JP5945350B2 - Equipment condition monitoring method and apparatus - Google Patents

Description

The present invention relates to a state monitoring method and apparatus for detecting an abnormality at an early stage and diagnosing a phenomenon based on multidimensional time-series data output from a plant or equipment.

Electric power companies use waste heat from gas turbines to supply hot water for district heating, and supply high-pressure steam and low-pressure steam to factories. Petrochemical companies operate gas turbines and other power sources. In various plants and facilities using gas turbines and the like in this way, preventive maintenance that detects a malfunction of a facility or its sign is extremely important in order to minimize damage to society. In addition to detection, abnormality diagnosis that explains the phenomenon of abnormality is also important for taking appropriate actions.

Not only gas turbines and steam turbines, but also water turbines at hydroelectric power plants, nuclear reactors at nuclear power plants, wind turbines at wind power plants, engines of aircraft and heavy machinery, railway vehicles and tracks, escalators, elevators, equipment / parts level, Equipment that requires preventive maintenance as described above, such as on-board battery deterioration and life, has no spare time. Recently, for health management, detection of abnormalities (various symptoms) in the human body is becoming important as seen in EEG measurement and diagnosis.

For this reason, US Pat. No. 6,952,662 (Patent Document 1) and US Pat. No. 6,975,96
No. 2 (Patent Document 2) discloses an abnormality detection method mainly for an engine.
This is because past data such as time series sensor signals are stored in a database, the degree of similarity between observation data and past learning data is calculated by an original method, and an estimated value is calculated by linear combination of data with high degree of similarity. Thus, the degree of deviation between the estimated value and the observation data is output.

In Japanese Patent No. 3,631,118, case data is registered in a database, the degree of similarity of the input data to the case data is evaluated, and an event name associated with the highest case in advance with the highest degree of similarity. Is disclosed.

US Pat. No. 6,952,662 US Pat. No. 6,975,962 Japanese Patent No. 3631118

Stephan W. Wegerich; Nonparametric modeling of vibration signal features for equipment health monitoring, Aerospace Conference, 2003. Proceedings. 2003 IEEE, Volume 7, Issue, 2003 Page (s): 3113-3121

In the methods described in Patent Document 1 and Patent Document 2, if observation data that is not included in the learning data is observed, these are all treated as not included in the learning data, and are determined to be outliers. Is determined to be abnormal, and the reliability of the inspection is significantly reduced. For this reason, it is necessary for the user to comprehensively store data in various past states as learning data in the database.

On the other hand, when anomalies are mixed in the learning data, the degree of deviation from the observation data representing the anomalies is low, and this is overlooked. For this reason, a sufficient check is necessary so that no abnormalities are included in the learning data. However, Patent Literature 1 and Patent Literature 2 do not disclose a method for comprehensive data collection and abnormality elimination, and the user bears such a load. Since it is necessary to meticulously cope with changes over time, surrounding environmental changes, and the presence or absence of maintenance work such as parts replacement, it is practically difficult and impossible in many cases to perform such correspondence manually.

In the method described in Patent Document 3, since the case associated with the event is recorded in the database as it is, the basis for the abnormality determination cannot be explained and it is difficult to convince the user. Also, there is no correlation between abnormal signs and events.

Accordingly, an object of the present invention is to solve the above-mentioned problem, and to detect an abnormal sign with high sensitivity without increasing the user load even if learning data is insufficient, and an abnormal sign detection method, and To provide a facility state monitoring method and system including an abnormality diagnosis method capable of explaining not only detection but also abnormality and anomaly sign, that is, what state of a sensor signal is the basis for abnormality determination It is in.

In addition, an object of the present invention is to provide an abnormality that can create a high-accuracy normal model using only correct learning data without increasing the load on the user even when there is an abnormality in the learning data. It is to provide a predictive detection method.

Further, in order to detect an abnormal sign with high sensitivity, it is necessary to examine the sensor item to be used. However, Patent Document 1 and Patent Document 2 do not describe a method for selecting a sensor item, and the effort of the user is made. It will be.

Therefore, an object of the present invention is to provide an abnormality sign detection method capable of creating a high-accuracy normal model by excluding sensor items that hinder sensitivity without increasing the load on the user.

In order to achieve the above-mentioned object, the present invention performs mode division according to the operating state based on the event signal in the equipment state monitoring based on the time-series sensor signal and event signal output from the equipment or the manufacturing apparatus or the measuring apparatus, A normal model is created for each mode based on the sensor signal, an abnormal measure is calculated by comparing the normal model with the sensor signal, the sufficiency of the learning data used to create the normal model is checked for each mode, and the sufficiency of the learning data Anomaly identification based on the anomaly measure is performed after setting the sensitivity according to.

In addition, the sensor signals that have been judged to be all events or abnormalities are quantized into cause events, and failure events that have occurred between the occurrence of the cause events and the elapse of a certain period of time are taken as result events, and a frequency matrix of cause events and result events is created. Based on the matrix, a failure that occurs within a certain time when an event occurs is predicted.

That is, according to the present invention, in the facility state monitoring method for detecting an abnormality based on the time-series sensor signal and event signal output from the facility or apparatus, mode division is performed for each operating state based on the event signal, and based on the sensor signal. Extracts feature vectors, creates a normal model for each mode based on the feature vectors, checks the sufficiency of the learning data used to create the normal model for each mode, and sets a threshold according to the sufficiency of the learning data Learning mode to perform, mode division for each operating state based on the event signal, to extract the feature vector based on the sensor signal,
An anomaly measure is calculated by comparing the normal model with the feature vector, and an anomaly detection step for identifying an anomaly by comparing the anomaly measure with a threshold value.

