a plant system including a plant having a process with a plurality of process characteristics and the above-mentioned anomaly detection device, in which the anomaly detection device calculates an anomaly degree or a deviation degree that expresses the anomaly degree for each operating condition of the process data, and controls the plant based on the anomaly degree or the deviation degree.

[0013] In order to solve the above-described problems, the present disclosure provides a feature information generation device including: a feature information generation unit that generates, for each process characteristic, candidates of feature information representing features of normal process data from a plurality of normal process data acquired when a process having a plurality of process characteristics is in a normal state; and a search unit that evaluates the candidate feature information based on an error between estimated process data calculated using the candidate feature information and the normal process data, and searches for optimal feature information for each process characteristic.

[0014] The search unit may calculate an evaluation threshold from the quartile of the error, and evaluate the characteristic information based on the number of normal process data items that exceed the evaluation threshold.

[0015] The search unit may search for the optimum characteristic information to be characteristic information that minimizes the number of normal process data items that exceed the evaluation threshold.

[0016] Furthermore, in order to solve the above-mentioned problems, according to the present disclosure, there is provided an anomaly detection method including: a process data acquisition step of acquiring process data of a process having a plurality of process characteristics; and an anomaly detection step of detecting an abnormal state of the process based on an abnormality degree indicating a difference between the acquired process data and a normal state of the process represented by feature information representing characteristics of normal process data for each process characteristic, wherein the feature information representing the normal state of the process is optimal feature information for each process characteristic that is searched for by evaluating feature information candidates generated for each process characteristic from a plurality of normal process data acquired when the process is in a normal state, based on an error between estimated process data calculated using the feature information candidates and the normal process data.

[0017] In order to solve the above-described problems, the present disclosure provides a feature information generation method including: a feature information generation step of generating, for each process characteristic, feature information candidates representing features of normal process data from a plurality of normal process data acquired when a process having a plurality of process characteristics is in a normal state; and a search step of evaluating the feature information candidates based on an error between the normal process data and estimated process data calculated using the feature information candidates, and searching for optimal feature information for each process characteristic.

[0018] Furthermore, in order to solve the above-described problems, according to the present disclosure, there is provided a program that causes a computer to function as an anomaly detection device including: a process data acquisition unit that acquires process data of a process having a plurality of process characteristics; and an anomaly detection unit that detects an abnormal state of the process based on an abnormality degree indicating a difference between the acquired process data and a normal state of the process represented by feature information that represents the features of normal process data for each process characteristic, wherein the feature information that represents the normal state of the process is optimal feature information for each process characteristic that is found by evaluating feature information candidates generated for each process characteristic from a plurality of normal process data acquired when the process is in a normal state, based on an error between estimated process data calculated using the feature information candidates and the normal process data.

[0019] In order to solve the above-described problems, the present disclosure provides a program that causes a computer to function as a feature information generation device including: a feature information generation unit that generates, for each process characteristic, candidates of feature information representing features of normal process data from a plurality of normal process data acquired when a process having a plurality of process characteristics is in a normal state; and a search unit that evaluates the candidate feature information based on an error between estimated process data calculated using the candidate feature information and the normal process data, and searches for optimal feature information for each process characteristic.

[0020] As described above, according to the present disclosure, in a process having a plurality of process characteristics, an abnormal state of the process is detected based on an anomaly degree indicating a difference between the normal state of the process represented by feature information for each process characteristic and the process data, thereby enabling anomalies occurring in the process to be detected with high accuracy.

[0021] 12 is a conceptual diagram showing a normal state of a process represented by optimal feature information obtained for each process characteristic. FIG. 13 is a block diagram showing an example of a configuration of an anomaly detection system according to the present disclosure. FIG. 14 is a flowchart showing an overview of a feature information generation method according to the present disclosure. FIG. 15 is a flowchart showing an example of a feature information generation method using NMF. FIG. 16 is an explanatory diagram showing a past data matrix Y. FIG. 17 is an explanatory diagram showing the relationship between the past data matrix Y and the matrix product of a coefficient matrix Φ and an operational state matrix X. FIG. 18 is an explanatory diagram showing an image of the relationship between the Euclidean norm value of an estimation error calculated for a plurality of normal process data used to generate feature information candidates and the Euclidean norm value of an estimation error. FIG. 19 is a flowchart showing an overview of an anomaly detection method according to the present disclosure. FIG. 19 is a flowchart showing an example of an anomaly detection method using NMF. FIG. 19 is a conceptual diagram when a deviation is expressed by a vector. FIG. 19 is a numerical example for explaining a feature information generation method according to the present disclosure, showing an example in which the past data matrix Y is approximated to the matrix product of a coefficient matrix Φ and a matrix X. FIG. 19 is a graph showing feature information candidates in the numerical example of FIG. 11. FIG. 19 is an explanatory diagram explaining calculation of an evaluation threshold in the numerical example of FIG. 11. FIG. 19 is an explanatory diagram explaining calculation of an anomaly degree in the numerical example of FIG. FIG. 1 is a block diagram illustrating an example of a hardware configuration of an information processing device that functions as a feature information generating device or an anomaly detecting device according to the present disclosure.

[0022] Preferred embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. In this specification and drawings, components having substantially the same functional configurations are designated by the same reference numerals, and redundant description will be omitted.

[0023] [1. System Configuration] The anomaly detection system according to the present disclosure is a system for detecting anomalies occurring in a process based on process data acquired from the process. The process according to the present disclosure is a process having multiple process characteristics. Process data refers to data obtained during the operation of the process, such as equipment operating conditions, product type, and measurements obtained using sensors, etc. Process characteristics refer to trends in the process data acquired in the process. For example, in some processes, such as steel plant processes, the values ​​of process data may vary significantly depending on the product type, etc., even when the same equipment is used. For example, in a casting process using continuous casting equipment, the way in which solidification anomalies occur in the solidified shell varies depending on the electromagnetic stirring conditions and the type of powder. Such a process is referred to as a process having multiple process characteristics.

[0024] In the anomaly detection system according to the present disclosure, feature information representing the features of normal process data acquired when the process is in a normal state is generated as an index for detecting a process anomaly. The feature information serving as the index is generated using normal process data acquired in past operations. For one process characteristic, one piece of optimal feature information representing the features of normal process data that could possibly be assumed for that process characteristic is generated as the feature information serving as the index.

[0025] For example, an anomaly detection system acquires process data from a process while monitoring whether an anomaly has occurred in the process. The anomaly detection system detects an abnormal state of the process based on the anomaly degree of the process at the time the process data was acquired. Here, the anomaly degree is a value indicating how much the acquired process data deviates from the normal state of the process represented by the generated characteristic information, and indicates the difference between the process data and the normal state of the process represented by the characteristic information. The anomaly detection system detects an anomaly in the process by determining how much the process deviates from the normal state at the time the process data was acquired based on the characteristic information corresponding to the process characteristics at the time the process data was acquired. In this way, in a process having multiple process characteristics, the accuracy of anomaly detection can be improved by detecting an anomaly in the process using the characteristic information corresponding to the process characteristics of the acquired process data.

