Abnormality detection device and abnormality detection method

Abstract

This abnormality detection device is configured so as to comprise: a first waveform extraction unit (1) that extracts a waveform from a period in which the difference in a feature is greater than a first threshold from among waveform data indicating the behavior of a device when the device is normal; a cluster determination unit (2) that determines a cluster to which each of one or more waveforms extracted by the first waveform extraction unit (1) belongs; and a threshold calculation unit (3) that, for each cluster to which one or more waveforms belong, calculates a second threshold on the basis of the distribution of the features of the waveforms belonging to the cluster.

Description

Anomaly detection device and anomaly detection method

[0001] The present disclosure relates to an anomaly detection device and an anomaly detection method.

[0002] There are anomaly detection devices that detect abnormalities in equipment. For example, Patent Document 1 discloses an anomaly detection device that extracts a feature vector from a sensor signal output by a sensor attached to equipment, calculates an anomaly measure of the equipment based on the feature vector, and determines whether the equipment is abnormal based on the result of comparing the anomaly measure with a threshold value. The anomaly measure of the equipment is a value that indicates the likelihood of the equipment being abnormal.

[0003] JP 2014-032455 A

[0004] Sensor signals may change over time even when no abnormality occurs in the equipment. Furthermore, if the cause of the equipment abnormality differs, the feature vectors extracted from the sensor signals will differ, and therefore the anomaly measures of the equipment calculated based on the feature vectors will also differ. In the equipment status monitoring device disclosed in Patent Document 1, the same threshold is used to compare the anomaly measures, even when no abnormality occurs in the equipment or when the cause of the abnormality differs. Therefore, the equipment status monitoring device disclosed in Patent Document 1 has the problem of potentially overlooking an abnormality or overdetecting an abnormality.

[0005] The present disclosure has been made to solve the above-mentioned problems, and aims to provide an anomaly detection device that can reduce both the overlooking of anomalies and the overdetection of anomalies more than the equipment status monitoring device disclosed in Patent Document 1.

[0006] The anomaly detection device according to the present disclosure includes a first waveform extraction unit that extracts waveforms for a period in which the difference in characteristics is greater than a first threshold from waveform data that indicates the behavior of the equipment when the equipment is normal; a cluster determination unit that determines a cluster to which each of the one or more waveforms extracted by the first waveform extraction unit belongs; and a threshold calculation unit that calculates a second threshold for each cluster to which the one or more waveforms belong, based on the distribution of characteristics of the waveforms that belong to that cluster.

[0007] According to the present disclosure, it is possible to reduce both overlooking of abnormalities and overdetection of abnormalities more than the equipment status monitoring device disclosed in Patent Document 1.

[0008] FIG. 1 is a configuration diagram showing an anomaly detection device according to a first embodiment. FIG. 2 is a hardware configuration diagram showing hardware of the anomaly detection device according to the first embodiment. FIG. 3 is a hardware configuration diagram of a computer when the anomaly detection device is realized by software, firmware, or the like. FIG. 4 is a flowchart showing a part (threshold value calculation process) of an anomaly detection method which is a processing procedure of the anomaly detection device. FIG. 5 is a flowchart showing a part (anomaly detection process) of an anomaly detection method which is a processing procedure of the anomaly detection device. FIG. 6 is an explanatory diagram showing an example of waveform data indicating the behavior of an equipment when the equipment is normal. FIG. 7 is an explanatory diagram showing an example of anomaly scores for a plurality of time periods. ｊ Classification example of the waveform HSW by the clustering unit 2b ｊ 10 is an explanatory diagram showing an example of clustering of the second threshold Th calculated by the threshold calculation unit 3. ２，ｋ 1 is an explanatory diagram showing an example of an anomaly score for a plurality of time periods. FIG. 2 is an explanatory diagram showing an example of waveform data showing the behavior of an appliance when there is a possibility that an abnormality has occurred in the appliance. FIG. 3 is an explanatory diagram showing an example of anomaly scores for a plurality of time periods. FIG. 4 is a configuration diagram showing an anomaly detection device according to embodiment 2. FIG. 5 is a hardware configuration diagram showing the hardware of the anomaly detection device according to embodiment 2. FIG. 6 is an explanatory diagram showing an example where waveform data showing the behavior of an appliance when the appliance is normal is vibration waveform data. FIG. 7 is an explanatory diagram showing an example where waveform data showing the behavior of an appliance when there is a possibility that an abnormality has occurred in the appliance is vibration waveform data. FIG. 8 is an explanatory diagram showing an example of anomaly scores for a plurality of time periods. FIG. 9 is a configuration diagram showing an anomaly detection device according to embodiment 3. FIG. 10 is a hardware configuration diagram showing the hardware of the anomaly detection device according to embodiment 3.

[0009] In order to explain the present disclosure in more detail, embodiments of the present disclosure will be described below with reference to the accompanying drawings.

[0010] Embodiment 1. FIG. 1 is a configuration diagram showing an anomaly detection device according to embodiment 1. FIG. 2 is a hardware configuration diagram showing the hardware of the anomaly detection device according to embodiment 1. The anomaly detection device shown in FIG. 1 includes a first waveform extraction unit 1, a cluster determination unit 2, a threshold calculation unit 3, a threshold storage unit 4, a second waveform extraction unit 5, a cluster identification unit 6, an anomalous waveform detection unit 7, and a display processing unit 8. At sites where overdetection of anomalies frequently occurs, the workload of inspection and maintenance personnel confirming results increases. At sites where overdetection of anomalies frequently occurs, the risk of serious failures in the equipment and facilities increases. The anomaly detection device shown in FIG. 1 contributes to reducing the workload of maintenance and inspection personnel and reducing the risk of serious failures. Note that when using only a single threshold, a small threshold increases the risk of overdetection of anomalies, while a large threshold increases the risk of overdetection of anomalies. Using multiple thresholds can reduce overdetection of anomalies while suppressing overdetection of anomalies.

[0011] The first waveform extraction unit 1 is realized, for example, by the first waveform extraction circuit 21 shown in FIG. 2 . The first waveform extraction unit 1 includes an anomaly score calculation unit 1a and a high-score waveform extraction unit 1b. The first waveform extraction unit 1 acquires waveform data indicating the behavior of an equipment when the equipment is normal. The equipment is an equipment targeted for anomaly detection, such as a plant facility or a device having multiple components. The first waveform extraction unit 1 extracts, from the waveform data, a high-score waveform, which is a waveform for a period in which the difference in characteristics is greater than a first threshold. The first threshold may be stored in an internal memory of the first waveform extraction unit 1 or may be provided from outside the anomaly detection device shown in FIG. 1 . The first waveform extraction unit 1 outputs each of the one or more high-score waveforms to the cluster determination unit 2.

