Abnormality detection device and computer-readable recording medium

Abstract

An abnormality detection device according to the present disclosure comprises: a data acquisition unit that acquires data related to the state of an industrial machine; a feature amount creation unit that creates a feature amount indicating a feature of the state of the industrial machine on the basis of the data related to the state; a feature amount storage unit that stores the feature amount; a feature model storage unit that stores at least one feature model; an inference calculation unit that uses the feature model to calculate an evaluation value of the state of the industrial machine based on the feature amount; an abnormality determination unit that determines occurrence of some abnormality in the state of the industrial machine on the basis of the calculation result of the inference calculation unit; a state diagnosis unit that diagnoses the state of the industrial machine if the abnormality determination unit has determined occurrence of an abnormality in the industrial machine; and a feature model management unit that creates a feature model using the feature amount stored in the feature amount storage unit according to the result of diagnosis by the state diagnosis unit and adds the feature model to the feature model storage unit.

Description

Anomaly detection device and computer-readable recording medium

[0001] The present disclosure relates to an anomaly detection device and a computer-readable recording medium.

[0002] Breakdowns of industrial machinery such as machine tools and robots can cause a decrease in the availability of production sites. Even if there is no abnormality in the mechanism of the industrial machinery, wear and deterioration of parts can reduce the operating accuracy, leading to the occurrence of defective workpieces and abnormal operation. There is a need to perform preventive maintenance on industrial machinery to prevent a decrease in availability, defective workpieces, and abnormal operation. To achieve preventive maintenance, information (control signals, current values, vibration values, etc.) is collected from the industrial machinery while it is in operation. Methods have been proposed that use machine learning based on the collected information to model features that indicate the characteristics of the state of the industrial machinery and perform anomaly detection (e.g., Patent Documents 1 to 3, etc.).

[0003] JP 2020-123191 A JP 2021-110979 A JP 2018-156415 A

[0004] Anomaly detection technology detects the appearance of a feature not included in the feature model (a change in the state of the machine) as an anomaly. Therefore, even if an anomaly is detected, it is not clear whether an actual problem has occurred in the machine, or whether an unknown normal state has simply been detected as an anomaly. If an anomaly continues to be detected even when there is no problem with the operating state of the industrial machine, it is necessary to update the feature model so that similar states will not be detected as anomalies in the future.

[0005] Industrial machinery experiences a variety of abnormalities and state changes. Abnormalities in industrial machinery include scratches on bearings, increased vibration due to misalignment of shafts, and missing parts. Some state changes are also reversible. For this reason, it is difficult to detect anomalies using only a single feature model that is optimal for specific conditions.

[0006] The anomaly detection device disclosed herein solves the above problem by notifying an unknown anomaly when status data with features not included in the feature model appears, and updating the feature model based on the results of the resulting inspection of the industrial machinery.

[0007] One aspect of the present disclosure is an anomaly detection device including: a data acquisition unit that acquires data related to a state of an industrial machine; a feature creation unit that creates feature values ​​indicating characteristics of the state of the industrial machine based on the data related to the state; a feature storage unit that stores the feature values; a feature model storage unit that stores at least one feature model; an inference calculation unit that calculates an evaluation value of the state of the industrial machine based on the feature values ​​using the feature model; an abnormality determination unit that determines, based on a calculation result of the inference calculation unit, that some abnormality has occurred in the state of the industrial machine; a condition diagnosis unit that diagnoses the state of the industrial machine when the abnormality determination unit determines that an abnormality has occurred in the industrial machine; and a feature model management unit that creates a feature model using the feature values ​​stored in the feature storage unit according to a result of the diagnosis by the condition diagnosis unit, and adds the feature model to the feature model storage unit.

[0008] FIG. 1 is a hardware configuration diagram of an anomaly detection device according to a first embodiment. FIG. 2 is a block diagram showing the functions of an anomaly detection device according to a first embodiment. FIG. 3 is a schematic diagram showing an example in which an inference calculation unit performs inference based on feature quantities using a plurality of feature models. FIG. 4 is a table diagram showing an example of inference processing using feature models by the inference calculation unit. FIG. 5 is a table diagram showing another example of inference processing using feature models by the inference calculation unit. FIG. 6 is a table diagram showing another example of inference processing using feature models by the inference calculation unit. FIG. 7 is a screen diagram showing an example of a determination result by an anomaly determination unit. FIG. 8 is a screen diagram showing an example of a threshold setting screen. FIG. 9 is a schematic diagram showing an example of a feature model storage unit that stores feature models for each context. FIG. 10 is a block diagram showing the functions of an anomaly detection device according to a second embodiment.

[0009] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the following description, components having the same or similar functions will be denoted by the same reference numerals. Duplicate descriptions of those components may be omitted.

[0010] In this application, "based on XX" means "based on at least XX," and includes cases where it is based on other elements in addition to XX. Furthermore, "based on XX" is not limited to cases where XX is used directly, but also includes cases where it is based on XX that has been calculated or processed. "XX" is any element (for example, any information).

[0011] [First Embodiment] Fig. 1 is a schematic hardware configuration diagram showing the main parts of an anomaly detection device according to a first embodiment of the present disclosure. The anomaly detection device 1 of the present disclosure can be implemented, for example, on a control device that controls industrial machinery. The anomaly detection device 1 of the present disclosure can also be implemented on a computer such as a personal computer attached to the control device that controls industrial machinery, or a personal computer, cell computer, fog computer 6, or cloud server 7 connected to the control device via a wired or wireless network. In this embodiment, an example is shown in which the anomaly detection device 1 is implemented on a control device that controls industrial machinery.