[0026] FIG. 1 shows a conceptual diagram of the normal state of a process represented by optimal feature information obtained for each process characteristic. The conceptual diagram shown in FIG. 1 shows the normal state of a process having three process characteristics. The normal process data ND generates clusters c1, c2, and c3 for each process characteristic. The anomaly detection system obtains feature information representing the dominant features of the normal process data for each cluster c1, c2, and c3, and obtains a space (normal space) representing the normal state of the entire process. The feature information of each of the clusters c1, c2, and c3 is represented by a direction vector a that defines the normal space. １ , a ２ , a ３ and the process data is a direction vector a １ , a ２ , a ３ If the process data is within the normal space spanned by (a), the process is said to be in a normal state. In other words, if the process data is outside the normal space, the process is likely to be in an abnormal state.

[0027] The degree of anomaly d calculated by the anomaly detection system according to the present disclosure represents the degree to which the process data PD to be determined deviates from a hyperplane indicating the boundary of the normal space, expressed as the minimum distance from the normal space. The larger the degree of anomaly d, the more the process data PD to be determined deviates from the normal space, indicating a greater abnormality in the process. In this way, the anomaly detection system according to the present disclosure detects process anomalies by using feature information to represent a minimum-dimensional polyhedron that rationally explains the relationship between the process data when the process was normal.

[0028] The configuration of an anomaly detection system 1 according to the present disclosure will be described below with reference to Fig. 2. Fig. 2 is a block diagram showing an example of the configuration of an anomaly detection system 1 according to the present disclosure. As shown in Fig. 2, the anomaly detection system 1 according to the present disclosure includes a feature information generation device 100, an anomaly detection device 200, and a feature information storage unit 300.

[0029] [1-1. Feature Information Generation Device] The feature information generation device 100 generates feature information representing features of normal process data acquired from a process 10 having a plurality of process characteristics when the process 10 is in a normal state. As shown in FIG. 2 , the feature information generation device 100 includes a feature information generation unit 110 and a search unit 120.

[0030] (Feature Information Generator) The feature information generator 110 generates feature information candidates representing features of normal process data from a plurality of normal process data for each process characteristic. The feature information generator 110 acquires the normal process data from the process data storage unit 30, which stores process data acquired in past operations. The feature information generator 110 acquires the normal process data used to generate feature information candidates from the process data storage unit 30. The feature information generator 110 may acquire a plurality of process data acquired over a predetermined period, or may acquire a predetermined number of process data.

[0031] The feature information generating unit 110 according to the present disclosure acquires feature information from the acquired normal process data using non-negative matrix factorization (hereinafter also referred to as "NMF"). NMF is an algorithm that decomposes one non-negative matrix into the product of two non-negative matrices. The feature information generating unit 110 acquires a matrix (hereinafter also referred to as "feature matrix") representing feature information of each process characteristic by decomposing the normal process data into a non-negative matrix using NMF. The feature information generating unit 110 will be described in detail later. The feature information generating unit 110 outputs candidates for feature information of each acquired process characteristic to the searching unit 120.

[0032] (Searching Unit) The searching unit 120 evaluates candidate feature information based on the error between estimated process data calculated using candidate feature information and normal process data, and searches for optimal feature information for each process characteristic. The searching by the searching unit 120 refers to evaluating multiple candidate feature information to find one optimal feature information. The optimal feature information to be searched for represents the dominant feature of normal process data. That is, the searching unit 120 searches for feature information that represents a feature that applies to as many process data obtained when the process is in a normal state as possible. The searching unit 120 evaluates candidate feature information for each process characteristic together. That is, the searching unit 120 evaluates multiple candidate combinations of feature information for each process characteristic, and ultimately searches for optimal feature information for each process characteristic. In this way, optimal feature information for each process characteristic for the entire process is found.

[0033] The estimated process data is calculated based on candidate feature information obtained from normal process data, and therefore is considered to represent normal process data. Therefore, the error between the estimated process data and the normal process data represents the degree to which the features represented by the candidate feature information used to calculate the estimated process data deviate from the features of the actual normal process data. The larger the error, the more the features represented by the candidate feature information deviate from the features of the normal process data.

[0034] Based on the error between the estimated process data and the normal process data, the search unit 120, for example, sets an evaluation index and evaluates candidate feature information using the evaluation threshold. The evaluation threshold can be calculated, for example, from the quartile of the error between the estimated process data and the normal process data. Quartiles refer to values ​​obtained by dividing data into four equal parts when the data is sorted in ascending order. Quartiles are referred to as the first quartile, second quartile (i.e., median), and third quartile, from the smallest to the largest. The first quartile is a value that corresponds to 25% of the total, and the third quartile is a value that corresponds to 75% of the total. Since quartiles are set based on the median, they are useful for setting thresholds based on the main characteristics of the process data. Furthermore, quartiles are useful for understanding the variation in data values ​​and are less susceptible to outliers. Therefore, the search unit 120 sets an evaluation threshold for distinguishing normal process data from process data that deviates from the normal process data, using the quartile of the error.

[0035] For example, the searching unit 120 may use the sum of the difference between the third quartile and the median and the third quartile as the evaluation threshold. Such an evaluation threshold is a value that is assumed to distinguish most of the process data as normal process data. The smaller the number of normal process data whose errors from estimated process data calculated using candidate feature information exceed the evaluation threshold, the more accurately the evaluation threshold can be used to evaluate whether the process data is normal process data. The searching unit 120 evaluates candidate feature information using such an evaluation threshold, and searches for a candidate feature information that minimizes the number of normal process data whose errors exceed the evaluation threshold as the optimal feature information.

[0036] The search unit 120 records the optimum feature information for each process characteristic in the feature information storage unit 300 .

[0037] [1-2. Anomaly Detection Device] The anomaly detection device 200 detects an abnormal state of the process 10 from the process data to be determined, using characteristic information of the process 10. As shown in FIG. 2 , the anomaly detection device 200 includes a process data acquisition unit 210 and an anomaly detection unit 220.

[0038] (Process Data Acquisition Unit) The process data acquisition unit 210 acquires process data to be determined. For example, the process data acquisition unit 210 may acquire process data acquired from a sensor or the like provided in the equipment during the operation of the process 10 as the process data to be determined, or may acquire process data input from the terminal 500 as the process data to be determined. The process data acquisition unit 210 outputs the acquired process data to be determined to the anomaly detection unit 220.