[0012] The abnormality score calculation unit 1a acquires waveform data that indicates the behavior of the device when the device is normal. The abnormality score calculation unit 1a calculates abnormality scores for multiple time periods in the waveform data. The abnormality score calculation unit 1a outputs the abnormality scores for the multiple time periods to the high-score waveform extraction unit 1b.

[0013] The high score waveform extraction unit 1b acquires the abnormality scores for a plurality of time periods from the abnormality score calculation unit 1a. The high score waveform extraction unit 1b calculates the abnormality scores for each time period and the threshold value Th １ Compare with the threshold value Th １ is a value obtained by converting the first threshold into an abnormality score. １ may be stored in an internal memory of the high score waveform extraction unit 1b, or may be provided from outside the anomaly detection device shown in FIG. 1. The high score waveform extraction unit 1b １ The waveform of the time period associated with the abnormality score greater than the threshold value is output to the cluster determination unit 2 as a high-score waveform.

[0014] The cluster determination unit 2 is realized, for example, by the cluster determination circuit 22 shown in FIG. 2 . The cluster determination unit 2 includes a waveform classification unit 2a and a clustering unit 2b. The cluster determination unit 2 acquires one or more high-score waveforms from the first waveform extraction unit 1. The cluster determination unit 2 determines the cluster to which each high-score waveform belongs. The cluster determination unit 2 outputs cluster information indicating the cluster to which each high-score waveform belongs to each of the threshold calculation unit 3 and the threshold storage unit 4. The cluster determination unit 2 also outputs waveform data of each high-score waveform to the threshold calculation unit 3.

[0015] The waveform classification unit 2a acquires one or more high-score waveforms from the first waveform extraction unit 1. The waveform classification unit 2a compares the shapes of the one or more high-score waveforms with each other. The waveform classification unit 2a classifies the one or more high-score waveforms based on the shape comparison results. The waveform classification unit 2a outputs the classification results of the high-score waveforms to the clustering unit 2b.

[0016] The clustering unit 2b acquires the classification results of the high-score waveforms from the waveform classification unit 2a. The clustering unit 2b clusters one or more high-score waveforms classified as having the same shape by the waveform classification unit 2a. The clustering unit 2b outputs cluster information indicating the cluster to which each high-score waveform belongs to each of the threshold calculation unit 3 and the threshold storage unit 4. The clustering unit 2b also outputs waveform data of each high-score waveform to the threshold calculation unit 3.

[0017] The threshold calculation unit 3 is realized, for example, by the threshold calculation circuit 23 shown in FIG. 2 . The threshold calculation unit 3 acquires waveform data and cluster information for each high-score waveform from the cluster determination unit 2. For each cluster to which one or more high-score waveforms belong, the threshold calculation unit 3 calculates a second threshold based on the distribution of characteristics of the high-score waveforms belonging to the cluster. Specifically, the threshold calculation unit 3 calculates the second threshold based on the high-score waveform with the most different characteristics among the one or more high-score waveforms belonging to the cluster. However, this is merely an example. If there is no practical problem, the threshold calculation unit 3 may calculate the second threshold based on, for example, the high-score waveform with the second most different characteristics among the one or more high-score waveforms belonging to the cluster. The threshold calculation unit 3 outputs the second threshold for each cluster to the threshold storage unit 4.

[0018] The threshold storage unit 4 is realized by, for example, the threshold storage circuit 24 shown in Fig. 2. The threshold storage unit 4 stores the cluster information output from the cluster determination unit 2 and the second threshold for each cluster calculated by the threshold calculation unit 3.

[0019] The second waveform extraction unit 5 is realized, for example, by the second waveform extraction circuit 25 shown in FIG. 2 . The second waveform extraction unit 5 includes an anomaly score calculation unit 5a and a high-score waveform extraction unit 5b. The second waveform extraction unit 5 acquires waveform data indicating the behavior of an equipment when an abnormality may occur in the equipment. The second waveform extraction unit 5 extracts, from the waveform data, a high-score waveform, which is a waveform during a period in which the difference in characteristics is greater than a first threshold. The first threshold may be stored in an internal memory of the second waveform extraction unit 5 or may be provided from outside the anomaly detection device shown in FIG. 1 . The second waveform extraction unit 5 outputs one or more high-score waveforms to the cluster identification unit 6 and the anomalous waveform detection unit 7, respectively.

[0020] The abnormality score calculation unit 5a acquires waveform data indicating the behavior of the device when there is a possibility that an abnormality has occurred in the device. The abnormality score calculation unit 5a calculates abnormality scores for multiple time periods in the waveform data. The abnormality score calculation unit 5a outputs the abnormality scores for the multiple time periods to the high-score waveform extraction unit 5b.

[0021] The high score waveform extraction unit 5b acquires the abnormality scores for a plurality of time periods from the abnormality score calculation unit 5a. The high score waveform extraction unit 5b calculates the abnormality scores for each time period and the threshold value Th １ The high-score waveform extracting unit 5b compares the threshold value Th １ The waveforms in the time periods associated with abnormality scores greater than the threshold value are output as high-score waveforms to the cluster specifying unit 6 and the abnormal waveform detecting unit 7, respectively.

[0022] The cluster identifying unit 6 is realized by, for example, the cluster identifying circuit 26 shown in FIG. 2 . The cluster identifying unit 6 acquires one or more high-score waveforms from the second waveform extracting unit 5. The cluster identifying unit 6 identifies the cluster to which each of the one or more high-score waveforms extracted by the second waveform extracting unit 5 belongs, from among the clusters determined by the cluster determining unit 2. The cluster identifying unit 6 outputs information about the cluster to which each high-score waveform belongs to the abnormal waveform detecting unit 7.

[0023] The abnormal waveform detection unit 7 is realized, for example, by the abnormal waveform detection circuit 27 shown in FIG. 2 . The abnormal waveform detection unit 7 acquires one or more high-score waveforms from the second waveform extraction unit 5 and acquires cluster information from the cluster identification unit 6. The abnormal waveform detection unit 7 acquires, as a threshold for each high-score waveform extracted by the second waveform extraction unit 5, a second threshold corresponding to the cluster identified by the cluster identification unit 6 from among one or more second thresholds calculated by the threshold calculation unit 3. That is, the abnormal waveform detection unit 7 acquires, as a threshold for each high-score waveform, a second threshold corresponding to the cluster identified by the cluster identification unit 6 from among the second thresholds for each cluster stored in the threshold storage unit 4. If part or all of each high-score waveform extracted by the second waveform extraction unit 5 is greater than the acquired second threshold, the abnormal waveform detection unit 7 detects each high-score waveform as an abnormal waveform. The abnormal waveform detection unit 7 outputs waveform data indicating the detected abnormal waveform to the display processing unit 8.

[0024] The display processing unit 8 is realized by, for example, the display processing circuit 28 shown in Fig. 2. The display processing unit 8 acquires waveform data indicating an abnormal waveform from the abnormal waveform detection unit 7. The display processing unit 8 outputs display data for displaying the abnormal waveform detected by the abnormal waveform detection unit 7 to a display (not shown).