[0012] The CPU 11 provided in the anomaly detection device 1 according to this embodiment is a processor that controls the entire anomaly detection device 1. The CPU 11 reads a system program stored in the ROM 12 via the bus 22, and controls the entire anomaly detection device 1 in accordance with the system program. The RAM 13 temporarily stores temporary calculation data, display data, various data input from outside, and the like.

[0013] The nonvolatile memory 14 is configured, for example, by a battery-backed memory or an SSD (Solid State Drive) (not shown), and maintains its stored state even when the power to the anomaly detection device 1 is turned off. The nonvolatile memory 14 stores programs and data read from an external device 72 via the interface 15, programs and data input via the input device 71, programs and data acquired from the industrial machine 2, and the like. The data stored in the nonvolatile memory 14 may be expanded into the RAM 13 during execution / use. In addition, various system programs such as known analysis programs are written in the ROM 12 in advance.

[0014] The interface 15 is an interface for connecting the CPU 11 of the anomaly detection device 1 to an external device 72 such as a USB memory, CompactFlash (registered trademark), or SD card. For example, control programs and various data used to control the industrial machine 2 can be read from the external device 72. Furthermore, control programs and various data edited within the anomaly detection device 1 can be stored in the external device 72. A programmable logic controller (PLC) 16 outputs signals to the industrial machine 2 and its peripheral devices (e.g., tool changers, actuators such as robots, sensors attached to the industrial machine 2, etc.) via an I / O unit 17 to control the industrial machine 2 and its peripheral devices (e.g., tool changers, actuators such as robots, sensors attached to the industrial machine 2, etc.) using a sequence program built into the anomaly detection device 1. The PLC 16 also receives signals from various switches on an operation panel installed on the main body of the industrial machine 2 and from peripheral devices, performs necessary signal processing, and then passes the signals to the CPU 11.

[0015] The display device 70 displays various data loaded into the memory, data obtained as a result of executing programs, etc., output via the interface 18. An input device 71, which is comprised of a keyboard, pointing device, etc., passes instructions, data, etc., based on operations by an operator to the CPU 11 via the interface 19.

[0016] The interface 20 is an interface for connecting the CPU 11 of the anomaly detection device 1 to a wired or wireless network 5. The network 5 may communicate using technologies such as serial communication such as RS-485, Ethernet (registered trademark), optical communication, wireless LAN, Wi-Fi (registered trademark), Bluetooth (registered trademark), etc. Computers such as a fog computer 6 and a cloud server 7 are connected to the network 5, and data is exchanged between the network 5 and the anomaly detection device 1.

[0017] The axis control circuit 30 for controlling the control axes of the industrial machine 2 receives position commands for the control axes from the CPU 11 and outputs commands for the control axes to the servo amplifier 40. The servo amplifier 40 receives these commands and drives the servo motors 50 for the control axes, moving each part of the industrial machine 2 along the respective control axes. Each servo motor 50 has a built-in position detector, and feeds back a position feedback signal from this position detector to the axis control circuit 30. The axis control circuit 30 performs feedback control of the servo motor 50 based on this position feedback signal. Note that while the hardware configuration diagram in FIG. 1 shows only one axis control circuit 30, one servo amplifier 40, and one servo motor 50, in reality, there are as many axis control circuits 30, as there are control axes of the industrial machine 2 to be controlled. For example, to control a typical machine tool with three linear axes, three sets of axis control circuits 30, servo amplifiers 40, and servo motors 50 are provided to move a spindle to which a tool is attached and a workpiece relatively in the three linear axes (X-axis, Y-axis, and Z-axis).

[0018] The spindle control circuit 60 receives a spindle rotation command and outputs a spindle speed signal to a spindle amplifier 61. The spindle amplifier 61 receives this spindle speed signal and rotates a spindle motor 62 of the industrial machine 2 at the commanded rotation speed, thereby driving the spindle. A position coder 63 is connected to the spindle motor 62. The position coder 63 outputs a feedback pulse in synchronization with the rotation of the spindle, and this feedback pulse is read by the CPU 11. Note that while the hardware configuration diagram in FIG. 1 shows only one spindle control circuit 60, one spindle amplifier 61, and one spindle motor 62, in reality, there are as many spindle control circuits 60, spindle amplifiers 61, and spindle motors 62 as there are control axes provided in the industrial machine 2 to be controlled. Furthermore, industrial machines 2 that do not have a spindle may not have these components.

[0019] Interface 21 is an interface for connecting CPU 11 and machine learning device 100. Machine learning device 100 includes processor 101 that controls the entire machine learning device 100, ROM 102 that stores system programs and the like, RAM 103 that provides temporary storage for each process related to machine learning, and non-volatile memory 104 that stores models and the like. Machine learning device 100 can observe each piece of information that can be acquired by anomaly detection device 1 via interface 21. In addition, anomaly detection device 1 acquires processing results output from machine learning device 100 via interface 21, and stores or displays the acquired results, or transmits them to another device via network 5 or the like.

[0020] 2 is a schematic block diagram illustrating functions of the anomaly detection device 1 according to the first embodiment of the present disclosure. Each function of the anomaly detection device 1 according to this embodiment is realized by the CPU 11 of the anomaly detection device 1 and the processor 101 of the machine learning device 100 shown in FIG. 1 executing a system program and controlling the operation of each unit of the anomaly detection device 1 and the machine learning device 100.