[0039] (Abnormality Detection Unit) The abnormality detection unit 220 detects an abnormal state of the process 10 based on an abnormality degree indicating a difference between the acquired process data to be determined and a normal state of the process 10 represented by feature information representing the features of normal process data for each process characteristic. The abnormality degree is represented by the distance between the value of the process data to be determined and a hyperplane representing the normal state of the process 10 using feature information representing the features of normal process data for each process characteristic. The greater the abnormality degree, the more the process 10 deviates from the normal state when the process data to be determined was obtained, and the more likely it is that an abnormality has occurred.

[0040] For example, when feature information is acquired using NMF, the anomaly detection unit 220 may factorize a matrix representing the process data to be evaluated using a feature matrix representing the feature information to obtain a coefficient matrix representing the feature information of the process data, and use these matrices to calculate the degree of anomaly, which is the error between the process data to be evaluated and the feature information. By using NMF, the degree of anomaly can be automatically determined based on feature information corresponding to the process characteristics of the process data to be evaluated, among multiple process characteristics possessed by the process 10. Furthermore, the anomaly detection unit 220 may calculate a deviation degree that represents the degree of anomaly for each operating condition of the process data. A detailed description of the calculation process of the degree of anomaly and the deviation degree will be given later.

[0041] The anomaly detection unit 220 outputs the calculated degree of anomaly to, for example, the terminal 500. When the anomaly detection unit 220 calculates the degree of deviation, the anomaly detection unit 220 may output the degree of deviation to the terminal 500 together with the degree of anomaly.

[0042] Furthermore, the anomaly detection unit 220 may determine whether the calculated anomaly degree exceeds an evaluation threshold and perform anomaly detection for the process 10. When the anomaly degree exceeds the evaluation threshold, an anomaly may have occurred in the process 10. In this case, the anomaly detection unit 220 may notify the terminal 500 that an anomaly may have occurred in the process 10.

[0043] The terminal 500 is an information processing device for a user to input information and present the information to the user. The terminal 500 may be, for example, a personal computer, a tablet terminal, or the like. The user can check the values ​​estimated by the anomaly detection device 200 via the terminal 500, and if an abnormality is found in the process 10, can take action to improve the abnormality.

[0044] The above describes one exemplary configuration of the anomaly detection system 1 according to the present disclosure. While FIG. 2 illustrates an example in which the feature information generation device 100, the anomaly detection device 200, and the feature information storage unit 300 are configured as different devices, the present disclosure is not limited to such an example. For example, at least two of the feature information generation device 100, the anomaly detection device 200, and the feature information storage unit 300 may be configured as a single device. For example, the anomaly detection device 200 may include the feature information generation unit 110 and the search unit 120 of the feature information generation device 100 as processing units for generating feature information representing the normal state of a process. Alternatively, the feature information generation device 100 may be configured as two or more devices, and the anomaly detection device 200 may be configured as two or more devices.

[0045] It is also possible to create a program for implementing the functions of the feature information generation unit 110 and search unit 120 of the feature information generation device 100 and the process data acquisition unit 210 and anomaly detection unit 220 of the anomaly detection device 200 and to install the program on a computer or the like. The functions of the feature information generation device 100 and the anomaly detection device 200 are implemented by the computer executing the implemented program using a central processing unit (CPU) or the like of the computer. A computer-readable recording medium on which such a program is stored can also be provided. Examples of the recording medium include a magnetic disk, an optical disk, a magneto-optical disk, and a flash memory. The program may also be distributed, for example, via a network, without using a recording medium.

[0046] [2. Process Anomaly Detection] In the anomaly detection system 1, the feature information generation device 100 executes a feature information generation method that generates feature information representing features of normal process data acquired from a process 10 in a normal state, and the anomaly detection device 200 executes an anomaly detection method that uses the feature information of the process 10 to detect an anomaly in the process 10 from the process data to be determined. The feature information generation method and the anomaly detection method can each be realized by a computer executing a program including the steps described below. The feature information generation method and the anomaly detection method according to the present disclosure will be described below.

[0047] [2-1. Feature Information Generation Method] (2-1-1. Overview) Fig. 3 is a flowchart showing an overview of the feature information generation method according to the present disclosure. In the feature information generation method according to the present disclosure, as shown in Fig. 3, first, the feature information generator 110 generates, for each process characteristic, feature information candidates representing the characteristics of normal process data from a plurality of normal process data (S11: feature information generation step). Next, the searcher 120 evaluates the feature information candidates based on the error between the estimated process data and the normal process data calculated using the feature information candidates generated in step S11, and searches for optimal feature information for each process characteristic (S13: search step).

[0048] More specifically, in the feature information generation method according to the present disclosure, feature information is generated using nonnegative matrix factorization (NMF), as an example. NMF is an algorithm that decomposes one nonnegative matrix into the product of two nonnegative matrices. By decomposing normal process data used for generating feature information into a nonnegative matrix using NMF, feature information of multiple process characteristics of the process can be automatically obtained. An example of a feature information generation method using NMF will be described in detail below.

[0049] (2-1-2. Feature Information Generating Method Using NMF) FIG. 4 is a flowchart showing an example of a feature information generating method using NMF. When using NMF, the past process data recorded in the process data storage unit 30 is represented by a matrix Y as shown in FIG. 5. The matrix Y is a matrix with T rows and M columns, where the rows represent time and the columns represent data items of the past process data (Y∈R （Ｔ，Ｍ） ). The values ​​of the data items in each row of the matrix Y indicate the values ​​of the process data acquired at each time, and are associated with each other by time. Hereinafter, the matrix Y will also be referred to as the "past data matrix Y." Note that the process data at each time in the past data matrix Y does not need to be arranged in chronological order. The process data in the past data matrix Y may be process data acquired at equal intervals or may be data acquired at unequal intervals. Furthermore, the process data in the past data matrix Y may be continuous data or may be discontinuous data.

[0050] (S101: Setting Initial Values) In the feature information generation method using NMF, as shown in FIG. 4, first, the feature information generation unit 110 sets initial values ​​for the number of process data classifications N, the coefficient matrix Φ, and the operation state matrix X (S101).

[0051] The number of classifications N is the number of classes into which process data is classified. The initial value and upper limit of the number of classifications N can be set arbitrarily. For example, the initial value N ０ = 2, and the upper limit of the number of classifications N ｍａｘ =10.

[0052] The coefficient matrix Φ and the operational state matrix X are non-negative matrices generated by decomposing the past data matrix Y using NMF, as shown in Fig. 6. The coefficient matrix Φ is a matrix with T rows and N columns, where the rows represent time and the columns represent classifications (i.e., classes) of process data (Φ∈R （Ｔ，Ｎ） The coefficient matrix Φ is also called a feature matrix. The operational state matrix X is an N-row, M-column matrix (Φ∈R （Ｎ，Ｍ） The operational state matrix X is also referred to as a feature matrix. The initial values ​​of the coefficient matrix Φ and the operational state matrix X may be set randomly, for example.