[0025] 1, it is assumed that each of the components of the anomaly detection device, namely, a first waveform extraction unit 1, a cluster determination unit 2, a threshold calculation unit 3, a threshold storage unit 4, a second waveform extraction unit 5, a cluster identification unit 6, an anomalous waveform detection unit 7, and a display processing unit 8, is realized by dedicated hardware such as that shown in Fig. 2. In other words, it is assumed that the anomaly detection device is realized by a first waveform extraction circuit 21, a cluster determination circuit 22, a threshold calculation circuit 23, a threshold storage circuit 24, a second waveform extraction circuit 25, a cluster identification circuit 26, an anomalous waveform detection circuit 27, and a display processing circuit 28.

[0026] The threshold storage circuit 24 may be, for example, a semiconductor memory such as a RAM (Random Access Memory), a flash memory, a magnetic disk, a flexible disk, an optical disk, a compact disk, or a minidisk. The first waveform extraction circuit 21, the cluster determination circuit 22, the threshold calculation circuit 23, the second waveform extraction circuit 25, the cluster identification circuit 26, the abnormal waveform detection circuit 27, and the display processing circuit 28 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a combination thereof.

[0027] The components of the anomaly detection device are not limited to those realized by dedicated hardware, and the anomaly detection device may be realized by software, firmware, or a combination of software and firmware. The software or firmware is stored as a program in the memory of a computer. The computer refers to hardware that executes a program, and includes, for example, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, a processor, or a DSP (Digital Signal Processor).

[0028] 3 is a hardware configuration diagram of a computer when the anomaly detection device is realized by software, firmware, or the like. When the anomaly detection device is realized by software, firmware, or the like, a threshold storage unit 4 is configured on a memory 41 of the computer. Programs for causing the computer to execute the respective processing procedures of the first waveform extraction unit 1, cluster determination unit 2, threshold calculation unit 3, second waveform extraction unit 5, cluster identification unit 6, anomalous waveform detection unit 7, and display processing unit 8 are stored in the memory 41. A processor 42 of the computer then executes the programs stored in the memory 41.

[0029] 2 shows an example in which each of the components of the anomaly detection device is realized by dedicated hardware, while Fig. 3 shows an example in which the anomaly detection device is realized by software, firmware, etc. However, this is merely an example, and some of the components in the anomaly detection device may be realized by dedicated hardware, and the remaining components may be realized by software, firmware, etc.

[0030] Next, the operation of the anomaly detection device shown in Fig. 1 will be described. Fig. 4 is a flowchart showing a part of the anomaly detection method (threshold calculation process) which is a processing procedure of the anomaly detection device. Fig. 5 is a flowchart showing a part of the anomaly detection method (anomaly detection process) which is a processing procedure of the anomaly detection device.

[0031] First, the calculation process of the threshold value by the anomaly detection device will be described. The anomaly score calculation unit 1a of the first waveform extraction unit 1 acquires waveform data indicating the behavior of the device when the device is normal. Fig. 6 is an explanatory diagram showing an example of waveform data indicating the behavior of the device when the device is normal. In Fig. 6, the horizontal axis represents time, and the vertical axis represents the signal level of the waveform indicating the behavior of the device. As shown in Fig. 6, the signal level of the waveform indicating the behavior of the device may change over time, even if the device is normal.

[0032] The abnormality score calculation unit 1a calculates abnormality scores for multiple time periods in the waveform data (step ST1 in FIG. 4). As shown in FIG. 7, the abnormality score is small in time periods with small waveform fluctuations and large in time periods with large waveform fluctuations. FIG. 7 is an explanatory diagram showing an example of abnormality scores for multiple time periods. In FIG. 7, the horizontal axis represents time and the vertical axis represents the abnormality score. There is no particular restriction on the method used by the abnormality score calculation unit 1a to calculate the abnormality score, but it is possible to obtain the abnormality score by, for example, calculating the time derivative of the waveform data. In this case, the time derivative value of the waveform data is used as the abnormality score. The abnormality score calculation unit 1a outputs the abnormality scores for multiple time periods to the high-score waveform extraction unit 1b.

[0033] The high score waveform extraction unit 1b acquires the abnormality scores for a plurality of time periods from the abnormality score calculation unit 1a. The high score waveform extraction unit 1b calculates the abnormality scores for each time period and the threshold value Th １ The high-score waveform extracting unit 1b extracts a waveform that indicates the behavior of the device from the waveforms that match the threshold Th １ The waveform of the time period related to the abnormal score larger than ｊ (Step ST2 in FIG. 4). j is an identification symbol for identifying one or more high score waveforms, and j=1, ..., J. J is the number of high score waveforms extracted by the high score waveform extraction unit 1b, and is an integer equal to or greater than 1. The high score waveform extraction unit 1b extracts one or more high score waveforms HSW. ｊ (j=1, . . . , J) is output to the cluster determination unit 2.

[0034] The waveform classification unit 2a of the cluster determination unit 2 extracts one or more high-score waveforms HSW from the first waveform extraction unit 1. ｊ (j=1, . . . , J). The waveform classification unit 2a obtains one or more high-score waveforms HSW. １ ~HSW Ｊ and comparing the shapes of the waveforms with each other, and based on the results of the shape comparison, determining one or more high-scoring waveforms HSW ｊ (Step ST3 in FIG. 4). FIG. 8 shows the high score waveform HSW obtained by the waveform classification unit 2a. ｊClassification example of the waveform HSW by the clustering unit 2b ｊ 8 is an explanatory diagram showing an example of clustering of high-score waveforms HSW. ｊ As a result of the classification, the high score waveform HSW is classified into a high score waveform having a maximum value, a high score waveform having a minimum value, a high score waveform having both a maximum value and a minimum value, a high score waveform whose signal level increases suddenly, a high score waveform whose signal level decreases suddenly, and a high score waveform whose signal level oscillates. ｊ The classification result is output to the clustering unit 2b.