[0021] The anomaly detection device 1 of this embodiment includes a data acquisition unit 110, a feature creation unit 120, an inference calculation unit 140, an anomaly determination unit 150, a condition diagnosis unit 160, a feature model management unit 170, and an output unit 190. In addition, the RAM 103 to the nonvolatile memory 104 of the machine learning device 100 are provided with a feature model storage unit 210, which is an area for storing at least one feature model, and a feature storage unit 220, which is an area for storing features.

[0022] The data acquisition unit 110 acquires data relating to a predetermined state acquired from the industrial machine 2. Examples of data relating to the state of the industrial machine 2 include the feed rate, the load on the feed axis, the spindle rotation speed, the load on the spindle, a position feedback value, and a vibration value. The data acquisition unit 110 may also acquire context information such as a signal indicating the predetermined state (such as a cutting in progress signal), a program number, and a tool number. The data acquisition unit 110 outputs the acquired data to the feature creation unit 120.

[0023] The feature creation unit 120 creates feature quantities that indicate characteristics of the state of the industrial machine 2 based on data related to the state of the industrial machine 2 acquired by the data acquisition unit 110. The feature quantities created by the feature creation unit 120 are useful information for determining whether an abnormality in the state of the industrial machine 2 is detected. The feature quantities created by the feature creation unit 120 may be obtained by performing predetermined statistical calculations (such as average and variance), frequency characteristic calculations, or normalization based on predetermined criteria on the acquired state data. The feature quantities created by the feature creation unit 120 include multiple values ​​created based on data related to at least one state. An example of a feature quantity to be used as a feature quantity is, for example, the spindle load acquired by the data acquisition unit 110, sampled at a predetermined sampling interval for a predetermined period in the past. Another example of a feature quantity is the peak value of the vibration value of the servo motor 50 attached to the industrial machine 2 within a predetermined period in the past. The feature creation unit 120 outputs the created feature quantities to the inference calculation unit 140. The feature creation unit 120 also stores the created feature in the feature storage unit 220 in association with the time when the data relating to the state from which the feature was created was acquired.

[0024] The inference calculation unit 140 calculates an evaluation value that infers the state of the industrial machine 2 using at least one feature model stored in the feature model storage unit 210, based on the feature quantities input from the feature quantity creation unit 120. FIG. 3 is a schematic diagram showing an example in which the inference calculation unit 140 performs inference based on feature quantities using multiple feature models. As shown in FIG. 3, the inference calculation unit 140 configures a machine learning device that uses each of multiple feature models 1-1 to 1-n stored in the feature model storage unit 210, and inputs feature quantities 1 to m created by the feature quantity creation unit 120 as input data to each machine learning device. The inference calculation unit 140 then calculates inference results 1 to n as outputs. Each of the inference results 1 to m becomes an evaluation value 1 to m that infers the state of the industrial machine 2. The inference calculation unit 140 outputs at least one evaluation value as an inference result to the abnormality determination unit 150.

[0025] The feature model storage unit 210 stores in advance at least one feature model that can be used to infer the state of the industrial machine 2. This feature model may be created based on state data acquired from the industrial machine 2. Alternatively, for example, a feature model used for another industrial machine of the same type as the industrial machine 2 may be used. Each feature model may be, for example, a feature model (hereinafter referred to as a normality feature model) created by machine learning of feature quantities created based on state data acquired when the industrial machine 2 is operating normally. The normality feature model is used to infer, when at least one feature quantity is input, whether the feature quantity falls within the range of feature quantities obtained from the industrial machine 2 operating normally. By using the normality feature model, it is possible to determine an abnormality when the feature quantity falls outside the range of feature quantities for normal operation. Each feature model may be, for example, a feature model (hereinafter referred to as an abnormality feature model) created by machine learning of feature quantities created based on state data acquired when the industrial machine 2 is operating abnormally. The abnormality feature model is used to infer, when at least one feature quantity is input, whether the feature quantity falls within the range of feature quantities obtained from the industrial machine 2 operating in a predetermined abnormal state. By using an anomaly feature model, it is possible to determine that an anomaly exists when the feature value falls within the range of an anomaly. Each feature model may be created by machine learning based on data relating to a different state. Furthermore, each feature model may be a machine learning model using a different method. For example, the feature model may be a model for performing inference processing using a multilayer neural network, or may be a known machine learning model such as a VAE (Variational AutoEncoder), a Bayesian network, a support vector machine, a Gaussian mixture model, or a cluster model. The feature model may be a model for performing inference using a method such as supervised learning, unsupervised learning, or reinforcement learning.

[0026] The abnormality determination unit 150 determines that some abnormality has occurred in the state of the industrial machine 2 based on at least one evaluation value input from the inference calculation unit 140. The abnormality determination unit 150 compares each of the evaluation values ​​inferred by, for example, a normality characteristic model with a predetermined threshold value. Next, if the comparison result with the threshold value satisfies a predetermined condition, it determines that there is an abnormality in the state of the industrial machine 2 from the evaluation value. Then, if it is determined that the industrial machine 2 is in an abnormal state from all of the evaluation values, it determines that some abnormality has occurred in the industrial machine 2. On the other hand, if it is determined that the industrial machine 2 is in a normal state from some of the characteristic models, it determines that the industrial machine 2 is not in an abnormal state.