[0053] Furthermore, the feature information generating unit 110 sets an upper limit value for the number of trials L as an initial setting. For example, the upper limit value L ｍａｘ = 100. The number of trials L starts from 1.

[0054] (S103: Generation of Feature Information) Next, when the feature information generator 110 acquires the past process data recorded in the process data storage unit 30, it approximates the past data matrix Y representing the past process data to the matrix product (Y≈Φ·X) of the coefficient matrix Φ and the operation state matrix X using NMF (S103). Here, the past process data is normal process data acquired when the process was in a normal state.

[0055] The coefficient matrix Φ is generally composed of sparse matrix elements as shown in Fig. 6. Each row of the coefficient matrix Φ is denoted by a matrix element Φ ｊ (j=1, . . . , T), the feature information generating unit 110 calculates the value of the data item by the matrix element Φ ｊ The clustering is performed by relating the matrix element Φ ｊ represents the contribution of the process to each process characteristic at each time. That is, the matrix element Φ ｊEach column of the operational state matrix X represents a class corresponding to the process characteristic. The operational state matrix X represents the characteristics of the time-invariant process data values, which are independent of time. The operational state matrix X can be said to be feature information representing the characteristics of normal process data acquired from the process 10. Each row of the operational state matrix X represents a directional vector, which is feature information of normal process data having similar process characteristics. The feature information representing each process characteristic of the process 10 is, for example, the directional vector a shown in FIG. １ , a ２ , a ３ and represents the proportional relationship of the normal process data for each process characteristic.

[0056] The matrix element Φ of the coefficient matrix Φ obtained using NMF ｊ Since each column in the coefficient matrix Φ represents a class corresponding to the process characteristic, it can be said that the process data belongs to the class of the column having the largest value. ｊ The class to which the process data at each time belongs is shown in the graph, and the process characteristics of each class are automatically identified.

[0057] The characteristic information generating unit 110 expresses the past normal process data as a matrix product of the coefficient matrix Φ and the operational state matrix X, and outputs the coefficient matrix Φ and the operational state matrix X to the searching unit 120. At this time, the operational state matrix X output from the characteristic information generating unit 110 to the searching unit 120 is a candidate for characteristic information.

[0058] (S105-S121: Search for optimal feature information) Next, the searching unit 120 evaluates the feature information candidates input from the feature information generating unit 110 and searches for optimal feature information. The searching unit 120 evaluates the feature information candidates based on the error between the estimated process data and the normal process data, which is calculated using the feature information candidates.

[0059] Specifically, the search unit 120 first calculates the error between the estimated process data calculated using the feature information candidates and the normal process data, and calculates a Euclidean norm value for each row of the matrix (S105). The error between the estimated process data and the normal process data is expressed as the difference (Y-Φ·X) between the past data matrix Y and the matrix product of the coefficient matrix Φ and the operational status matrix X. The search unit 120 calculates the Euclidean norm value for each row of the matrix representing the error. The Euclidean norm value represents the magnitude of the vector data represented by each row, and the larger the value, the larger the value.

[0060] The searching unit 120 calculates an evaluation threshold based on the calculated Euclidean norm value to evaluate whether the candidate feature information appropriately represents the mainstream features of normal process data (S107). In this example, the searching unit 120 calculates the evaluation threshold from the quartile of the error between the estimated process data and the normal process data. As described above, the quartile is a value set based on the median, and is therefore useful for setting a threshold based on the mainstream features of the process data. For example, the searching unit 120 calculates the sum of the difference between the third quartile and the median and the third quartile, and sets the result as the evaluation threshold. Such an evaluation threshold means a value that is expected to distinguish most of the process data as normal process data.

[0061] The search unit 120 then evaluates the feature information candidates using the evaluation threshold calculated in step S107. Specifically, the search unit 120 calculates the number of Euclidean norm values ​​calculated in step S105 that exceed the evaluation threshold (hereinafter also referred to as the "number of records exceeding the threshold") (S109), and evaluates the feature information candidates based on the number of records exceeding the threshold (S111).

[0062] 7 shows an image of the relationship between the calculated Euclidean norm values ​​of the estimation errors and the Euclidean norm values ​​of the estimation errors for multiple normal process data used to generate feature information candidates. In the example of FIG. 7, some of the multiple normal process data are over-threshold records in which the Euclidean norm values ​​of the estimation errors exceed the evaluation threshold. Since the evaluation threshold is a value that can distinguish most normal process data from normal process data, when the feature information candidates correctly represent the features of the normal process data, all of the Euclidean norm values ​​of the estimation errors are equal to or less than the evaluation threshold.

[0063] In other words, an over-threshold record in which the Euclidean norm value of the estimation error exceeds the evaluation threshold means that the candidate feature information deviates from the characteristics of the normal process data represented by the candidate feature information. That is, the over-threshold record is normal process data that is determined to deviate from normal process data based on the evaluation threshold, even though it is normal process data. The over-threshold record can also be considered process data that is overdetected by the evaluation threshold as process data acquired during a process abnormality. Therefore, the fewer the over-threshold records, the more accurately the candidate feature information used to calculate the evaluation threshold can be evaluated to represent the characteristics of the normal process data.

[0064] Therefore, in step S111, the search unit 120 determines whether the number of records exceeding the threshold has updated the minimum value, thereby evaluating whether the candidate feature information to be evaluated this time represents a more prevalent feature of normal process data than the feature information evaluated so far. If the number of records exceeding the threshold has updated the minimum value (S111: YES), the search unit 120 retains the number of classifications N of the current process data, the operation status matrix X, and the evaluation threshold (S113). On the other hand, if the number of records exceeding the threshold has not updated the minimum value (S111: NO), the search unit 120 proceeds to the processing of step S115.

[0065] When the process up to step S113 is completed, the search unit 120 determines whether the number of trials L reaches the upper limit of the number of trials L ｍａｘ It is determined whether the number of trials L reaches the upper limit of the number of trials L (S115). ｍａｘIf it has not been reached (S115: NO), the search unit 120 changes the coefficient matrix Φ and the operation state matrix X (S117), and adds 1 to the number of trials L (S119). Thereafter, the processes of steps S103 to S115 are repeatedly performed.

[0066] On the other hand, the number of trials L is equal to the upper limit of the number of trials L ｍａｘ If so (S115: YES), the search unit 120 determines whether the number of classifications N of the process data is equal to or exceeds the upper limit value N ｍａｘ It is determined whether the number of classifications N of the process data reaches the upper limit of the number of classifications N (S121). ｍａｘ If it has not reached (S121: NO), the search unit 120 changes the coefficient matrix Φ and the operational state matrix X (S123), resets the number of trials L to 1, and adds 1 to the number of classifications N (S125). Thereafter, the processes of steps S103 to S121 are repeatedly performed.