[0035] The clustering unit 2b extracts the high-score waveforms HSW from the waveform classification unit 2a. ｊ The clustering unit 2b obtains the classification results of one or more high-score waveforms HSW classified into the same shape by the waveform classification unit 2a. ｍ，ｎ (Step ST4 in FIG. 4). m is an identification symbol for identifying the waveform shape, and n is an identification symbol for identifying high-score waveforms classified into the same shape. In the example of FIG. 8, m=1, 2, 3, 4, 5, 6. Specifically, the clustering unit 2b clusters the high-score waveforms HSW ｍ，ｎ For example, by providing the result to an unsupervised learning model or a dendrogram, the high-score waveform HSW is obtained from the unsupervised learning model. ｍ，ｎ The cluster CLS to which ｋ The k is an identification symbol for identifying one or more clusters, and k = 1, ..., K. K is the total number of clusters and is an integer equal to or greater than 1. During learning, the unsupervised learning model or the like is given a plurality of high-score waveforms, and learns the cluster to which each high-score waveform belongs. During inference, the unsupervised learning model or the like uses the high-score waveform HSW ｍ，ｎ Given a high-scoring waveform HSW ｍ，ｎ The cluster CLS to which ｋIn the example of FIG. 8, high-score waveforms having local maximum values ​​are classified into one of three or more clusters based on the magnitude of the change in signal level. The clustering unit 2b outputs cluster information indicating the high-score waveform HSW. ｍ，ｎ The cluster CLS to which ｋ The clustering unit 2b outputs cluster information indicating the high score waveform HSW to the threshold calculation unit 3 and the threshold storage unit 4. ｍ，ｎ The waveform data of one or more high-score waveforms HSW is output to the threshold calculation unit 3. In the cluster determination unit 2 shown in FIG. ｊ After classifying the waveforms, the clustering unit 2b classifies one or more high score waveforms HSW classified into the same shape by the waveform classification unit 2a. ｍ，ｎ However, this is merely an example, and the clustering unit 2b may extract one or more high-score waveforms HSW from the first waveform extraction unit 1. ｊ (j=1, . . . , J) and generate one or more high-score waveforms HSW ｍ，ｎ may be clustered.

[0036] The threshold calculation unit 3 receives the high score waveform HSW from the cluster determination unit 2. ｍ，ｎ Waveform data and high score waveform HSW ｍ，ｎ The cluster CLS to which ｋ The threshold calculation unit 3 obtains cluster information indicating one or more high-score waveforms SW. ｍ，ｎ The cluster CLS to which ｋ For each cluster CLS ｋ High score waveform SW belonging to ｍ，ｎ Based on the distribution of the features of ２，ｋ (Step ST5 in FIG. 4). Specifically, the threshold calculation unit 3 calculates the cluster CLS ｋ One or more high-scoring waveforms SW belonging to ｍ，ｎ , the second threshold Th ２，ｋ More specifically, the threshold calculation unit 3 calculates the maximum signal level of the high-score waveform with the most different characteristics as a second threshold Th ２，ｋThe feature may be the nearest distance to another waveform, or a feature amount such as a differential value of the waveform. ２，ｋ FIG. 9 is an explanatory diagram showing an example of two clusters CLS. １ , CLS ２ The second threshold Th ２，１ , Th ２，２ The threshold calculation unit 3 calculates the cluster CLS ｋ The second threshold Th ２，ｋ (k=1, . . . , K) is output to the threshold storage unit 4.

[0037] The threshold value storage unit 4 stores the cluster information output from the cluster determination unit 2 and the cluster CLS calculated by the threshold value calculation unit 3. ｋ The second threshold Th ２，ｋ (k=1, . . . , K) are stored.

[0038] Next, the anomaly detection process performed by the anomaly detection device will be described. The anomaly score calculation unit 5a of the second waveform extraction unit 5 acquires waveform data indicating the behavior of the device when there is a possibility that an anomaly has occurred in the device. Fig. 10 is an explanatory diagram showing an example of waveform data indicating the behavior of the device when there is a possibility that an anomaly has occurred in the device. In Fig. 10, the horizontal axis represents time, and the vertical axis represents the signal level of the waveform indicating the behavior of the device.

[0039] The abnormality score calculation unit 5a calculates abnormality scores for multiple time periods in the waveform data (step ST11 in FIG. 5). As shown in FIG. 11, the abnormality score is small in time periods with small waveform fluctuations and is large in time periods with large waveform fluctuations. FIG. 11 is an explanatory diagram showing an example of abnormality scores for multiple time periods. In FIG. 11, the horizontal axis represents time and the vertical axis represents the abnormality score. There is no particular restriction on the method used by the abnormality score calculation unit 5a to calculate the abnormality score, but it is possible to obtain the abnormality score by calculating the time derivative of the waveform data, for example. In this case, the time derivative of the waveform data is used as the abnormality score. The abnormality score calculation unit 5a outputs the abnormality scores for multiple time periods to the high-score waveform extraction unit 5b.

[0040] The high score waveform extraction unit 5b acquires the abnormality scores for a plurality of time periods from the abnormality score calculation unit 5a. The high score waveform extraction unit 5b calculates the abnormality scores for each time period and the threshold value Th １ The high score waveform extracting unit 5b extracts a waveform that is within a threshold value Th from the waveform that indicates the behavior of the device. １ The waveform of the time period related to the abnormal score larger than ｐ (Step ST12 in FIG. 5). p is an identification symbol for identifying one or more high score waveforms, and p=1, ..., P. P is the number of high score waveforms extracted by the high score waveform extraction unit 5b, and is an integer equal to or greater than 1. The high score waveform extraction unit 5b extracts one or more extracted high score waveforms HSW. ｐ (p=1, . . . , P) is output to the cluster specifying unit 6 and the abnormal waveform detecting unit 7, respectively.

[0041] The cluster specifying unit 6 receives one or more high score waveforms HSW from the high score waveform extracting unit 5b. ｐ (p=1, . . . , P) and obtains the cluster information stored in the threshold storage unit 4. The cluster identification unit 6 obtains the high-score waveforms HSW ｐ For example, by providing the result to an unsupervised learning model or a dendrogram, the high-score waveform HSW is obtained from the unsupervised learning model. ｍ，ｎ The cluster CLS to which ｋ The cluster specifying unit 6 obtains information indicating the cluster CLS' indicated by the cluster information stored in the threshold storage unit 4. １ ~CLS Ｋ In the cluster CLS ｋ ' and the same cluster CLS ｋ (Step ST13 in FIG. 5). The cluster specifying unit 6 specifies the specified cluster CLS ｋ The information is output to the abnormal waveform detector 7.

[0042] The abnormal waveform detection unit 7 detects one or more high score waveforms HSW from the high score waveform extraction unit 5b. ｐ (p=1, . . . , P), and the cluster specifying unit 6 obtains the specified cluster CLS. ｋThe abnormal waveform detection unit 7 obtains information on each high score waveform HSW. ｐ As a threshold value for ｋ The second threshold Th ２，１ ~Th ２，Ｋ The cluster CLS identified by the cluster identification unit 6 ｋ The second threshold Th ２，ｋ (Step ST14 in FIG. 5). The abnormal waveform detection unit 7 obtains the high score waveform HSW ｐ (p=1, . . . , P) is a part or all of which is equal to the second threshold Th ２，ｋ (step ST15 in FIG. 5: YES), the high score waveform HSW ｐ The abnormal waveform detection unit 7 detects the high score waveform HSW as an abnormal waveform (step ST16 in FIG. 5). ｐ All of these are within the second threshold Th ２，ｋ If it is equal to or less than this (if step ST15 in FIG. 5 is NO), the high score waveform HSW ｐ The abnormal waveform detector 7 outputs waveform data indicating the detected abnormal waveform to the display processor 8.