[0027] [Correction Based on Rule 91, 17.10.2025] Figure 4 is a table diagram showing an example of inference processing using feature models by the inference calculation unit 140. In the example of Figure 4, normality characteristic models 1 to 4 are stored in the feature model storage unit 210. Assume that inference is performed using normality characteristic models 1 to 4 based on feature quantities created based on data related to the state of the industrial machine 2. In the example of Figure 4, an evaluation value of 4.5 is calculated as the inference result using normality characteristic model 1. Similarly, an evaluation value of 7.5 is calculated as the inference result using normality characteristic model 2, an evaluation value of 6.4 is calculated as the inference result using normality characteristic model 3, and an evaluation value of 3.3 is calculated as the inference result using normality characteristic model 4. Here, the evaluation value calculated using normality characteristic model 1 is set so that if it is greater than threshold value 6, it is determined that there is an abnormality in the state of the industrial machine 2. Similarly, it is set so that it is determined that there is an abnormality in the state of the industrial machine 2 when the evaluation value calculated using normality characteristic model 2 is greater than threshold value 7, when the evaluation value calculated using normality characteristic model 3 is greater than threshold value 5, and when the evaluation value calculated using normality characteristic model 4 is greater than threshold value 6. In the example of FIG. 4 , the evaluation values ​​calculated using normality characteristic models 2 and 3 exceed the threshold values, so it is determined that there is an abnormality in the state of the industrial machine 2. However, the evaluation values ​​calculated using normality characteristic models 1 and 4 are equal to or less than the threshold values, so it is determined that there is no abnormality in the state of the industrial machine 2. In such cases, the abnormality determination unit 150 determines that no abnormality has occurred in the industrial machine 2.

[0028] FIG. 5 is a table diagram showing another example of inference processing using feature models by the inference calculation unit 140. In the example of FIG. 5, normality characteristic models 1 to 4 are stored in the feature model storage unit 210. Then, it is assumed that inference is performed using normality characteristic models 1 to 4 based on feature quantities created based on data related to the state acquired from the industrial machine 2. In the example of FIG. 5, an evaluation value of 7.0 is calculated as the inference result using normality characteristic model 1. Similarly, an evaluation value of 8.2 is calculated as the inference result using normality characteristic model 2, an evaluation value of 6.8 is calculated as the inference result using normality characteristic model 3, and an evaluation value of 6.2 is calculated as the inference result using normality characteristic model 4. In this case, all of the evaluation values ​​calculated using normality characteristic models 1 to 4 exceed the threshold value. Therefore, the abnormality determination unit 150 determines that an abnormality has occurred in the industrial machine 2.

[0029] When the anomaly determination unit 150 determines that some kind of abnormality has occurred in the industrial machine 2 using the evaluation value inferred by the normality characteristic model, it may further determine whether the abnormality is a known abnormality using the evaluation value inferred by the abnormality characteristic model. In this case, the anomaly determination unit 150, for example, compares each of the evaluation values ​​inferred by the abnormality characteristic models with a predetermined threshold. Then, when the comparison result with the threshold satisfies a predetermined condition, it determines that a known abnormality exists in the state of the industrial machine 2. Furthermore, when the comparison result with the threshold does not satisfy a predetermined condition for all of the evaluation values ​​inferred by the abnormality characteristic models, it determines that an unknown abnormality has occurred in the industrial machine 2. Note that, when no abnormality characteristic model related to the state of the industrial machine 2 is stored in the characteristic model storage unit 210, it may be determined that an unknown abnormality has occurred in the industrial machine 2 when it is determined that some kind of abnormality has occurred in the industrial machine 2 using the evaluation value inferred by the normality characteristic model.

[0030] FIG. 6 is a table diagram showing another example of inference processing using feature models by the inference calculation unit 140. In the example of FIG. 6, normality feature models 1 to 4 and abnormality feature models 1 and 2 are stored in the feature model storage unit 210. Then, based on the result of inference using normality feature models 1 to 4 based on feature quantities created based on data related to the state acquired from the industrial machine 2, the abnormality determination unit 150 determines that some abnormality has occurred in the industrial machine 2. Next, the abnormality determination unit 150 refers to the result of inference using abnormality feature models 1 and 2. In the example of FIG. 6, an evaluation value of 8.2 is calculated as the inference result using abnormality feature model 1. Furthermore, an evaluation value of 9.6 is calculated as the inference result using abnormality feature model 2. In the example of FIG. 6, neither of the evaluation values ​​using abnormality feature models 1 and 2 satisfy the conditions of the set thresholds. Therefore, the abnormality determination unit 150 determines that an unknown abnormality has occurred in the industrial machine 2.

[0031] Fig. 7 is a table diagram showing another example of inference processing using feature models by the inference calculation unit 140. In the example of Fig. 7, similar to the example of Fig. 6, based on the results of inference using normality feature models 1 to 4, the abnormality determination unit 150 determines that some kind of abnormality has occurred in the industrial machine 2. On the other hand, the evaluation value using abnormality feature model 1 satisfies the condition of being smaller than threshold value 7, while the evaluation value using abnormality feature model 2 does not satisfy the threshold value condition. Therefore, the abnormality determination unit 150 determines that a known abnormality related to abnormality feature model 1 has occurred in the industrial machine 2.

[0032] The abnormality determination unit 150 outputs the determination result related to the state of the industrial machine 2 to the output unit 190. Fig. 8 is a screen diagram illustrating an example of the determination result by the abnormality determination unit. In the example of Fig. 8, the transitions of evaluation values ​​by a plurality of feature models are displayed side by side. Furthermore, when the abnormality determination unit 150 determines that an unknown abnormality has occurred in the industrial machine 2, it notifies the state diagnosis unit 160 that an abnormality has been determined in the state of the industrial machine 2.