[0067] The number of classifications N of the process data is equal to the upper limit of the number of classifications N ｍａｘ If so (S121: YES), the search unit 120 stores the currently held operation state matrix X, number of categories N, and evaluation threshold in the feature information storage unit 300 as the optimal operation state matrix X, number of categories N, and evaluation threshold (S127). The optimal operation state matrix X becomes the optimal feature information searched from the feature information candidates.

[0068] An example of a feature information generation method using NMF according to the present disclosure has been described above. According to the present disclosure, by decomposing normal process data used for feature information generation into a non-negative matrix using NMF, feature information of multiple process characteristics of a process can be automatically obtained. Furthermore, in large-scale systems, there are many types of process data obtained during process operation, such as equipment operating conditions, product types, and measurements measured using sensors, and the like. The operational state matrix X represented by these process data is not necessarily uniquely determined. In such large-scale systems, it is significant to obtain an optimal operational state matrix X by search, as in the feature information generation method according to the present disclosure.

[0069] [2-2. Anomaly Detection Method] (2-2-1. Overview) Fig. 8 is a flowchart showing an overview of the anomaly detection method according to the present disclosure. In the anomaly detection method according to the present disclosure, as shown in Fig. 8, first, the process data acquisition unit 210 acquires process data to be determined (S21: process data acquisition step). Next, the anomaly detection unit 220 detects an abnormal state of the process 10 based on an anomaly degree indicating a difference between the acquired process data to be determined and a normal state of the process 10 represented by feature information that represents the features of normal process data for each process characteristic (S23: anomaly detection step).

[0070] Here, the feature information representing the normal state of the process can be obtained by the feature information generation method shown in Fig. 3. That is, the feature information representing the normal state of the process (the feature information representing the features of the normal process data for each process characteristic) is optimal feature information for each process characteristic, which is searched for by evaluating feature information candidates generated for each process characteristic from a plurality of normal process data acquired when the process is in a normal state, based on the error between the normal process data and estimated process data calculated using the feature information candidates.

[0071] More specifically, in the anomaly detection method according to the present disclosure, as an example, the degree of anomaly is calculated as the distance between a hyperplane representing the normal state of the process 10 based on feature information acquired using nonnegative matrix factorization (NMF) and the value of the acquired process data. By using NMF, the degree of anomaly can be automatically determined based on feature information corresponding to the process characteristic of the process data to be determined, among multiple process characteristics of the process 10, without specifying the process characteristic of the process data to be determined. An example of an anomaly detection method using NMF will be described in detail below.

[0072] (2-2-2. Anomaly Detection Method Using NMF) FIG. 9 is an example of a flowchart showing an anomaly detection method using NMF.

[0073] (S200: Acquire Process Data) First, the process data acquisition unit 210 acquires process data to be determined, for which an anomaly degree is to be calculated in order to detect an anomaly in the process 10 (S200). The process data acquisition unit 210 may acquire, for example, process data acquired during the operation of the process 10 as the process data to be determined, or may acquire process data input from the terminal 500 as the process data to be determined. The process data acquisition unit 210 outputs the acquired process data to be determined to the anomaly detection unit 220.

[0074] (S210-S250: Abnormality Detection Processing) The abnormality detection unit 220 calculates the degree of abnormality based on the acquired process data of the process to be determined, and detects an abnormal state of the process 10.

[0075] First, the anomaly detection unit 220 acquires the characteristic information of the process 10 from the characteristic information storage unit 300 (S210). Specifically, the anomaly detection unit 220 acquires, from the characteristic information storage unit 300, the optimal operation state matrix X, the number of categories N, and the evaluation threshold for the process 10, which have been generated by the characteristic information generation device 100.

[0076] Next, the anomaly detection unit 220 uses NMF to calculate a coefficient matrix φ from the classification number N and the operational state matrix X acquired in step S210, and the process data matrix y representing the process data to be determined acquired in step S200 (S220). Here, the process data matrix y is a 1-row, M-column matrix (y∈R （１，Ｍ） ). The coefficient matrix φ is the matrix element Φ that makes up the coefficient matrix Φ. ｊ (j=1, ..., T) is a matrix of 1 row and N columns (φ∈R （１，Ｎ） ).

[0077] The coefficient matrix φ is determined from the input process data matrix y and operational state matrix X. Once the coefficient matrix φ is determined, the anomaly detection unit 220 can identify a class to which the process data to be estimated belongs from the column with the maximum value. Identifying the class to which the process data to be estimated belongs makes it possible to identify the process characteristics. The anomaly detection unit 220 calculates the coefficient matrix φ representing the feature information of the process data by approximating the process data matrix y to the matrix product (y≈φ·X) of the coefficient matrix φ and the operational state matrix X, which is a feature matrix.

[0078] In this example, since NMF is used, the coefficient matrix φ needs to be a non-negative matrix. To ensure that the coefficient matrix φ is a non-negative matrix, a method is used in which the process data matrix y is approximated to the matrix product of the coefficient matrix φ and the operational state matrix X, rather than multiplying both sides of the matrix product (y≈φ·X) of the coefficient matrix φ and the operational state matrix X from the right.

[0079] Furthermore, the anomaly detection unit 220 calculates the absolute value of the reconstruction error (|y - φ·X|) as the degree of anomaly (S230). The degree of anomaly represented by the reconstruction error represents the distance between the hyperplane (φ·X) representing the normal state of the process 10 and the value of the process data (y) being evaluated. The anomaly detection unit 220 then determines whether the calculated degree of anomaly exceeds the evaluation threshold value acquired in step S210 (S240). If the degree of anomaly is equal to or less than the evaluation threshold value (S240: NO), the anomaly detection unit 220 determines that the process data being evaluated is normal process data and that no anomaly has occurred in the process 10, and ends the processing shown in FIG. 9.

[0080] On the other hand, if the degree of abnormality exceeds the evaluation threshold (S240: YES), the abnormality detection unit 220 evaluates that the process data to be judged is not normal process data, and determines that there is a possibility that an abnormality has occurred in the process 10. In this case, the abnormality detection unit 220 notifies the terminal 500 that there is a possibility that an abnormality has occurred in the process 10 (S250).

[0081] At this time, the anomaly detection unit 220 may notify the terminal 500 of the degree of anomaly as well as the degree of deviation, which represents the degree of anomaly for each operating condition of the process data. The degree of deviation may be expressed, for example, by a reconstruction error (y-φ·X). Since the reconstruction error represents the degree of anomaly in components for each data item, it is possible to identify the operating conditions of the process data that are causing the degree of anomaly to increase.