[0043] The display processing unit 8 acquires waveform data indicating an abnormal waveform from the abnormal waveform detection unit 7. The display processing unit 8 outputs display data for displaying the abnormal waveform detected by the abnormal waveform detection unit 7 to a display (not shown) (step ST17 in FIG. 5 ). As a result, the abnormal waveform is displayed on the display (not shown).

[0044] In the first embodiment described above, the anomaly detection device is configured to include a first waveform extraction unit 1 that extracts waveforms for a period in which the difference in characteristics is greater than a first threshold from waveform data that indicates the behavior of the equipment when the equipment is normal, a cluster determination unit 2 that determines a cluster to which each of the one or more waveforms extracted by the first waveform extraction unit 1 belongs, and a threshold calculation unit 3 that calculates a second threshold for each cluster to which one or more waveforms belong, based on the distribution of characteristics of the waveforms that belong to that cluster. Therefore, the anomaly detection device can reduce both oversight of anomalies and overdetection of anomalies more than the equipment status monitoring device disclosed in Patent Document 1.

[0045] Furthermore, in the first embodiment, the anomaly detection device is configured to include: a second waveform extraction unit 5 that extracts waveforms for a period in which the difference in characteristics is greater than a first threshold from waveform data that indicates the behavior of the device when there is a possibility that an abnormality has occurred in the device; a cluster identification unit 6 that identifies a cluster to which each of the one or more waveforms extracted by the second waveform extraction unit 5 belongs, among the clusters determined by the cluster determination unit 2; and an anomalous waveform detection unit 7 that acquires, as a threshold for each waveform extracted by the second waveform extraction unit 5, a second threshold corresponding to the cluster identified by the cluster identification unit 6 from one or more second thresholds calculated by the threshold calculation unit 3, and detects each waveform extracted by the second waveform extraction unit as an anomalous waveform if part or all of the waveform is greater than the acquired second threshold. Therefore, the anomaly detection device can detect anomalous waveforms while reducing both oversight of anomalies and overdetection of anomalies.

[0046] Second Embodiment In a second embodiment, an anomaly detection device will be described in which waveform data indicating the behavior of an apparatus when the apparatus is normal and waveform data indicating the behavior of an apparatus when there is a possibility that an abnormality has occurred in the apparatus are both vibration waveform data.

[0047] FIG. 12 is a configuration diagram showing an anomaly detection device according to embodiment 2. In FIG. 12, the same reference numerals as in FIG. 1 indicate the same or corresponding parts, and detailed description thereof will be omitted. FIG. 13 is a hardware configuration diagram showing the hardware of the anomaly detection device according to embodiment 2. In FIG. 13, the same reference numerals as in FIG. 2 indicate the same or corresponding parts, and detailed description thereof will be omitted. The anomaly detection device shown in FIG. 12 includes a first waveform extraction unit 1, a cluster determination unit 11, a threshold calculation unit 3, a threshold storage unit 4, a second waveform extraction unit 5, a cluster identification unit 12, an anomalous waveform detection unit 7, and a display processing unit 8.

[0048] The cluster determination unit 11 is realized by, for example, a cluster determination circuit 31 shown in FIG. 13 . The cluster determination unit 11 acquires one or more high-score waveforms from the first waveform extraction unit 1. The cluster determination unit 11 determines the cluster to which each high-score waveform belongs based on the amplitude of the high-score waveform. The cluster determination unit 11 outputs cluster information indicating the cluster to which each high-score waveform belongs to each of the threshold calculation unit 3 and the threshold storage unit 4. The cluster determination unit 11 also outputs waveform data of each high-score waveform to the threshold calculation unit 3.

[0049] The cluster identifying unit 12 is realized by, for example, a cluster identifying circuit 32 shown in FIG. 13 . The cluster identifying unit 12 acquires one or more high-score waveforms from the second waveform extracting unit 5. The cluster identifying unit 12 identifies the cluster to which each of the one or more high-score waveforms extracted by the second waveform extracting unit 5 belongs, from among the clusters determined by the cluster determining unit 11. The cluster identifying unit 12 outputs information about the cluster to which each high-score waveform belongs to the anomalous waveform detecting unit 7.

[0050] 12, it is assumed that each of the components of the anomaly detection device, namely, first waveform extraction unit 1, cluster determination unit 11, threshold calculation unit 3, threshold storage unit 4, second waveform extraction unit 5, cluster identification unit 12, anomalous waveform detection unit 7, and display processing unit 8, is realized by dedicated hardware such as that shown in Fig. 13. In other words, it is assumed that the anomaly detection device is realized by first waveform extraction circuit 21, cluster determination circuit 31, threshold calculation circuit 23, threshold storage circuit 24, second waveform extraction circuit 25, cluster identification circuit 32, anomalous waveform detection circuit 27, and display processing circuit 28.

[0051] The first waveform extraction circuit 21, the cluster determination circuit 31, the threshold calculation circuit 23, the second waveform extraction circuit 25, the cluster identification circuit 32, the anomalous waveform detection circuit 27, and the display processing circuit 28 may each be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof. The components of the anomaly detection device are not limited to those realized by dedicated hardware, and the anomaly detection device may be realized by software, firmware, or a combination of software and firmware.

[0052] When the anomaly detection device is realized by software, firmware, or the like, the threshold storage unit 4 is configured on a memory 41 shown in Fig. 3. Programs for causing a computer to execute the respective processing procedures of the first waveform extraction unit 1, cluster determination unit 11, threshold calculation unit 3, second waveform extraction unit 5, cluster identification unit 12, anomalous waveform detection unit 7, and display processing unit 8 are stored in the memory 41. Then, a processor 42 shown in Fig. 3 executes the programs stored in the memory 41.

[0053] 13 shows an example in which each of the components of the anomaly detection device is realized by dedicated hardware, while Fig. 3 shows an example in which the anomaly detection device is realized by software, firmware, etc. However, this is merely an example, and some of the components in the anomaly detection device may be realized by dedicated hardware, and the remaining components may be realized by software, firmware, etc.

[0054] Next, the operation of the anomaly detection device shown in Fig. 12 will be described. First, the threshold calculation process performed by the anomaly detection device will be described. The anomaly score calculation unit 1a of the first waveform extraction unit 1 acquires vibration waveform data as waveform data indicating the behavior of the device when the device is normal. Fig. 14 is an explanatory diagram showing an example in which waveform data indicating the behavior of the device when the device is normal is vibration waveform data. In Fig. 14, the horizontal axis represents time, and the vertical axis represents the amplitude of the waveform indicating the behavior of the device. As shown in Fig. 14, the amplitude of the waveform indicating the behavior of the device changes over time, even when the device is normal.