Further, in the present invention, the facility state monitoring method includes a time-series sensor that outputs a time-series event signal output from the facility or apparatus according to a mode division according to an operating state of the facility or apparatus, and is output from the facility or apparatus. A feature vector is obtained from the signal, a normal model is created for each mode divided using the mode division information and feature vector information obtained from the sensor signal, and the feature vector is abnormal for each mode divided using the created normal model. The measure is calculated, the calculated anomaly measure is compared with a preset threshold value, an anomaly is judged, and the equipment or device anomaly is diagnosed using the information on the judged anomaly and the sensor signal. .

Furthermore, in the present invention, the equipment state monitoring device includes a mode dividing means for inputting a time-series event signal output from the equipment or device and mode-dividing the event signal according to the operating state of the equipment or device, and equipment Alternatively, a feature vector calculation means for obtaining a feature vector from a sensor signal inputted by inputting a time-series sensor signal output from the apparatus, and a feature of the sensor signal obtained by the mode division information from the mode division means and the feature vector calculation means Normal model creation means for creating a normal model for each mode divided using vector information, and feature vector abnormality obtained by the feature vector calculation means for each mode divided using the normal model created by the normal model creation means An abnormal measure calculating means for calculating a measure, and a threshold value in which the abnormal measure calculated by the abnormal measure calculating means is set in advance. An abnormality determination unit that determines an abnormality by comparison, an abnormality diagnosis unit that diagnoses an abnormality of the facility or the apparatus using the abnormality information determined by the abnormality determination unit and a time-series sensor signal output from the facility or the apparatus, It was configured with.

In addition, the present invention extracts a feature vector based on a sensor signal and selects a feature to be used based on a data check of the feature vector in facility state monitoring based on a time-series sensor signal output from the facility, a manufacturing apparatus, or a measuring device. Select the learning data to be used based on the feature vector data check, create a normal model based on the feature vector, calculate the anomaly measure by comparing the normal model and the sensor signal, and use the learning data used to create the normal model. Sufficiency is checked, sensitivity is set according to the sufficiency of the learning data, and abnormality identification is performed based on the abnormality measure.

That is, in the present invention, a facility state monitoring method for detecting an abnormality based on a time-series sensor signal output from a facility or apparatus is used to extract a feature vector based on the sensor signal and to use the feature vector based on data check Select the learning data to be used based on the feature vector data check, create a normal model based on the feature vector, check the sufficiency of the learning data used to create the normal model, Learning process to set the threshold according to the detection, feature vector is extracted based on the sensor signal, abnormality measure is calculated by comparing the normal model and feature vector, and abnormality detection is performed by comparing abnormality measure and threshold And a process.

According to the present invention, mode division is performed for each operating state, and a normal model is created for each mode. Therefore, a highly accurate normal model corresponding to various states can be created. Furthermore, by checking the sufficiency of the learning data for each mode and performing identification by reducing the sensitivity if the data is insufficient, it is possible to suppress misjudgment caused by the lack of data, and the reliability of abnormality detection Can be improved.

In addition, it is possible to learn the causal relationship between events by creating a frequency matrix of the cause event and the result event, and in particular, by quantizing the sensor signal into the cause event, the state and abnormality of the sensor signal can be determined. It becomes possible to associate. Further, by making a failure event that has occurred after a certain time has elapsed since the occurrence of the causal event as a result event, it is possible to associate an abnormality sign with the occurrence of the failure, and therefore it is possible to predict the occurrence of the failure based on the state of the sensor signal.

As described above, not only equipment such as gas turbines and steam turbines, but also water turbines in hydroelectric power plants, nuclear reactors in nuclear power plants, wind turbines in wind power plants, aircraft and heavy machinery engines, railway vehicles and tracks, escalators, elevators, At the equipment / part level, it is possible to detect and diagnose abnormalities and signs of abnormalities with high accuracy in various facilities / parts such as deterioration and life of on-board batteries.

Further, according to the present invention, since the feature and learning data to be used are automatically selected based on the feature vector data check, the user only has to input the entire sensor signal without examining the use features and the learning data. It is possible to create a high-precision normal model, and realize highly sensitive abnormality detection with less effort.