[0082] Furthermore, the deviation may be represented by, for example, a vector from the center of gravity of the normal process data to the process data to be determined. In this case, the center of gravity of the normal process data is the center of gravity of the normal process data having the same process characteristics as the process data to be determined. FIG. 10 shows a conceptual diagram of the deviation represented by a vector. As shown in FIG. 10 , when the process data PD to be determined has the same process characteristics as the normal process data ND of cluster c3, the anomaly detection unit 220 determines the average of the normal process data ND of cluster c3 as the center of gravity G, and calculates the vector from the center of gravity G to the process data PD as the deviation. Note that the magnitude of the vector may be the degree of anomaly d.

[0083] An example of an anomaly detection method using an NMF according to the present disclosure has been described above.

[0084] [2-3. Numerical Example] An example of the feature information generation method and anomaly detection method according to the present disclosure will be described using a simple example. In this example, two operating conditions (y1, y2) are set as data items of a process data matrix, and first, optimal feature information representing a normal state of a process is obtained from past normal process data using NMF based on the feature information generation method shown in FIG. 4. Here, the optimal feature information is obtained using the normal process data shown in Table 1 below.

[0085]

[0086] To obtain optimal characteristic information, first, the normal process data in Table 1 above is represented by a past data matrix Y. In this example, the past data matrix Y is a matrix with T rows and M columns, where the rows represent unique numbers (T=7) corresponding to the times when the process data were obtained, and the columns represent operating conditions (y1, y2) (M=2) (Y∈R（Ｔ，Ｍ） ). Then, the past data matrix Y is approximated to the matrix product (Y≈Φ·X) of the coefficient matrix Φ and the operational state matrix X. For example, when the number of classifications N is 2 and the input data matrix Y is approximated to the matrix product (Y≈Φ·X) of the coefficient matrix Φ and the operational state matrix X using NMF, the matrix can be expressed as shown in FIG. 11. Here, it is assumed that the coefficient matrix Φ and the operational state matrix X shown in FIG. 11 are optimal feature information searched for using the feature information generation method of FIG. 4.

[0087] Each row of the operational status matrix X, which is a characteristic matrix, indicates a directional vector, which is characteristic information of normal process data having similar process characteristics. That is, as shown in Fig. 12, data No. 1 and No. 2 take values ​​on a line L1 of a directional vector (2, 1), and data No. 3 to No. 7 take values ​​on a line L2 of a directional vector (3, 1). Note that the matrix element Φ of the coefficient matrix Φ obtained using NMF is ｊ Since each column in the coefficient matrix Φ represents a class corresponding to the process characteristic, it can be said that the process data belongs to the class of the column having the largest value. ｊ The class to which the process data at each time belongs is shown in the graph, and the process characteristics of each class are automatically identified.

[0088] In the feature information generation method according to the present disclosure, the past data matrix Y is approximated by the matrix product (Y≈Φ·X) of various coefficient matrices Φ and an operational state matrix X to generate feature information candidates, and optimal feature information is searched for. For example, as shown in Fig. 12, the feature information candidates include feature information that combines the directional vector of a line C1 and the directional vector of a line C2, and feature information that combines the directional vector of a line D1 and the directional vector of a line D2. From such various feature information representing normal process data, feature information that appropriately represents the mainstream features of the normal process data is searched for and determined as optimal feature information.

[0089] To calculate the evaluation threshold for the optimal feature information found, for example, as shown in FIG. 13 , the difference (Y − Φ × X) between the past data matrix Y and the matrix product of the coefficient matrix Φ and the operational status matrix X is calculated, and the Euclidean norm value is calculated for each row. The evaluation threshold is then calculated, for example, using the quartiles of the angular Euclidean norm values. As shown in FIG. 13 , the Euclidean norm values ​​of data No. 1 to No. 7 are 0.0, 1.0, 1.4, 2.0, 2.0, 2.3, and 3.0, with the median being 2.0. For example, if the evaluation threshold is the sum of the difference between the third quartile and the median and the third quartile, the evaluation threshold is 2.3 + 0.3 = 2.6. In this example, the number of records whose Euclidean norm value exceeds the evaluation threshold is 1.

[0090] Then, based on the acquired optimal feature information, the degree of anomaly of the process at a certain point in time is calculated from the process data acquired at that point in time, based on the anomaly detection method shown in Fig. 9. For example, assume that process data with operating conditions y1 = 180 and y2 = 95 is acquired. In this case, when the coefficient matrix φ is calculated using the process data matrix y with 1 row and M columns representing the acquired process data and the operational state matrix X obtained as the optimal feature information, a coefficient matrix φ with 1 row and 2 columns where φ1 = 90 and φ2 = 0 is obtained, as shown in Fig. 14.

[0091] Thereafter, the restoration error (y-φ·X) is calculated, and its absolute value (|y-φ·X|) is calculated as the degree of abnormality. The restoration error is a component representation of the degree of abnormality for each data item, and is also called the deviation. For example, in the example of FIG. 14, the restoration error (deviation) is 0 for operating condition y1, which does not deviate from the normal state, but is 5 for operating condition y2, which deviates from the normal state. In this case, the absolute value of the restoration error is 5.

[0092] The deviation may be expressed as a vector from the center of gravity of the normal process data shown in Fig. 10 to the process data to be determined. In this case, since the process data matrix y has the same process characteristics as No. 1 and No. 2, the deviation can be found by using the average vector (180 90.25) of No. 1 and No. 2 as the center of gravity G. In this case, the deviation is (0 4.75) (= (180 95) - (180 90.25)).

[0093] As described above, by using the feature information generation method and anomaly detection method according to the present disclosure, normal process data used for generating feature information can be decomposed into a non-negative matrix using NMF, thereby automatically obtaining feature information of multiple process characteristics of the process. Furthermore, a process anomaly is detected by determining the degree to which the process at the time the process data was acquired deviates from the normal state based on the feature information corresponding to the process characteristics at the time the process data was acquired. This allows process anomalies to be detected using the feature information corresponding to the process characteristics of the acquired process data without clustering the process data according to the process characteristics, thereby enabling accurate anomaly detection.

[0094] 3. Hardware Configuration The hardware configuration of the feature information generation device 100 and the anomaly detection device 200 according to the present disclosure will be described with reference to Fig. 15. Fig. 15 is a block diagram showing an example of the hardware configuration of an information processing device 900 that functions as the feature information generation device 100 or the anomaly detection device 200 according to the present disclosure.

[0095] The information processing device 900 includes one or more hardware processors such as a CPU 901, one or more memories such as a RAM (Random Access Memory) 905 and a ROM (Read Only Memory) 903, and performs various operations by executing one or more programs stored in the memories by the one or more hardware processors. The information processing device 900 also includes a bus 907, an input I / F 909, an output I / F 911, a storage device 913, a drive 915, a connection port 917, and a communication device 919.