[0033] The condition diagnosis unit 160 diagnoses the condition of the industrial machinery 2 when the abnormality determination unit 150 notifies the condition diagnosis unit 160 that an abnormality has occurred in the industrial machinery 2. The condition diagnosis unit 160 may immediately diagnose the condition of the industrial machinery 2 when the abnormality determination unit 150 notifies the condition diagnosis unit 160. However, preferably, the condition diagnosis unit 160 may analyze the condition of the industrial machinery 2 when a similar notification has continued for a predetermined period of time or when a similar notification has been received a predetermined number of times. In this manner, a certain amount of feature quantities created in similar conditions can be accumulated in the feature quantity storage unit 220. For example, the condition diagnosis unit 160 may cause the industrial machinery 2 to perform a predetermined diagnostic operation and automatically diagnose the condition of the industrial machinery 2 based on the results. In this case, a control program related to the diagnostic operation is prepared in advance. The operator is then prompted to execute the control program related to the diagnostic operation. An unknown abnormality occurring in the industrial machinery 2 is then automatically diagnosed based on the results. Alternatively, the condition diagnosis unit 160 may simply prompt the operator to inspect the industrial machinery 2 and input information related to the inspection results, thereby diagnosing the condition of the industrial machinery 2.

[0034] The result of the diagnosis of the state of the industrial machine 2 may be either a case where no abnormality has occurred or a case where an abnormality has occurred. Furthermore, if an abnormality has occurred, the result may include information relating to the nature of the abnormality. If the state diagnosis unit 160 diagnoses that no abnormality has occurred in the industrial machine 2, this means that the industrial machine 2 was not in an abnormal state even though the abnormality determination unit 150 determined that an unknown abnormality had occurred in the industrial machine 2. In such a case, the state diagnosis unit 160 instructs the feature model management unit 170 to create a new normality feature model. On the other hand, if the state diagnosis unit 160 diagnoses that an abnormality has occurred in the industrial machine 2, this means that some new abnormality has been recognized. In such a case, the state diagnosis unit 160 may instruct the feature model management unit 170 to create a new abnormality feature model related to the abnormality that has occurred. The state diagnosis unit 160 outputs the diagnosis result of the state of the industrial machine 2 to the output unit 190.

[0035] The feature model management unit 170 creates a feature model based on an instruction from the condition diagnosis unit 160. When the feature model management unit 170 is instructed by the condition diagnosis unit 160 to create a new normality feature model, the feature model management unit 170 reads out from the feature storage unit 220 a plurality of feature quantities calculated during the period in which the abnormality was detected. Then, the feature model management unit 170 creates a normality feature model based on machine learning of the read feature quantities. Furthermore, when the feature model management unit 170 is instructed by the condition diagnosis unit 160 to create a new abnormality feature model, the feature model management unit 170 reads out from the feature storage unit 220 a plurality of feature quantities calculated during the period in which the abnormality was detected. Then, the feature model management unit 170 creates an abnormality feature model based on machine learning of the read feature quantities. At this time, the feature model management unit 170 may have the operator specify a range of feature quantities to use to create the model. The threshold value for determining the evaluation value of each feature model may be determined appropriately depending on the type of feature model to be created and the distribution of feature quantities used for learning. For example, a numerical value corresponding to a predetermined percentile (e.g., 75th percentile) may be calculated for the feature quantity used in creating the feature model, and the calculated value may be multiplied by a predetermined multiple (e.g., 1.5 times) to set the threshold. In this case, multiple percentile values ​​may be set, and stricter and looser thresholds may be calculated. The calculated threshold value may be presented to the operator to request confirmation and correction. Furthermore, as illustrated in FIG. 9 , a transition of the degree of anomaly calculated based on the created feature model may be displayed on the display device 70 to prompt the operator to set a threshold. The feature model management unit 170 stores the created feature model in the feature model storage unit 210. The feature model stored in the feature model storage unit 210 is used for subsequent determination of the state of the industrial machine 2.

[0036] The output unit 190 outputs the result of the determination by the abnormality determination unit 150 and the result of the diagnosis by the state diagnosis unit. The output unit 190 may be configured to display and output the determination result and the diagnosis result on the display device 70. The output unit 190 may also be configured to transmit and output the results to a higher-level computer such as the fog computer 6 or the cloud server 7 via the network 5. The results may also be recorded and output in a log recording area provided on the RAM 13 or the non-volatile memory 14 of the abnormality detection device 1.

[0037] In the anomaly detection device 1 according to the present embodiment having the above-described configuration, if the state of the industrial machinery 2 has changed since the time the feature model stored in the feature model storage unit 210 was created and some unknown anomaly is detected, and if the inspection determines that there is no problem, a new normality feature model is created using the feature quantities created at that time. Therefore, in subsequent anomaly detections, similar states can be excluded from anomaly detection targets. Since inspection of the industrial machinery 2 only needs to be performed when an unknown anomaly occurs (when the state of the machine changes), the accuracy of anomaly detection can be improved with a minimum number of judgments.