It is a block diagram which shows the structure of the outline of the equipment state monitoring system of this invention. It is a flowchart which shows the flow of the process at the time of learning. It is a flowchart which shows the flow of the process at the time of abnormality detection. It is a signal list | wrist which shows the example of an event signal. It is a flowchart which shows the flow of a process by receiving an event signal and performing mode division. It is a schematic diagram of the event signal which shows the state which divided | segmented the movable state of the installation and was classified into either of 4 types of modes. It is a flowchart explaining the flow of a process of the 2nd Example of the mode division | segmentation method based on event information. It is a signal waveform diagram which shows the example of a sensor signal. It is a flowchart which shows the example of a normal model creation process procedure. It is a graph of the three-dimensional coordinate in FIG. It is a figure explaining a local subspace method. It is a graph which shows the example of an abnormal measure calculation result. It is a front view of the screen which displayed a plurality of signal waveforms in the example of the display screen in learning data check. It is a front view of the screen which displayed a plurality of feature vectors in the example of the display screen in learning data check. It is the front view of the screen which expanded and displayed the several signal waveform in the example of the display screen in learning data check. It is a front view of the screen which displayed the abnormality measure and the partial enlarged view in the example of the display screen in learning data check. It is the front view of the screen which displayed the accumulated histogram list of the mode for every mode written in the example of the display screen in a learning data check, and displayed the threshold parameter on the side. It is a flowchart which shows the procedure which produces a frequency matrix. It is a table | surface of a frequency matrix. It is a flowchart which shows the flow of the process at the time of evaluation using a frequency matrix. It is a flowchart which shows the procedure which produces a frequency matrix only using an event signal, without using a sensor signal. It is a table | surface of a frequency matrix. It is a block diagram which shows the structure of the outline of the equipment state monitoring system of this invention. It is a flowchart which shows the flow of the process at the time of learning. It is a flowchart which shows the flow of the process at the time of abnormality detection. It is a plot figure of the average and dispersion | distribution for every day. It is a figure showing the waveform model of one day. It is a figure explaining the method of attaching a label to data. It is a flowchart which shows the flow of the feature selection process at the time of learning. It is a plot figure of the average and dispersion | distribution for every day. It is a flowchart which shows the flow of the learning data selection process at the time of learning. It is a block diagram which shows the schematic structure of the equipment state monitoring system in Example 3. FIG.

  Hereinafter, the contents of the present invention will be described in detail with reference to the drawings.

  FIG. 1A shows an example of the configuration of a system that implements the equipment state monitoring method of the present invention.

This system is mainly configured to include a sensor signal analysis unit 100 and an abnormality diagnosis unit 110.

The sensor signal analysis unit receives the sensor signal 102 output from the facility 101 and performs feature selection, feature extraction, and feature conversion of the signal to obtain a feature vector, and an event signal 103 output from the facility 101. The mode division unit 104, the feature extraction unit 105, and the mode that divide the time according to the change in the operation state of the equipment 101 (in the following description, this division is referred to as mode division and the type of operation state is referred to as mode). A normal model creation unit 106 that creates a normal model in response to an output from the division unit 104, and an abnormality that calculates an abnormality measure from the sensor signal extracted by the feature extraction unit 105 using the normal model created by the normal model creation unit 106 The abnormal measure calculation unit 107 for the normal model created by the measure calculation unit 107 and the normal model creation unit 106
A learning data check unit 108 for checking a normal model based on the abnormality measure calculated in
Normal model data checked by the learning data check unit 108 and the abnormal measure calculation unit 107
An abnormality identification unit 109 for identifying an abnormality based on the abnormality measure calculated from the sensor signal 102 in FIG.
And an abnormality diagnosis unit 110 that diagnoses an abnormality of the equipment 101 from the sensor signal 102 and the determination result of the abnormality identification unit 109.

The operation of this system has two phases: “learning” in which a model used for abnormality sign detection and diagnosis is created in advance and “evaluation” in which abnormality sign detection and diagnosis are actually performed based on the model and input signals. Basically, the former is offline processing and the latter is online processing. In the following explanation, they are distinguished by the terms of learning and evaluation.
The equipment 101 subject to state monitoring is equipment or a plant such as a gas turbine or a steam turbine. The facility 101 outputs a sensor signal 102 and an event signal 103 representing the state.

The flow of processing during learning will be described with reference to FIG. 1B. The mode division unit 104 inputs the event signal 103 output from the equipment 101 (S101), and the equipment 1 according to the change in the operating state.
The operation time of 01 is divided into modes (S102). On the other hand, the feature extraction unit 105 includes the equipment 101.
The sensor signal 102 output from is input (S103), feature selection, feature extraction, and feature conversion are performed to obtain a feature vector (S104).

The mode division information from the mode division unit 104 and the feature vector information from the feature extraction unit 105 are input to the normal model creation unit 106, and learning data is selected from the feature vectors (S1
05), learning is performed for each mode using this, and a normal model is created (S106). The created normal model is input to the abnormality measure calculation unit 107 together with the feature vector information from the feature extraction unit 104, and the abnormality measure is calculated (S107).

Next, the learning data check unit 108 checks the sufficiency of the learning data used for creating the normal model for each mode based on the information of the abnormality measure calculated by the abnormality measure calculation unit 107 (S108). That is, it is checked whether the created normal model can properly express the normal state in that mode. In the learning data determined by the learning data check unit 108 that can express the normal state in the corresponding mode, a threshold value used for abnormality identification is set according to the check result (S109). That is, when the learning data is insufficient, the threshold value is increased in order to prevent an erroneous determination to determine that the learning data is abnormal although it is normal.

Next, the flow of processing during evaluation will be described using FIG. 1C. The mode division unit 104 is the facility 1
The event signal 103 output from 01 is input (S111), and the operation time of the equipment 101 is mode-divided according to the change in the operation state (S112). On the other hand, the feature extraction unit 105 receives the sensor signal 102 output from the facility 101 (S113), performs feature selection, feature extraction, and feature conversion to obtain a feature vector (S114). The mode division information from the mode division unit 104 and the feature vector information from the feature extraction unit 105 are input to the anomaly measure calculation unit 107, and the feature vectors are classified for each mode and created by the normal model creation unit 106 during learning. The abnormal measure is calculated by comparing with the stored normal model (S115).