[0055] The abnormality score calculation unit 1a calculates abnormality scores for multiple time periods in the waveform data. As shown in FIG. 15, the abnormality score is small in time periods with small amplitude fluctuations and is large in time periods with large amplitude fluctuations. FIG. 15 is an explanatory diagram showing an example of abnormality scores for multiple time periods. In FIG. 15, the horizontal axis represents time and the vertical axis represents the abnormality score. There is no particular restriction on the method used by the abnormality score calculation unit 1a to calculate the abnormality score, but it is possible to obtain it, for example, by calculating the amount of change in amplitude of the waveform per unit time. In this case, the amount of change in amplitude per unit time is used as the abnormality score. The abnormality score calculation unit 1a outputs the abnormality scores for multiple time periods to the high-score waveform extraction unit 1b.

[0056] The high score waveform extraction unit 1b acquires the abnormality scores for a plurality of time periods from the abnormality score calculation unit 1a. The high score waveform extraction unit 1b calculates the abnormality scores for each time period and the threshold value Th １ The high score waveform extracting unit 1b extracts a waveform that is within a threshold value Th from the waveform that indicates the behavior of the device. １ The waveform of the time period related to the abnormal score larger than ｊ The high score waveform extraction unit 1b extracts one or more high score waveforms HSW ｊ (j=1, . . . , J) is output to the cluster determining unit 11.

[0057] The cluster determination unit 11 extracts one or more high-score waveforms HSW from the first waveform extraction unit 1.ｊ (j=1, . . . , J). The cluster determination unit 11 obtains the high-score waveform HSW ｊ Based on the amplitude of the high-score waveform HSW ｊ The cluster CLS to which ｋ Specifically, the cluster determination unit 11 determines the high-score waveform HSW ｍ，ｎ The amplitude of the waveform HSW is given to, for example, an unsupervised learning model or a dendrogram, and the high-score waveform HSW is obtained from the unsupervised learning model. ｍ，ｎ The cluster CLS to which ｋ During learning, the unsupervised learning model etc. is given the amplitudes of multiple high score waveforms and learns the cluster to which each high score waveform belongs. During inference, the unsupervised learning model etc. obtains cluster information indicating the high score waveform HSW ｍ，ｎ Given the amplitude of ｍ，ｎ The cluster CLS to which ｋ The cluster determining unit 11 outputs cluster information indicating the high score waveform HSW. ｍ，ｎ The cluster CLS to which ｋ The cluster determining unit 11 outputs cluster information indicating the high score waveform HSW to the threshold calculation unit 3 and the threshold storage unit 4. ｍ，ｎ The waveform data is output to the threshold calculation unit 3.

[0058] The threshold calculation unit 3 receives the high score waveform HSW from the cluster determination unit 11. ｍ，ｎ Waveform data and high score waveform HSW ｍ，ｎ The cluster CLS to which ｋ The threshold calculation unit 3 obtains cluster information indicating one or more high-score waveforms SW. ｍ，ｎ The cluster CLS to which ｋ For each cluster CLS ｋ High score waveform SW belonging to ｍ，ｎ Based on the distribution of the features of ２，ｋ Specifically, the threshold calculation unit 3 calculates the cluster CLS ｋ One or more high-scoring waveforms SW belonging to ｍ，ｎ , the second threshold Th２，ｋ More specifically, the threshold calculation unit 3 calculates the second threshold Th ２，ｋ The threshold calculation unit 3 sets the cluster CLS ｋ The second threshold Th ２，ｋ (k=1, . . . , K) is output to the threshold storage unit 4.

[0059] The threshold storage unit 4 stores the cluster information output from the cluster determination unit 11 and the cluster CLS calculated by the threshold calculation unit 3. ｋ The second threshold Th ２，ｋ (k=1, . . . , K) are stored.

[0060] Next, the anomaly detection process performed by the anomaly detection device will be described. The anomaly score calculation unit 5a of the second waveform extraction unit 5 acquires vibration waveform data as waveform data indicating the behavior of the equipment when an anomaly may have occurred in the equipment. Fig. 16 is an explanatory diagram showing an example in which the waveform data indicating the behavior of the equipment when an anomaly may have occurred in the equipment is vibration waveform data. In Fig. 16, the horizontal axis represents time, and the vertical axis represents the amplitude of the waveform indicating the behavior of the equipment.

[0061] The abnormality score calculation unit 5a calculates abnormality scores for multiple time periods in the waveform data. As shown in FIG. 17 , the abnormality score is small in time periods with small amplitude fluctuations and is large in time periods with large amplitude fluctuations. FIG. 17 is an explanatory diagram showing an example of abnormality scores for multiple time periods. In FIG. 17 , the horizontal axis represents time and the vertical axis represents the abnormality score. There is no particular restriction on the method used by the abnormality score calculation unit 5a to calculate the abnormality score, but it is possible to obtain it, for example, by calculating the amount of change in amplitude of the waveform per unit time. In this case, the amount of change in amplitude per unit time is used as the abnormality score. The abnormality score calculation unit 5a outputs the abnormality scores for multiple time periods to the high-score waveform extraction unit 5b.

[0062] The high score waveform extraction unit 5b acquires the abnormality scores for a plurality of time periods from the abnormality score calculation unit 5a. The high score waveform extraction unit 5b calculates the abnormality scores for each time period and the threshold value Th １The high score waveform extracting unit 5b extracts a waveform that is within a threshold value Th from the waveform that indicates the behavior of the device. １ The waveform of the time period related to the abnormal score larger than ｐ The high score waveform extraction unit 5b extracts one or more extracted high score waveforms HSW. ｐ (p=1, . . . , P) is output to the cluster specifying unit 12 and the abnormal waveform detecting unit 7, respectively.

[0063] The cluster specifying unit 12 receives one or more high score waveforms HSW from the high score waveform extracting unit 5b. ｐ (p=1, . . . , P) and acquires the cluster information stored in the threshold storage unit 4. The cluster identification unit 12 acquires each high-score waveform HSW ｐ The amplitude of the waveform HSW is given to, for example, an unsupervised learning model or a dendrogram, and the high-score waveform HSW is obtained from the unsupervised learning model. ｍ，ｎ The cluster CLS to which ｋ The cluster specifying unit 12 obtains information indicating the cluster CLS' indicated by the cluster information stored in the threshold storage unit 4. １ ~CLS Ｋ Among them, cluster CLS ｋ ' and the same cluster CLS ｋ The cluster specifying unit 12 specifies the specified cluster CLS. ｋ The information is output to the abnormal waveform detector 7.

[0064] The abnormal waveform detection unit 7 detects one or more high score waveforms HSW from the high score waveform extraction unit 5b. ｐ (p=1, . . . , P), and the cluster specifying unit 12 obtains the specified cluster CLS. ｋ The abnormal waveform detection unit 7 obtains information on each high score waveform HSW. ｐ As a threshold value for ｋ The second threshold Th ２，１ ~Th ２，Ｋ The cluster CLS identified by the cluster identification unit 6 ｋ The second threshold Th ２，ｋ The abnormal waveform detection unit 7 obtains the high score waveform HSW.ｐ (p=1, . . . , P) is a part or all of which is equal to the second threshold Th ２，ｋ If it is greater than , the high score waveform HSW ｐ The abnormal waveform detection unit 7 detects the high score waveform HSW ｐ All of these are within the second threshold Th ２，ｋ If it is below, it is a high score waveform HSW ｐ The abnormal waveform detector 7 outputs waveform data indicating the detected abnormal waveform to the display processor 8.