[0038] Furthermore, a feature model can be created for each state of the industrial machine 2. Therefore, by assigning meaning to each feature model, it is expected that the interpretability of anomalies will improve. When an unknown anomaly is detected, it can be interpreted that there was no similar machine state in the past. Therefore, by creating a new feature model using feature quantities created within the range in which the anomaly was detected, it is possible to create a feature model with high interpretability that narrows the range of judgment. When a known anomaly is detected, it can be interpreted that there was a similar machine state in the past. Even when no anomaly is detected, it can be determined which state the anomaly is similar to among the machine states that were previously determined to be problem-free.

[0039] In operation using the anomaly detection device 1 according to this embodiment having the above-described configuration, a normality feature model is initially stored in the feature model storage unit 210. This normality feature model may be created based on feature quantities created from data relating to a relatively small number of states that can be obtained when the industrial machine 2 is operating normally. Then, when an unknown abnormality occurs while the industrial machine 2 is operating, a diagnosis is performed, and new normality feature models and abnormality feature models are added based on the results. Increasing the number of feature models in this way increases the accuracy of determining whether the industrial machine 2 is in a normal state or an abnormal state. This reduces implementation costs and makes it possible to create a group of feature models that are tailored to the characteristics of the industrial machine 2 as the industrial machine 2 continues to be operated.

[0040] As a modified example of the anomaly detection device 1 according to the present embodiment, multiple feature model groups may be prepared for each set of context information of the industrial machine 2. FIG. 10 is a schematic diagram showing an example of feature model groups stored in the feature model storage unit 210 according to this modified example. The feature model storage unit 210 according to this modified example stores at least one feature model group for each set of context information of the industrial machine 2. Each feature model group includes at least one feature model. When performing inference processing based on feature quantities created based on state data acquired from the industrial machine 2, the inference calculation unit 140 selects a feature model group to use according to the context information of the industrial machine 2. Then, inference is performed using at least one feature model included in the selected feature model group. Furthermore, when instructed to create a feature model, the feature model management unit 170 adds the created feature model to a feature model group corresponding to the context information. This configuration makes it possible to use feature models appropriate for the context information, which is expected to improve the accuracy of anomaly detection.

[0041] As another modification of the anomaly detection device 1 according to the present embodiment, the feature model management unit 170 may update or delete the feature models stored in the feature model storage unit 210. The feature model management unit 170 updates or deletes the feature models stored in the feature model storage unit 210, for example, in response to an instruction from an operator. When an inappropriate model is found among the feature models stored in the feature model storage unit 210, the operator instructs the update or deletion of the inappropriate model. This is done, for example, when a feature model used in another industrial machine is used to diagnose the state of the industrial machine 2 and a diagnostic trend different from that of the other industrial machines emerges, or when an abnormality in the industrial machine 2 is later discovered when a normality feature model created by the feature model management unit 170 is later verified. By providing such a function, it becomes possible to manage appropriate feature models to be used for diagnosing the industrial machine 2.

[0042] Second Embodiment An anomaly detection device according to a second embodiment will be described below. The anomaly detection device 1 according to this embodiment has the same hardware configuration as the anomaly detection device 1 according to the first embodiment.

[0043] 11 is a schematic block diagram illustrating functions of the anomaly detection device 1 according to the second embodiment of the present disclosure. Each function of the anomaly detection device 1 according to this embodiment is realized by the CPU 11 of the anomaly detection device 1 and the processor 101 of the machine learning device 100 shown in FIG. 1 executing a system program and controlling the operation of each unit of the anomaly detection device 1 and the machine learning device 100.

[0044] The anomaly detection device 1 of this embodiment further includes a feature quantity management unit 180 in addition to the data acquisition unit 110, feature quantity creation unit 120, inference calculation unit 140, anomaly determination unit 150, state diagnosis unit 160, feature quantity management unit 170, and output unit 190. Furthermore, on the RAM 103 to the nonvolatile memory 104 of the machine learning device 100, in addition to a feature model storage unit 210 which is an area for storing at least one feature model and a feature quantity storage unit 220 which is an area for storing feature quantities, an abnormality feature quantity storage unit 230 which is an area for storing feature quantities created when the industrial machine 2 is in an abnormal state is provided.

[0045] The functions of the data acquisition unit 110, feature creation unit 120, inference calculation unit 140, abnormality determination unit 150, feature model management unit 170, and output unit 190 according to this embodiment are the same as those of the first embodiment.

[0046] When the condition diagnosis unit 160 diagnoses an unknown abnormality occurring in the industrial machine 2, the feature amount management unit 180 according to this embodiment stores, based on the diagnosis result, the feature amounts created by the feature amount creation unit 120 during the period in which the abnormality was diagnosed, as feature amounts related to the abnormal state in the abnormality feature amount storage unit 230. At this time, the feature amount management unit 180 associates information related to the content of the abnormality diagnosed by the condition diagnosis unit 160 with the feature amounts related to the abnormal state and stores them.

[0047] When diagnosing an unknown abnormality in the industrial machine 2, the condition diagnosis unit 160 according to this embodiment calculates the similarity between the feature created by the feature creation unit 120 and each feature stored in the abnormality feature storage unit 230. For example, the condition diagnosis unit 160 may regard the feature as a vector having elements of each value included in the feature, calculate the Euclidean distance between the feature, and consider the smaller the value, the higher the similarity. The condition diagnosis unit 160 may then diagnose the content of the abnormality associated with the feature related to the abnormal state with the highest similarity as the currently occurring abnormality. If there is no feature related to an abnormal state within a predetermined distance from the feature created by the feature creation unit 120, the condition diagnosis unit 160 may diagnose the currently occurring abnormality as an unknown abnormality.