The calculated abnormality measure is input to the abnormality identification unit 109, and abnormality determination is performed by comparing with the threshold value set during learning (S116). The result of the abnormality determination is sent to the abnormality diagnosis unit 110, and the sensor signal 1 at the time when the abnormality is determined as the event signal 103 during learning.
Based on the information learned and stored in relation to 02, diagnosis is performed with the sensor signal 102 at the time when the abnormality was determined at the time of evaluation as an input (S117).

Next, the operation of each unit shown in FIG. 1A will be described in detail in order.
A first embodiment of the mode division method in the mode division unit 104 will be described with reference to FIGS. An example of the event signal 103 is shown in FIG. 2A. This is an irregularly output signal indicating operation / failure / warning of equipment, and consists of a time and a character string representing operation / failure / warning. As shown in FIG. 2B, this event signal 103 is input (S201), and a start sequence and a stop sequence are cut out by searching for a predetermined character string (S202). Based on the result, the “steady OFF” mode 211 from the stop sequence end time to the start sequence start time,
“Start” mode 212 in the start sequence, “steady ON” mode 213 from the end time of the start sequence to the start time of the stop sequence, and “stop” mode 214 in the stop sequence
(S203).

An example is shown in FIG. 2C. In order to cut out a sequence, a start event and an end event of a sequence are designated in advance, and the event signal 103 is cut out while scanning from the beginning to the end in the following manner.
(1) If it is not in the middle of the sequence, search for a start event. When it is found, the sequence starts.
(2) In the middle of a sequence, search for an end event. If found, end the sequence.
Here, the end event is a specified end event, a failure, a warning, or a specified start event. If it is terminated at a non-specified end event, it is recorded as an abnormal end. In the following, “cluster” refers to the time periods that are sequentially and sequentially not cut out in this way.
I will call it.

A second embodiment of the mode division method will be described with reference to FIG. The first embodiment is an example in which the start and end of the start sequence and the stop sequence can be specified, and four modes appear in order. Here, an example in which such specification cannot be performed is shown. . First, the event signal 103 is input (S301), and when the time interval becomes equal to or greater than the threshold value, a separation process is performed (S302), and an event sequence is created. Next, all unique event sequences are listed (S303), and the similarity between the event sequences is examined (S304). For example, if the length of each event sequence is L1, L2, the number of events required to change one to the other is deleted, and the number of additions is C

It is represented by

  For example, if one event sequence is aabc and the other is abb, then L1 = 4, L2 = 3, C = 3 (if you delete a and c from the former and add b, it becomes the latter), so the similarity is 4/7 = 0.571. Next, similar event strings are grouped based on the similarity between the event strings, and group labels are attached to all event strings (S305). The event occurrence period from the first time to the last time in the event sequence from the sensor signal 102 and the inter-event period sandwiched between the event sequences are sequentially cut out. By this process, the same cluster as described above is obtained. The event occurrence period is classified into a mode corresponding to the group label, and the inter-event period is classified into a mode corresponding to the combination of the preceding and succeeding groups (S306).

As described above, by using event information, it is possible to accurately divide various operating states, and it becomes simple when viewed by each mode, so the subsequent normal state model must be created with high accuracy. Is possible.

A data processing method during learning in the feature extraction unit 105 and the normal model creation unit 106 and an abnormality measure calculation method in the abnormality measure calculation unit 107 will be described with reference to FIGS.

An example of the sensor signal 102 is shown in FIG. Multiple time series signals, where time series / ×
Four types of signals are represented: signal 1 corresponding to x1, signal 2 corresponding to time series / xxx2, signal 3 corresponding to time series / xxx3, and signal 4 corresponding to time series / xxx4. ing. actually,
The number is not limited to four, and there may be a number of hundreds to thousands. Each signal corresponds to the output from a plurality of sensors provided in the equipment 101. For example, the temperature of the cylinder, oil, cooling water, the pressure of the oil or cooling water, the rotational speed of the shaft, the room temperature, the operating time, Are observed at regular intervals. In addition to representing an output or state, there may be a control signal for controlling something to a certain value. In the present invention, these data are handled as multidimensional time series signals.

FIG. 5 shows a normal model creation process flow processed by the feature quantity extraction unit 105 and the normal model creation unit 106. In this processing flow, first, the sensor signal 1 is sent to the feature amount extraction unit 105.
02 is input (S501), and feature amount extraction / conversion / selection processing is performed (S502). Next, the processed data is input to the normal model creation unit 106 to select learning data (S503).
The learning data is classified by mode with reference to the mode division information output from the mode division unit 104 (S504), and a normal model is created for each mode (S505).

Next, each step will be described in detail.
First, in step S <b> 501, the feature extraction unit 105 receives the sensor signal 102.
In step S502, the feature quantity extraction unit 105 performs feature selection, feature extraction, and feature conversion to obtain a feature vector. Although not shown, the sensor signal 102 is stored in advance, and a signal for a specified period is input. Also, the event signal 103 is used for mode division.
Are also accumulated during the same period.

Feature selection needs to exclude sensor signals with very small variance and monotonically increasing sensor signals as a minimum processing. It is also conceivable to delete invalid signals by correlation analysis. This is because when a correlation analysis is performed on a multidimensional time series signal and there are a plurality of signals having a correlation value close to 1, such that there is a high similarity, these are redundant and duplicated from the plurality of signals. This is a method of deleting signals and leaving non-overlapping ones. In addition, the user may specify. The selected sensor is stored so that the same sensor signal can be used during the evaluation.