[0065] The display processing unit 8 acquires waveform data indicating an abnormal waveform from the abnormal waveform detection unit 7. The display processing unit 8 outputs display data for displaying the abnormal waveform detected by the abnormal waveform detection unit 7 to a display (not shown). As a result, the abnormal waveform is displayed on the display (not shown).

[0066] In the above-described second embodiment, the waveform data indicating the behavior of the equipment when the equipment is normal and the waveform data indicating the behavior of the equipment when there is a possibility that an abnormality has occurred are each vibration waveform data, and the anomaly detection device is configured so that the cluster determination unit 11 determines the cluster to which each waveform belongs based on the amplitude of one or more waveforms extracted by the first waveform extraction unit 1, and the cluster identification unit 12 identifies the cluster to which each waveform belongs based on the amplitude of one or more waveforms extracted by the second waveform extraction unit 5. Therefore, the anomaly detection device can reduce both overlooking anomalies and overdetection of anomalies more than the equipment status monitoring device disclosed in Patent Document 1.

[0067] Third Embodiment In a third embodiment, an anomaly detection device will be described that includes a similarity calculation unit 13 that calculates the similarity between an abnormal waveform detected by an abnormal waveform detection unit 7 and waveforms that belong to the same cluster as the abnormal waveform.

[0068] FIG. 18 is a configuration diagram showing an anomaly detection device according to embodiment 3. In FIG. 18, the same reference numerals as those in FIGS. 1 and 12 indicate the same or corresponding parts, and therefore detailed description thereof will be omitted. FIG. 19 is a hardware configuration diagram showing the hardware of the anomaly detection device according to embodiment 3. In FIG. 19, the same reference numerals as those in FIGS. 2 and 13 indicate the same or corresponding parts, and therefore detailed description thereof will be omitted. The anomaly detection device shown in FIG. 18 includes a first waveform extraction unit 1, a cluster determination unit 2, a threshold calculation unit 3, a threshold storage unit 4, a second waveform extraction unit 5, a cluster identification unit 6, an anomalous waveform detection unit 7, a similarity calculation unit 13, and a display processing unit 14.

[0069] The similarity calculation unit 13 is realized by, for example, a similarity calculation circuit 33 shown in FIG. 19. The similarity calculation unit 13 receives the cluster CLS from the cluster identification unit 12. ｋ The similarity calculation unit 13 obtains the information of the cluster CLS and obtains waveform data indicating an abnormal waveform from the abnormal waveform detection unit 7. ｋ Based on the information, the abnormal waveform detected by the abnormal waveform detection unit 7 is detected as the same cluster CLS. ｋ The similarity calculation unit 13 identifies waveforms that belong to the same cluster CLS as the abnormal waveform. ｋ The similarity calculation unit 13 calculates the similarity between the waveform belonging to the abnormal waveform and the waveform belonging to the abnormal waveform. The similarity calculation unit 13 outputs the similarity to the display processing unit 14.

[0070] The display processing unit 14 is realized by, for example, a display processing circuit 34 shown in FIG. 19. The display processing unit 14 receives one or more high-score waveforms HSW from the second waveform extraction unit 5. ｐ (p=1, . . . , P) is acquired, and the cluster CLS is obtained from the cluster identification unit 6. ｋ The display processing unit 14 acquires waveform data indicating an abnormal waveform from the abnormal waveform detection unit 7, and acquires the similarity with the abnormal waveform from the similarity calculation unit 13. The display processing unit 14 outputs display data for displaying the abnormal waveform detected by the abnormal waveform detection unit 7 to a display (not shown), and also calculates the similarity with the abnormal waveform from the cluster CLS. ｋ The display data for displaying the waveforms belonging to the group and the similarity is output to a display (not shown).

[0071] In the anomaly detection device shown in Fig. 18, the similarity calculation unit 13 and the display processing unit 14 are each applied to the anomaly detection device shown in Fig. 1. However, this is merely an example, and the similarity calculation unit 13 and the display processing unit 14 may each be applied to the anomaly detection device shown in Fig. 12.

[0072] 18, it is assumed that each of the components of the anomaly detection device, namely, first waveform extraction unit 1, cluster determination unit 2, threshold calculation unit 3, threshold storage unit 4, second waveform extraction unit 5, cluster identification unit 6, anomalous waveform detection unit 7, similarity calculation unit 13, and display processing unit 14, is realized by dedicated hardware such as that shown in Fig. 19. In other words, it is assumed that the anomaly detection device is realized by a first waveform extraction circuit 21, cluster determination circuit 22, threshold calculation circuit 23, threshold storage circuit 24, second waveform extraction circuit 25, cluster identification circuit 26, anomalous waveform detection circuit 27, similarity calculation circuit 33, and display processing circuit 34.

[0073] Each of the first waveform extraction circuit 21, the cluster determination circuit 22, the threshold calculation circuit 23, the second waveform extraction circuit 25, the cluster identification circuit 26, the anomalous waveform detection circuit 27, the similarity calculation circuit 33, and the display processing circuit 34 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof. The components of the anomaly detection device are not limited to those realized by dedicated hardware, and the anomaly detection device may be realized by software, firmware, or a combination of software and firmware.

[0074] When the anomaly detection device is realized by software, firmware, or the like, the threshold storage unit 4 is configured on a memory 41 shown in Fig. 3. Programs for causing a computer to execute the respective processing procedures of the first waveform extraction unit 1, cluster determination unit 2, threshold calculation unit 3, second waveform extraction unit 5, cluster identification unit 6, anomalous waveform detection unit 7, similarity calculation unit 13, and display processing unit 14 are stored in the memory 41. Then, a processor 42 shown in Fig. 3 executes the programs stored in the memory 41.

[0075] 19 shows an example in which each of the components of the anomaly detection device is realized by dedicated hardware, while Fig. 3 shows an example in which the anomaly detection device is realized by software, firmware, etc. However, this is merely an example, and some of the components in the anomaly detection device may be realized by dedicated hardware, and the remaining components may be realized by software, firmware, etc.

[0076] Next, the operation of the anomaly detection device shown in Fig. 18 will be described. However, other than the similarity calculation unit 13 and the display processing unit 14, the anomaly detection device is the same as that shown in Fig. 1. Therefore, only the operation of the similarity calculation unit 13 and the display processing unit 14 will be described here.