[0048] The anomaly detection device 1 according to this embodiment, which is configured as described above, stores feature quantities created when an abnormality has previously occurred in the industrial machine 2 as feature quantities related to an abnormal state in association with the content of the abnormality, and when a new abnormality occurs, if a feature quantity related to an abnormal state similar to the created feature quantity is stored in the abnormality feature storage unit 230, the abnormality is treated as a known abnormality, but if a feature quantity related to a similar abnormal state is not stored, the abnormality is diagnosed as an unknown abnormality.

[0049] As a modified example of the anomaly detection device 1 according to this embodiment, when a currently occurring anomaly is diagnosed as a known anomaly based on feature quantities related to an abnormal state, the condition diagnosis unit 160 may instruct the feature model management unit 170 to update the existing anomaly feature model related to the abnormal state. Similar feature quantities indicate a high probability that the anomalies belong to the same group. At this time, the condition diagnosis unit 160 transmits to the feature model management unit 170 the feature quantities diagnosed as a known anomaly and feature quantities related to the abnormal state associated with the content of the known anomaly stored in the anomaly feature quantity storage unit 230. The feature model management unit 170 uses the multiple feature quantities sent to update the anomaly feature model related to the abnormal state. As a result, when a known anomaly is diagnosed, the anomaly feature model is updated to match the diagnosis result, which is expected to improve the accuracy of anomaly detection.

[0050] Although the embodiments of the present disclosure have been described in detail above, the present disclosure is not limited to the individual embodiments described above. Various additions, substitutions, modifications, partial deletions, etc. are possible in these embodiments without departing from the gist of the invention or the idea and intent of the present disclosure derived from the content described in the claims and their equivalents. For example, in the above-described embodiments, the order of each operation and the order of each process are shown as examples and are not limited to these. The same applies when numerical values ​​or mathematical expressions are used in the description of the above-described embodiments.

[0051] The following are supplementary notes related to embodiments of the present disclosure. (Supplementary Note 1) An anomaly detection device (1) according to one aspect of the present disclosure includes a data acquisition unit (110) that acquires data related to the state of an industrial machine (2), a feature creation unit (120) that creates feature quantities indicating features of the state of the industrial machine (2) based on the data related to the state, a feature storage unit (220) that stores the feature quantities, a feature model storage unit (210) that stores at least one feature model, an inference calculation unit (140) that calculates an evaluation value of the state of the industrial machine (2) based on the feature quantities using the feature model, and the inference calculation unit The industrial machine (2) includes an abnormality determination unit (150) that determines that some abnormality has occurred in the state of the industrial machine (2) based on the calculation result of (140); a condition diagnosis unit (160) that diagnoses the state of the industrial machine (2) when the abnormality determination unit (150) determines that an abnormality has occurred in the industrial machine (2); and a feature model management unit (170) that creates a feature model using the feature amounts stored in the feature amount storage unit (220) according to the result of the diagnosis by the condition diagnosis unit (160) and adds the feature model to the feature model storage unit (210).

[0052] (Supplementary Note 2) The inference calculation unit (140) included in the anomaly detection device (1) according to another aspect of the present disclosure calculates an evaluation value for the state of the industrial machine (2) using each feature model stored in the feature model storage unit (210). (Supplementary Note 3) The anomaly determination unit (150) included in the anomaly detection device (1) according to another aspect of the present disclosure determines that some kind of anomaly has occurred in the state of the industrial machine (2) using a predetermined judgment formula for at least one evaluation value calculated by the inference calculation unit (140). (Supplementary Note 4) The state diagnosis unit (160) included in the anomaly detection device (1) according to another aspect of the present disclosure receives inspection information of the industrial machine (2) and diagnoses the presence or absence of an anomaly based on the received inspection information when the anomaly determination unit (150) determines that an unknown anomaly has occurred.

[0053] (Supplementary Note 5) The condition diagnosis unit (160) included in the anomaly detection device (1) according to another aspect of the present disclosure diagnoses the condition of the industrial machine (2) when the anomaly determination unit (150) determines that some abnormality has occurred in the condition of the industrial machine (2) for a predetermined period of time or a predetermined number of times, and the feature model management unit (170) creates a feature model using the feature amounts created while the anomaly determination unit (150) determined that there is an abnormality. (Supplementary Note 6) The anomaly detection device (1) according to another aspect of the present disclosure further includes an abnormality feature amount storage unit (230) that stores feature amounts created when the condition of the industrial machine (2) is abnormal, and a feature amount management unit (180) that adds feature amounts used by the feature model management unit (170) to create a feature model to the abnormality feature amount storage unit (230) when the condition diagnosis unit (160) diagnoses that the condition of the industrial machine (2) is abnormal. (Supplementary Note 7) The condition diagnosis unit (160) provided in the anomaly detection device (1) according to another aspect of the present disclosure diagnoses whether the anomaly that has occurred is a known anomaly, based on the features created by the feature creation unit (120) and the features stored in the anomaly feature storage unit (230).

[0054] (Supplementary Note 8) The anomaly detection device (1) according to another aspect of the present disclosure further includes an output unit (190) that displays and outputs a result of the determination made by the anomaly determination unit (150). (Supplementary Note 9) The feature model management unit (170) included in the anomaly detection device (1) according to another aspect of the present disclosure updates or deletes the feature models stored in the feature model storage unit (210) based on an operation by an operator.