For feature extraction, it is conceivable to use the sensor signal as it is, but a window of ± 1, ± 2, ... is provided for a certain time, and the feature vector of window width (3, 5, ...) x number of sensors It is also possible to extract features that represent changes in data over time. Also, discrete wavelet transform (DWT: Discrete Wavelet Transform) may be applied to decompose into frequency components. Each feature may be canonically converted using an average and standard deviation so that the average is 0 and the variance is 1. The average and standard deviation of each feature is stored so that the same conversion can be performed at the time of evaluation.
Or you may normalize using the maximum value and minimum value, or the preset upper limit and lower limit. These processes are for simultaneously handling sensor signals of different units and scales.

For feature conversion, Principal Component Analysis (PCA), Independent Component Analysis (ICA:
Independent Component Analysis), non-negative matrix factorization (NMF)
orization), latent structure projection (PLS: Projection to Latent Structure), canonical correlation analysis (CCA:
There are various methods such as Canonical Correlation Analysis), but any method may be used, or they may be used in combination or may not be converted. Principal component analysis, independent component analysis, and non-negative matrix factorization are easy to use because there is no need to set objective variables. Parameters necessary for conversion, such as a conversion matrix, are stored so that the same conversion as in normal model creation is performed during evaluation.

In step S503, the feature-converted data is input to the normal model creation unit 106, and the normal model creation unit 106 selects learning data. First, since the acquired multidimensional time series signal may be missing, such data is deleted. For example, when most sensor signals output 0 simultaneously, all signal data at the corresponding time is deleted. Next, abnormal signal data is removed. Specifically, the time at which the warning or failure occurs is checked from the event signal 103, and all signal data of the cluster including the time (the period sequentially cut out in the above-described mode division) is removed.

Next, in step S504, the normal model creation unit 106 classifies the learning data selected in step S503 for each mode divided by the mode division unit 104, and creates a normal model for each mode in step S505.

As a normal model creation method, a projection distance method (PDM) or a local sub-space classifier (LSC) can be considered. The projection distance method is a method of creating a subspace having an original origin for learning data, that is, an affine subspace (space with maximum variance). For each cluster, an affine subspace is created as shown in FIG. In the figure, an example of creating a one-dimensional affine subspace in a three-dimensional feature space is shown.
The dimension of the feature space may be larger, and the dimension of the affine subspace may be any number as long as it is smaller than the dimension of the feature space and smaller than the number of learning data.

A method for calculating the affine subspace will be described. First, the mean μ of the learning data and the covariance matrix Σ are obtained, then the eigenvalue problem of Σ is solved, and a matrix U in which eigenvectors corresponding to r eigenvalues designated in advance from the larger one are arranged in the affine subspace. Let it be an orthonormal basis. The anomaly measure calculated by the anomaly measure calculation unit 107 is defined as the minimum value of the projection distance d to the affine subspace of each cluster belonging to the same mode as the evaluation data obtained from the sensor signal 102 via the feature extraction unit 105. . Here, instead of creating an affine subspace for each cluster, all clusters in the same mode may be collected to create an affine subspace. According to this method, the number of times of calculating the projection distance can be reduced, and the abnormal measure can be calculated at high speed. The abnormality measure calculation is basically a real-time process.

On the other hand, the local subspace method is a method of creating a k-1 dimensional affine subspace using k-neighbor data of the evaluation data q. FIG. 7 shows an example in the case of k = 3. As shown in FIG. 7, since the abnormal measure is expressed by the projection distance shown in the figure, the point b on the affine subspace closest to the evaluation data q may be obtained. In order to calculate b from the evaluation data q and its k-neighbor data xi (i = 1, ..., k), from the matrix Q and the matrix X that arranges k and q

To obtain the correlation matrix C,

To calculate b.

  In this method, since the affine subspace cannot be created unless the evaluation data is input, the normal model creation unit 106 selects the learning data shown in FIG. A kd tree for searching is constructed for each mode. The kd-tree is a space division data structure that classifies points in the k-dimensional Euclidean space. The segmentation is performed using only a plane perpendicular to one of the coordinate axes, and one point is stored in each leaf node. The anomaly measure calculation unit 107 obtains k-neighbor data of the evaluation data using a kd tree belonging to the same mode as the evaluation data, obtains the aforementioned point b from them, and calculates the distance between the evaluation data and the point b. An anomaly measure.

In addition, a normal model can be created using various methods such as Mahalanobis Taguchi method, regression analysis method, nearest neighbor method, similarity base model, and one-class SVM.

Next, a learning data sufficiency check method in the learning data check unit 108 will be described with reference to FIGS. FIG. 8 shows an example in which an abnormal measure is calculated based on the sensor signal 102 and the event signal 103 using the above-described projection distance method. A graph 801 represents an abnormality measure, a graph 802 represents the number of occurrences of a failure, and the horizontal axis represents time. It can be seen that a failure has occurred at the time of 803 and the abnormality measure has increased. However, the abnormal measure is large in other parts, and it is difficult to determine the threshold value so as not to give false information.

It has been found that the abnormal measure increases in spite of normality during the transition from one steady state to the other steady state in the “start” mode or “stop” mode. In other words, since the learning data is insufficient, the state of the mode cannot be expressed sufficiently. Accordingly, the sufficiency of the learning data is obtained for each mode, and the threshold value is determined for each mode accordingly.