[0077] The similarity calculation unit 13 receives the cluster CLS from the cluster identification unit 6. ｋ The similarity calculation unit 13 obtains the information of the cluster CLS and obtains waveform data indicating an abnormal waveform from the abnormal waveform detection unit 7. ｋ Based on the information, the abnormal waveform detected by the abnormal waveform detection unit 7 is detected as the same cluster CLS. ｋ The similarity calculation unit 13 identifies waveforms that belong to the same cluster CLS as the abnormal waveform. ｋ The similarity D between the waveform belonging to the cluster CLS and the abnormal waveform is calculated. The process of calculating the similarity D between two waveforms is a known technique, so a detailed description will be omitted. The similarity D is calculated by ｋ The similarity calculation unit 13 outputs the similarity D to the display processing unit 14.

[0078] The display processing unit 14 receives one or more high-score waveforms HSW from the second waveform extraction unit 5. ｐ (p=1, . . . , P) is acquired, and the cluster CLS is obtained from the cluster identification unit 6. ｋThe display processing unit 14 also acquires waveform data indicating an abnormal waveform from the abnormal waveform detection unit 7, and acquires the similarity with the abnormal waveform from the similarity calculation unit 13. The display processing unit 14 outputs display data for displaying the abnormal waveform to a display (not shown), similar to the display processing unit 8 shown in FIG. 1. The display processing unit 14 also acquires information on the cluster CLS. ｋ Based on the information, the abnormal waveform detected by the abnormal waveform detection unit 7 is detected as the same cluster CLS. ｋ The display processing unit 14 identifies waveforms that belong to the same cluster CLS as the abnormal waveform. ｋ The display data for displaying the waveforms belonging to the cluster CLS and the similarity is output to a display (not shown). ｋ The waveforms belonging to the group and the similarity D are displayed.

[0079] In addition, the present disclosure allows for free combination of the respective embodiments, modification of any of the components of the respective embodiments, or omission of any of the components of the respective embodiments.

[0080] The present disclosure is suitable for an anomaly detection device and an anomaly detection method.

[0081] 1 First waveform extraction unit, 1a Abnormal score calculation unit, 1b High score waveform extraction unit, 2 Cluster determination unit, 2a Waveform classification unit, 2b Clustering unit, 3 Threshold calculation unit, 4 Threshold storage unit, 5 Second waveform extraction unit, 5a Abnormal score calculation unit, 5b High score waveform extraction unit, 6 Cluster identification unit, 7 Abnormal waveform detection unit, 8 Display processing unit, 11 Cluster determination unit, 12 Cluster identification unit, 13 Similarity calculation unit, 14 Display processing unit, 21 First waveform extraction circuit, 22 Cluster determination circuit, 23 Threshold calculation circuit, 24 Threshold storage circuit, 25 Second waveform extraction circuit, 26 Cluster identification circuit, 27 Abnormal waveform detection circuit, 28 Display processing circuit, 31 Cluster determination circuit, 32 Cluster identification circuit, 33 Similarity calculation circuit, 34 Display processing circuit, 41 Memory, 42 Processor.

Claims

1. An anomaly detection device comprising: a first waveform extraction unit that extracts waveforms for a period in which the difference in characteristics is greater than a first threshold from waveform data that indicates the behavior of the equipment when the equipment is normal; a cluster determination unit that determines a cluster to which each of one or more waveforms extracted by the first waveform extraction unit belongs; and a threshold calculation unit that calculates a second threshold for each cluster to which one or more waveforms belong, based on the distribution of characteristics of the waveforms that belong to that cluster.

2. The anomaly detection device according to claim 1, characterized in that the threshold calculation unit calculates the second threshold based on the waveform with the most different characteristics among one or more waveforms belonging to the cluster.

3. The anomaly detection device according to claim 1, characterized in that the cluster determination unit comprises: a waveform classification unit that compares the shapes of one or more waveforms extracted by the first waveform extraction unit with each other and classifies the one or more waveforms based on the shape comparison results; and a clustering unit that clusters one or more waveforms classified as having the same shape by the waveform classification unit.

4. The anomaly detection device according to claim 1, further comprising: a second waveform extraction unit that extracts waveforms for a period in which the difference in characteristics is greater than the first threshold from waveform data that indicates the behavior of the device when there is a possibility that an abnormality has occurred in the device; a cluster identification unit that identifies a cluster to which each of the one or more waveforms extracted by the second waveform extraction unit belongs, from among the clusters determined by the cluster determination unit; and an abnormal waveform detection unit that obtains a second threshold corresponding to the cluster identified by the cluster identification unit from among the one or more second thresholds calculated by the threshold calculation unit as a threshold for each waveform extracted by the second waveform extraction unit, and detects each waveform as an abnormal waveform if part or all of the waveform extracted by the second waveform extraction unit is greater than the obtained second threshold.

5. The anomaly detection device according to claim 4, characterized in that the waveform data indicating the behavior of the equipment when the equipment is normal and the waveform data indicating the behavior of the equipment when there is a possibility of an abnormality occurring in the equipment are vibration waveform data, the cluster determination unit determines the cluster to which each waveform belongs based on the amplitude of each waveform extracted by the first waveform extraction unit, and the cluster identification unit identifies the cluster to which each waveform belongs based on the amplitude of each waveform extracted by the second waveform extraction unit.

6. The abnormality detection device according to claim 4, further comprising a display processing unit that outputs display data for displaying the abnormal waveform detected by said abnormal waveform detection unit.

7. The anomaly detection device according to claim 6, further comprising a similarity calculation unit that calculates the similarity between an abnormal waveform detected by the abnormal waveform detection unit and a waveform that belongs to the same cluster as the abnormal waveform, and the display processing unit not only displays the abnormal waveform detected by the abnormal waveform detection unit, but also displays waveforms that belong to the same cluster as the abnormal waveform and the similarity calculated by the similarity calculation unit.

8. An anomaly detection device comprising: a second waveform extraction unit that extracts waveforms for a period in which the difference in characteristics is greater than a first threshold from waveform data that indicates the behavior of a device when there is a possibility that the device is experiencing an abnormality; a cluster identification unit that identifies a cluster to which each of the one or more waveforms extracted by the second waveform extraction unit belongs, among the clusters to which each of the one or more waveforms belongs; and an abnormal waveform detection unit that obtains a second threshold corresponding to the cluster identified by the cluster identification unit from one or more second thresholds as a threshold for each waveform extracted by the second waveform extraction unit, and detects each waveform as an abnormal waveform if part or all of the waveform extracted by the second waveform extraction unit is greater than the obtained second threshold.

9. An anomaly detection method, in which a first waveform extraction unit extracts waveforms for a period in which the difference in characteristics is greater than a first threshold from waveform data that indicates the behavior of the device when the device is normal; a cluster determination unit determines a cluster to which each of the one or more waveforms extracted by the first waveform extraction unit belongs; and a threshold calculation unit calculates a second threshold for each cluster to which one or more waveforms belong, based on the distribution of characteristics of the waveforms belonging to that cluster.

Images