[0055] (Supplementary Note 10) A computer-readable recording medium according to one aspect of the present disclosure includes a data acquisition unit (110) that acquires data related to a state of an industrial machine (2), a feature creation unit (120) that creates a feature indicating a feature of the state of the industrial machine (2) based on the data related to the state, a feature storage unit (220) that stores the feature, a feature model storage unit (210) that stores at least one feature model, an inference calculation unit (140) that calculates an evaluation value of the state of the industrial machine (2) based on the feature using the feature model, and a calculation unit (150) for calculating an evaluation value of the state of the industrial machine (2) based on the feature. The computer records a program that causes the computer to operate as an abnormality determination unit (150) that determines that some abnormality has occurred in the state of the industrial machine (2) based on the calculation result, a condition diagnosis unit (160) that diagnoses the state of the industrial machine (2) when the abnormality determination unit (150) determines that an abnormality has occurred in the industrial machine (2), and a feature model management unit (170) that creates a feature model using the feature amounts stored in the feature amount storage unit (220) according to the result of the diagnosis by the condition diagnosis unit (160) and adds the model to the feature model storage unit (210).

[0056] 1 Anomaly detection device 2 Industrial machine 5 Network 6 Fog computer 7 Cloud server 11 CPU 12 ROM 13 RAM 14 Non-volatile memory 15 Interface 16 PLC 17 I / O unit 18, 19, 20, 21 Interface 22 Bus 30 Axis control circuit 40 Servo amplifier 50 Servo motor 60 Spindle control circuit 61 Spindle amplifier 62 Spindle motor 63 Position coder 70 Display device 71 Input device 72 External device 100 Machine learning device 101 Processor 102 ROM 103 RAM 104 Non-volatile memory 110 Data acquisition unit 120 Feature creation unit 140 Inference calculation unit 150 Anomaly determination unit 160 Condition diagnosis unit 170 Feature model management unit 180 Feature management unit 190 Output unit 210 Feature model storage unit 220 Feature amount storage unit 230 Abnormal feature amount storage unit

Claims

1. An anomaly detection device comprising: a data acquisition unit that acquires data related to the state of an industrial machine; a feature creation unit that creates feature quantities that indicate characteristics of the state of the industrial machine based on the data related to the state; a feature storage unit that stores the feature quantities; a feature model storage unit that stores at least one feature model; an inference calculation unit that calculates an evaluation value of the state of the industrial machine based on the feature quantities using the feature model; an abnormality determination unit that determines that some abnormality has occurred in the state of the industrial machine based on the calculation result of the inference calculation unit; a condition diagnosis unit that diagnoses the state of the industrial machine when the abnormality determination unit determines that an abnormality has occurred in the industrial machine; and a feature model management unit that creates a feature model using the feature quantities stored in the feature storage unit according to the result of the diagnosis by the condition diagnosis unit, and adds the feature model to the feature model storage unit.

2. The anomaly detection device according to claim 1, wherein the inference calculation unit calculates an evaluation value of the state of the industrial machine using each feature model stored in the feature model storage unit.

3. The anomaly detection device according to claim 1, wherein the anomaly judgment unit judges that some kind of anomaly has occurred in the state of the industrial machine using a predetermined judgment formula for at least one evaluation value calculated by the inference calculation unit.

4. The anomaly detection device according to claim 1, wherein when the anomaly determination unit determines that an unknown anomaly has occurred, the condition diagnosis unit receives inspection information for the industrial machinery and diagnoses whether an anomaly exists based on the received inspection information.

5. The anomaly detection device according to claim 1, wherein the condition diagnosis unit diagnoses the condition of the industrial machine when the abnormality determination unit determines that some abnormality has occurred in the condition of the industrial machine for a predetermined period of time or a predetermined number of times, and the feature model management unit creates a feature model using the feature quantities created during the period in which the abnormality determination unit determines that an abnormality has occurred.

6. The anomaly detection device according to claim 1, further comprising: an abnormality feature storage unit that stores features created when the state of the industrial machine is abnormal; and a feature management unit that, when the state diagnosis unit diagnoses that the state of the industrial machine is abnormal, adds to the abnormality feature storage unit the features used by the feature model management unit to create a feature model.

7. The anomaly detection device according to claim 6, wherein the condition diagnosis unit diagnoses whether the anomaly that has occurred is a known anomaly based on the features created by the feature creation unit and the features stored in the anomaly feature storage unit.

8. The anomaly detection device according to claim 1, further comprising an output unit that displays and outputs the result of the determination made by the anomaly determination unit.

9. The anomaly detection device according to claim 1, wherein the feature model management unit updates or deletes the feature model stored in the feature model storage unit based on an operation by an operator.

10. A computer-readable recording medium having recorded thereon a program for causing a computer to operate as: a data acquisition unit that acquires data related to the state of industrial machinery; a feature creation unit that creates feature quantities that indicate characteristics of the state of the industrial machinery based on the data related to the state; a feature storage unit that stores the feature quantities; a feature model storage unit that stores at least one feature model; an inference calculation unit that calculates an evaluation value of the state of the industrial machinery based on the feature quantities using the feature model; an abnormality determination unit that determines that some abnormality has occurred in the state of the industrial machinery based on the calculation result of the inference calculation unit; a condition diagnosis unit that diagnoses the state of the industrial machinery when the abnormality determination unit determines that an abnormality has occurred in the industrial machinery; and a feature model management unit that creates a feature model using feature quantities stored in the feature storage unit according to the result of the diagnosis by the condition diagnosis unit, and adds the feature model to the feature model storage unit.

Images