The sufficiency check is performed by, for example, cross-validation of learning data. k-fold cross valid
This method is called ation, and the data is divided into k groups, one of which is the evaluation data,
A model is created using the rest as learning data, and an abnormal measure is calculated. If the same processing is performed for all k groups while replacing the evaluation data, the abnormality measure can be calculated for all data. Here, when k is increased, a model closer to the model of the entire learning data can be obtained. However, since the calculation time becomes longer, it is necessary to select an appropriate k.

After calculating the abnormal measure for all data, the frequency distribution (histogram) of the abnormal measure is created for each mode. Based on this, a cumulative histogram is created, and a value reaching a ratio close to 1 specified in advance is obtained. It can be said that the larger this value, the less the learning data. The threshold is determined for each mode by processing such as adding an offset or multiplying by a constant based on this value. The identification unit 109 determines that there is an abnormality when the abnormality measure is equal to or greater than the threshold value thus determined.

FIG. 9 shows an example of a GUI related to the learning data check. The signal display screen, the feature display screen, the signal enlargement display screen, the feature enlargement display screen, the abnormal measure display screen, and the abnormal measure cumulative histogram screen can be switched by selecting a menu (selecting a tab displayed at the top of each screen).
FIG. 9A shows a signal display screen 901. The signal display screen 901 is composed of a plurality of signal display windows 902. In each window, the sensor signal 102 for a period previously designated as learning data is displayed as time-series data for each sensor (for each signal). The period of learning data is displayed in a period display window 903, and designation can be made in this window. That is, by designating the period to be displayed in the period display window and clicking the period designation button 912, the data of the period currently displayed in the signal display window 902 is switched to the data of the designated period and displayed. . Display / non-display of each window 902 can be selected by a minimize button 904 and a maximize button 905, and the display order can be changed by a drag-and-drop operation. FIG. 9A shows a state in which signals 1 to 4 are maximized and displayed and signals 5 to 7 are minimized. A cursor 906 represents a starting point for enlarged display and can be moved by a mouse operation or a keyboard operation.
FIG. 9B shows a feature display screen 907. The feature display screen 907 includes a plurality of feature display windows 908, and the feature vectors output from the feature extraction unit 105 are displayed in each window as time-series data according to dimensions. The display / non-display selection and the display order operation are the same as those on the signal display screen 901. A cursor 909 is a cursor 906 on the signal display screen 901.
Is displayed at the same time, but you can also move on this screen.

FIG. 9C shows a signal enlargement display screen 910. The signal enlargement display screen 910 is composed of a plurality of signal enlargement display windows 911. In each window, an enlarged display of the signal is performed starting from the time indicated by the cursor 906 on the signal display screen 901. Signal display
The non-display and display order follow the signal display screen 901. In the period designation window 912, the period from the display start point to the end point is specified in units of hours or days. Scroll bar 91
It is also possible to change the starting point of the display at 3, and this change is reflected in the positions of the cursor 906 and the cursor 909. The entire length of the scroll bar display area 9131 corresponds to the period specified in the period display window 903 of the signal display screen 901 or the characteristic display screen 907. The length of the scroll bar 913 corresponds to the period specified in the period specifying window 912, and the left end of the scroll bar 913 corresponds to the starting point of each signal displayed in the signal enlargement display window 911. At the same time, the mode display unit 914 displays the modes representing the above-described operation states in different colors. Although the feature enlargement display screen is not shown, information displayed on the feature display screen 907 is displayed in the same manner as the signal enlargement display screen 910.

FIG. 9D shows an abnormal measure display screen 915. The anomaly measure display screen 915 includes an anomaly measure display window 916 and an anomaly measure enlargement display window 917, and the anomaly measure display window 916 displays an anomaly measure calculated by cross-validation. The cursor 918 is synchronized with the cursor 906 and the cursor 909, but can also be moved on this screen. The abnormal measure enlarged display window 917 performs enlarged display similar to the signal enlarged display screen 910 starting from the time indicated by the cursor 918. Threshold value 924 for identification again
Is also displayed. The period designation window 919 and the scroll bar 920 also function in the same manner as the signal enlargement display screen 910.
FIG. 9E shows an abnormal measure cumulative histogram screen 921. The abnormal measure cumulative histogram screen 921 includes a histogram display window 922 and a parameter display screen 923 for the number of modes. The histogram display window 922 displays a cumulative histogram of abnormal measures for each mode, and threshold values calculated according to the parameters shown on the parameter display screen 923 are indicated by dotted lines 924-1 to 924-4. This threshold value is used for abnormality identification in the identification unit 109.

The parameters displayed on the parameter display screen 923 are the ratio for determining the reference value and the magnification for multiplying the offset used for threshold calculation by a constant in the threshold calculation method described above. Parameters can be changed on the parameter display screen 923, and the threshold values displayed in the histogram display window 922 and the abnormal measure enlargement display window 917 change with the change.

With the GUI as described above, sensor signals, extracted features, modes, anomaly measures,
Since the threshold value can be visually confirmed, it is possible to judge whether the model is good or bad, and as a result, a better normal model can be created.

Next, processing in the abnormality diagnosis unit 110 will be described.
10A and 10B show a causal relationship learning method in the abnormality diagnosis unit 110. FIG. First, FIG.
The procedure for creating the frequency matrix 1020 shown in B will be described with reference to the flowchart of FIG. 10A. First, the sensor signal 102 and the event signal 103 for a certain period are input to the abnormality diagnosis unit 110 (S1001 and S1011). Because we need to learn many cases of failure,
It takes a longer period than the training data for creating a normal model. It is also possible to increase the number of cases using data from multiple devices. Next, a failure event is extracted from the event signal 103 (S1002), and a result event list is created (S1003). Add "Nothing happens" to the result event list.