[0096] For example, the CPU 901 functions as an arithmetic processing unit and a control unit. The CPU 901 controls all or part of the operations within the information processing device 900 in accordance with various programs recorded in the ROM 903, the RAM 905, the storage device 913, or the removable recording medium 925. The ROM 903 stores programs used by the CPU 901, arithmetic parameters, etc. The RAM 905 temporarily stores programs used by the CPU 901, or parameters that change as appropriate during program execution. These are interconnected by a bus 907 constituted by an internal bus such as a CPU bus. The bus 907 is connected via a bridge to an external bus such as a PCI (Peripheral Component Interconnect / Interface) bus or PCI Express (registered trademark).

[0097] The arithmetic processing unit and the control unit may be realized by a programmable logic controller (PLC) other than the CPU 901, or may be realized by dedicated hardware such as an application specific integrated circuit (ASIC).

[0098] The input I / F 909 is an interface that accepts input from an input device 921, which is an operating means operated by a user, such as a mouse, keyboard, touch panel, button, switch, or lever. The input I / F 909 is configured, for example, as an input control circuit that generates an input signal based on information input by the user using the input device 921 and outputs the signal to the CPU 901. The input device 921 may be, for example, a remote control device that uses infrared or other radio waves, or an external device 927 such as a PDA that supports operation of the information processing device 900. A user of the information processing device 900 can operate the input device 921 to input various data to the information processing device 900 and instruct processing operations.

[0099] The output I / F 911 is an interface that outputs input information to an output device 923 that can visually or audibly notify the user. The output device 923 may be, for example, a display device such as a CRT display device, a liquid crystal display device, a plasma display device, an EL display device, or a lamp. Alternatively, the output device 923 may be an audio output device such as a speaker or headphones, a printer, a mobile communication terminal, or a facsimile machine. The output I / F 911 instructs the output device 923 to output, for example, processing results obtained from various processes executed by the information processing device 900. Specifically, the output I / F 911 instructs the display device to display the processing results of the information processing device 900 as text or images. The output I / F 911 also instructs the audio output device to convert audio signals, such as audio data, that have been instructed to be played into analog signals and output them.

[0100] The storage device 913 is one of the storage units of the information processing device 900 and is a device for storing data. The storage device 913 is a non-transitory, tangible, computer-readable recording medium. The storage device 913 is configured, for example, by a magnetic storage device such as a hard disk drive (HDD), a semiconductor storage device such as a solid state drive (SSD), an optical storage device, or a magneto-optical storage device. The storage device 913 stores programs executed by the CPU 901, various data generated by the execution of the programs, various data acquired from the outside, and the like.

[0101] The drive 915 is a reader / writer for a recording medium, and is built into or externally attached to the information processing device 900. The drive 915 reads information recorded on the attached removable recording medium 925 and outputs it to the RAM 905. The drive 915 can also write information to the attached removable recording medium 925. The removable recording medium 925 is, for example, a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory. Specifically, the removable recording medium 925 may be a CD media, a DVD media, a Blu-ray (registered trademark) media, a CompactFlash (registered trademark), a flash memory, an SD memory card (Secure Digital memory card), or the like. The removable recording medium 925 may also be, for example, an IC card (Integrated Circuit card) equipped with a contactless IC chip, an electronic device, or the like.

[0102] The connection port 917 is a port for directly connecting a device to the information processing device 900. The connection port 917 is, for example, a Universal Serial Bus (USB) port, an external Serial Advanced Technology Attachment (eSATA), or a Serial Attached Small Computer System Interface (SAS) port. The information processing device 900 can directly acquire various data from an external device 927 connected to the connection port 917 or provide various data to the external device 927. For example, an alarm notification device such as a rotating light for notifying alarm information may be connected via the connection port 917. Furthermore, a network attached storage (NAS) may be connected as the external device 927 and used as a storage device.

[0103] The communication device 919 is, for example, a communication interface configured with a communication device for connecting to a communication network 929. The communication device 919 is, for example, a wired or wireless local area network (LAN), a communication card for Bluetooth (registered trademark), or wireless USB (WUSB). The communication device 919 may also be a router for optical communication, a router for asymmetric digital subscriber line (ADSL), or a modem for various communications. The communication device 919 can transmit and receive signals, for example, between the Internet and other communication devices in accordance with a predetermined protocol such as TCP / IP. For example, a computer for operating the information processing device 900 can be connected via the communication device 919. The communication network 929 connected to the communication device 919 is configured with a wired or wireless network. For example, the communication network 929 is the Internet, a home LAN, infrared communication, radio wave communication, satellite communication, or the like.

[0104] The above shows an example of the hardware configuration of the information processing device 900. Each of the above components may be configured using general-purpose components, or may be configured using hardware specialized for the function of each component. The hardware configuration of the information processing device 900 can be changed as appropriate depending on the technical level at the time of implementing the present disclosure.

[0105] Although the preferred embodiments of the present disclosure have been described in detail above with reference to the accompanying drawings, the present disclosure is not limited to such examples. It is clear that a person skilled in the art to which the present disclosure pertains can conceive of various modified or altered examples within the scope of the technical ideas set forth in the claims, and it is understood that these also naturally fall within the technical scope of the present disclosure.

[0106] For example, the anomaly detection device may be installed in a plant system including a plant having a process with multiple process characteristics, rather than in an anomaly detection system that detects anomalies occurring in a process. The plant system includes plants with various operating conditions, such as steel plants, chemical plants, power plants, and other power plants, and the plant process is controlled by a control device having a processor that controls the plant. The plant system can calculate the degree of anomaly or deviation using the anomaly detection device. The plant system controls the plant based on the calculated degree of anomaly or deviation.

[0107] For example, process data changes when the plant's operating conditions, such as the plant's operation volume or the type of operating equipment, change. As the process data input to the anomaly detection device changes, the anomaly level and deviation level output by the anomaly detection device based on the process data change. Therefore, according to the present disclosure, the anomaly level can be reduced by appropriately changing the plant's operating conditions under equipment constraints. Furthermore, the deviation level output from the anomaly detection device can be used to identify the plant's operating conditions that increase the anomaly level. By appropriately changing the identified operating conditions that increase the anomaly level under equipment constraints, it is possible to reduce the deviation level, and as a result, it is possible to reduce the anomaly level.

[0108] In this way, the plant system controls the plant based on the degree of anomaly or deviation calculated by the anomaly detection device. For example, the plant system controls the plant by changing the operating conditions of the process, such as changing the equipment in operation, so that the process operates normally. This prevents damage to the plant.