On the other hand, abnormality identification is performed by the above-described abnormality identification method based on the sensor signal 102 and the event signal 103 (S1012). Anomaly identification is performed using a threshold value calculated by an appropriate parameter after calculating an anomaly measure by cross-validation. Alternatively, it is performed using a normal model and a threshold value learned in advance using different data. The feature vector at the time determined to be abnormal is picked up (S1013), and vector quantization is performed by applying an unsupervised clustering method such as k-means or EM algorithm (S1014). Vector quantization is to collect similar vectors, group them, and calculate the average of them as a representative vector of the group. A label representing the group is attached to each representative vector. A list is created using the labeled vector as a cause event (S1015).

Next, a frequency matrix 1020 is created with the horizontal axis as a result event and the vertical axis as a cause event (S1).
020). When creating learning data using the frequency matrix 1020, all elements of the matrix are first reset to zero. Scan the anomaly measure along the time series and examine the anomaly occurrence time exceeding the threshold. The time during which the causal relationship is recognized is designated in advance, the event signal 103 from the abnormality occurrence time to the lapse of the designated time is examined, and a failure event is extracted. The nearest representative vector is obtained from the sensor signal 102 at the time of occurrence of the abnormality or a feature extracted based on it. The crossing element between the obtained representative vector and the extracted failure event is counted up. If no failure event is extracted, the element where the representative vector and “nothing happens” cross is counted up. Perform this operation for the entire specified period. Also, the frequency of each representative vector is checked.

Next, the flow of processing during evaluation will be described using FIG. 10C. First, the sensor signal 102 is input to the feature amount extraction unit 105 (S151), the event signal 103 is input to the mode division unit 104 (S152), and abnormality identification is performed by the abnormality identification unit 109 in the same manner as described above (S153). . The distance between the feature vector at the time determined to be abnormal and each of the representative vectors is checked, and the cause event X corresponding to the closest vector is extracted (S154). The frequency matrix 10
The line corresponding to the causal event X is checked on 20, the result events Y1, Y2, Y3... Are extracted in the order of frequency (S155), and the extracted results are presented (displayed on the screen) (S156). This presentation is a notice that these consequential events may occur. At the same time, the frequency of the cause event X and the result events Y1, Y2, Y3... Divided by the frequency of the cause event X is presented as the probability of the event occurrence. Furthermore, a frequency matrix 1005 based on the data at the time of occurrence of an abnormality at the time of evaluation.
May be updated. The diagnosis process is basically a real-time process.

In diagnosis, it is also important to present the causal event in an easy-to-understand manner. That is, it is necessary to explain in what state the sensor signal is abnormal. For this purpose, a normal signal and an actual signal may be superimposed and displayed for a certain period of time before and after the abnormality. For example, when calculating the abnormal measure by the projection distance method or the local subspace method,
The coordinates of the foot of the perpendicular line from the evaluation data to the affine subspace (b in FIGS. 6 and 7) are displayed. By displaying it as time-series information, it is easy to confirm that the movement is not normal.
Further, since a signal with a large deviation is considered to contribute to the abnormality determination when an abnormality occurs, it is easy to check which sensor signal is abnormal when the signals are displayed from the top in the order of the large deviation. In addition, if you display the past cause event examples in the same way for the presented result event,
It is easy to be convinced that it is the same phenomenon, and it is possible to trust the notice of the result event.

As described above, by detecting an abnormality based on the sensor signal 102 and then quantizing the sensor signal, it is possible to narrow down the information and use it as a matrix input, thereby realizing the causal relationship between events. In the learning of the causal relationship, by counting the result events from the occurrence of the causal event until the lapse of a predetermined time, it is possible to extract the causal relationship having a time difference, and as a result, it is possible to predict the failure based on the event. That is, it is possible to detect a sign of failure.

The frequency matrix 1005 of the cause event and the result event obtained here can be used for the sufficiency check of the learning data described above in addition to the diagnosis. Specifically, a signal vector having a high occurrence frequency and a high probability of “nothing happening” may be examined, and the threshold value in the case of the signal vector may be increased.

The failure occurrence notice after the abnormality detection has been described above, but the time until failure occurrence can be predicted by adding processing. When the frequency matrix 1005 is created, a time difference matrix of the same cause event and result event is created. However, the column “Nothing happens” is deleted. First, all elements are reset to 0. If a failure event is extracted between the occurrence time of the abnormality and the lapse of the specified time, the elapsed time from the occurrence time of the abnormality is calculated, and the value is added to the crossing element of the corresponding cause event and the extracted failure event. As a result, the total time from the occurrence of a cause event to the occurrence of a result event of a case where a result has occurred due to a certain event is calculated. At the time of evaluation, the cause event is identified after the abnormality is detected, and the actual difference of the time difference between the events is obtained by dividing the element of the time difference matrix by the frequency for the result event extracted based on the frequency matrix. This presentation of time is a prediction of the time of occurrence.