[0109] The following configurations are also included within the technical scope of the present disclosure. (1) An anomaly detection device comprising: a process data acquisition unit that acquires process data of a process having a plurality of process characteristics; and an anomaly detection unit that detects an abnormal state of the process based on an abnormality degree indicating a difference between the acquired process data and a normal state of the process represented by feature information representing features of normal process data for each of the process characteristics, wherein the feature information representing the normal state of the process is optimal feature information for each of the process characteristics searched for by evaluating feature information candidates generated for each of the process characteristics from a plurality of normal process data acquired when the process is in a normal state, based on an error between estimated process data calculated using the feature information candidates and the normal process data. (2) The anomaly detection device according to (1), wherein the anomaly detection unit factorizes a matrix representing the acquired process data by a feature matrix representing the feature information representing features of normal process data of the process to obtain a coefficient matrix representing the feature information of the process data, and calculates the abnormality degree based on the matrix representing the process data, the feature matrix, and the coefficient matrix. (3) The anomaly detection device according to (1) or (2), wherein the degree of anomaly is a distance between the value of the process data and a hyperplane representing a normal state of the process using feature information representing features of normal process data for each of the process characteristics. (4) The anomaly detection device according to (3), wherein the anomaly detection unit calculates a deviation representing the degree of anomaly for each operating condition of the process data. (5) The anomaly detection device according to any one of (1) to (4), wherein the processing unit is configured to generate feature information representing a normal state of the process, the processing unit having: a feature information generation unit that generates, for each process characteristic, candidates of feature information representing features of the normal process data from a plurality of normal process data acquired when a process having a plurality of process characteristics is in a normal state; and a search unit that evaluates the feature information candidates based on an error between the normal process data and estimated process data calculated using the feature information candidates.(6) The anomaly detection device according to (5) above, wherein the search unit calculates an evaluation threshold from a quartile of the error, and evaluates the feature information based on the number of pieces of normal process data that exceed the evaluation threshold. (7) The anomaly detection device according to (6) above, wherein the search unit searches for feature information that minimizes the number of pieces of normal process data that exceed the evaluation threshold, as the optimal feature information. (8) A plant system comprising a plant having a process with a plurality of process characteristics and the anomaly detection device according to any one of (1) to (7) above, wherein the anomaly detection device calculates the degree of anomaly or a degree of deviation that expresses the degree of anomaly for each operating condition of the process data, and controls the plant based on the degree of anomaly or the degree of deviation. (9) An anomaly detection method according to (9), comprising: a process data acquiring step of acquiring process data of a process having a plurality of process characteristics; and an anomaly detection step of detecting an abnormal state of the process based on an anomaly degree indicating a difference between the acquired process data and a normal state of the process represented by feature information representing features of normal process data for each of the process characteristics, wherein the feature information representing the normal state of the process is optimal feature information for each of the process characteristics found by evaluating feature information candidates generated for each of the process characteristics from a plurality of normal process data acquired when the process is in a normal state, based on an error between estimated process data calculated using the feature information candidates and the normal process data. (10) The anomaly detection method according to (9), wherein the anomaly detection step includes: factorizing a matrix representing the acquired process data by a feature matrix representing the feature information representing features of the normal process data of the process to obtain a coefficient matrix representing the feature information of the process data; and calculating the anomaly degree based on the matrix representing the process data, the feature matrix, and the coefficient matrix. (11) The anomaly detection method according to (9) or (10), wherein the degree of anomaly is a distance between a value of the process data and a hyperplane that represents a normal state of the process using feature information that represents features of normal process data for each of the process characteristics.(12) The anomaly detection method according to (11), wherein the anomaly detection step calculates a deviation degree that represents the degree of anomaly for each operating condition of the process data. (13) The anomaly detection method according to any one of (9) to (12), wherein the processing for generating feature information representing a normal state of the process includes: a feature information generation step of generating, for each process characteristic, candidate feature information representing a feature of the normal process data from a plurality of normal process data acquired when a process having a plurality of process characteristics is in a normal state; and a search step of evaluating the candidate feature information based on an error between the normal process data and estimated process data calculated using the candidate feature information, thereby searching for optimal feature information for each of the process characteristics. (14) The anomaly detection method according to (13), wherein the search step calculates an evaluation threshold from a quartile of the error, and evaluates the feature information based on the number of the normal process data that exceed the evaluation threshold. and a program for causing a computer to function as an anomaly detection device including: a process data acquisition unit that acquires process data of a process having a plurality of process characteristics; and an anomaly detection unit that detects an abnormal state of the process based on an abnormality degree indicating a difference between the acquired process data and a normal state of the process represented by feature information representing characteristics of normal process data for each of the process characteristics, wherein the feature information representing the normal state of the process is optimal feature information for each of the process characteristics, the optimal feature information being searched for by evaluating feature information candidates generated for each of the process characteristics from a plurality of normal process data acquired when the process is in a normal state, based on an error between estimated process data calculated using the feature information candidates and the normal process data.(17) The program according to (16) above, wherein the anomaly detection unit factorizes a matrix representing the acquired process data with a feature matrix representing the feature information representing features of normal process data of the process to obtain a coefficient matrix representing the feature information of the process data, and calculates the degree of anomaly based on the matrix representing the process data, the feature matrix, and the coefficient matrix. (18) The program according to (16) or (17) above, wherein the degree of anomaly is a distance between a value of the process data and a hyperplane representing a normal state of the process using feature information representing features of normal process data for each of the process characteristics. (19) The program according to (18) above, wherein the anomaly detection unit calculates a deviation degree representing the degree of anomaly for each operating condition of the process data. (20) The program according to any one of (16) to (19), causing a computer to function as an anomaly detection device including a processing unit for generating feature information representing a normal state of the process, wherein the processing unit includes: a feature information generating unit that generates, for each process characteristic, candidate feature information representing a feature of the normal process data from a plurality of normal process data acquired when a process having a plurality of process characteristics is in a normal state; and a searching unit that evaluates the candidate feature information based on an error between the normal process data and estimated process data calculated using the candidate feature information, and searches for optimal feature information for each of the process characteristics. (21) The program according to (20), wherein the searching unit calculates an evaluation threshold from a quartile of the error and evaluates the feature information based on the number of pieces of normal process data that exceed the evaluation threshold. (22) The program according to (21), wherein the searching unit searches for feature information that minimizes the number of pieces of normal process data that exceed the evaluation threshold, as the optimal feature information.

[0110] 1 Anomaly detection system 10 Process 30 Process data storage unit 100 Feature information generation device 110 Feature information generation unit 120 Search unit 200 Anomaly detection device 210 Process data acquisition unit 220 Anomaly detection unit 300 Feature information storage unit 500 Terminal 900 Information processing device 901 CPU 903 ROM 905 RAM 907 Bus 909 Input I / F 911 Output I / F 913 Storage device 915 Drive 917 Connection port 919 Communication device 921 Input device 923 Output device 925 Removable recording medium 927 External device 929 Communication network

Images