Hereinafter, as a modification of the processing method described with reference to FIG. 10A, an embodiment of an abnormality diagnosis method that does not use the sensor signal 102 will be described with reference to FIG. FIG. 11 is a flowchart of abnormality diagnosis processing based only on the event signal 103. During learning, the event signal 103 for a certain period is input to the abnormality diagnosis unit 110 (S1101). Since it is necessary to learn many cases in which failures occur, set as long a period as possible. Cases may be increased using data from a plurality of devices. Next, the failure event 1001 is extracted from the event signal 103 (S1102), and “nothing happens” is added to create a result event list (S1103). On the other hand, the event signal 103
All types of events are extracted from (S1104), and a cause event list is created (S110).
5).

Next, a frequency matrix 1120 as shown in FIG. 11B is created with the result event 1103 on the horizontal axis and the cause event 1115 on the vertical axis (S1106). When learning data is generated using the frequency matrix 1120, as in the case described with reference to FIG. 10B, all elements of the matrix are first reset to 0, and the event signal 103 is sequentially processed in time series.

A time during which a causal relationship is recognized is designated in advance, and a failure event that occurs between the occurrence of a certain event and the lapse of the designated time is extracted. The elements where the former event, that is, the cause event, and the extracted failure event cross are counted up. When no failure event is extracted, the element where the cause event and “nothing happens” cross is counted up. This process is performed for all input event signals 103. Also check the frequency of each event.

At the time of evaluation, the event signal 103 is acquired in real time and immediately processed. When the event, that is, the cause event X occurs, the corresponding row of the frequency matrix is examined, and the result events Y1, Y2, Y3,... According to this method, the occurrence of a failure can be predicted only by analyzing the event signal 103.

In the above description, the event signal is automatically output by the apparatus. However, as a result event of the frequency matrix 1005 of the cause event and the result event, an item of a defect found in the periodic inspection may be used together. In addition, images, sounds,
Data such as odor and vibration may be quantized and used.

In addition, when the equipment to be monitored is an apparatus used intermittently such as an image diagnostic apparatus, a measurement apparatus, or a manufacturing apparatus, data obtained at the time of use can be used as a cause event or a result event. For example, in the case of an image diagnostic apparatus, the image is classified into a predetermined category based on the defect and image quality of the obtained image. If it is a measuring device, a reference object is periodically measured and the result is quantized. If it is a manufacturing apparatus, the quality of the intermediate product after processing is classified into a predetermined category according to the result of inspection or measurement.

FIG. 12A shows a configuration example of a second embodiment relating to a system for realizing the equipment state monitoring method of the present invention.

In this system, the sensor signal analysis unit 100 described in FIG.
The sensor signal analysis unit 1200 as shown in FIG.

The sensor signal analysis unit 1200 receives the sensor signal 102 output from the facility 101 and performs feature extraction of the signal. The feature extraction unit 1201 that obtains a feature vector and feature selection that receives the output of the feature extraction unit 1201 perform feature selection. 1202, a learning data selection unit 1203 that selects learning data to be used in response to the output of the feature selection unit 1202, a normal model creation unit 1204 that creates a normal model in response to the output of the learning data selection unit 1203, and a normal model creation unit An abnormal measure calculation unit 1205 that calculates an abnormal measure from a feature vector obtained through the feature extraction unit 1201 and the feature selection unit 1202 using the normal model created in 1204, and a normal model creation unit 1204
A learning data check unit 1206 and a learning data check unit 1206 that check the normal model based on the abnormality measure calculated by the abnormality measure calculation unit 1205 for the normal model created in step S1.
An abnormality identification unit 1207 for identifying an abnormality based on the abnormality measure calculated from the normal model data checked in step S2 and the feature vector obtained from the sensor signal 102 through the feature extraction unit 1201 and the feature selection unit 1202 in the abnormality measure calculation unit 1205; It is configured with.

The flow of processing during learning of this system will be described with reference to FIG. 12B. The term “learning” refers to offline processing in which a model used for abnormality sign detection is created in advance.

Although not shown, the sensor signal 102 output from the facility 101 is stored in advance for learning. The feature extraction unit 1201 inputs the accumulated sensor signal 102 (S1201).
Then, feature extraction is performed to obtain a feature vector (S1202).

The feature selection unit 1202 performs data check on the feature vector output from the feature extraction unit 1201 and selects a feature to be used (S1203).

The learning data selection unit 1203 performs data check of the feature vector composed of the selected features, and selects learning data used for normal model creation (S1204). The selected learning data is divided into k groups (S1205), except for one group, which is input to the normal model creation unit 1204. The normal model creation unit 1204 performs learning using this, and the normal model Is created (S1206).

The anomaly measure calculation unit 1205 calculates the anomaly measure by using the created normal model and inputting the data of the group removed in S1206 (S1207). If the calculation of the anomaly measure has not been completed for the data of all groups (S1208), for other groups (
Steps S1209), normal model creation (S1206), and abnormality measure calculation (S1207) are repeated. When the calculation of the abnormality measure is completed for the data of all groups (S120)
8) Go to the next step.

The learning data check unit 1206 sets a threshold value for identifying an abnormality based on the abnormality measure calculated for the data of all groups (S1209). Normal model creation part 1
In 204, learning is performed using all selected learning data, and a normal model is created (S
1210).

Next, the flow of processing during evaluation of this system will be described with reference to FIG. 12C. Evaluation time refers to a process of detecting an abnormal sign based on a model created by learning and an input signal. Although it is basically online processing, it may be configured to be offline processing.

The feature extraction unit 1201 receives the sensor signal 102 (S1212), performs feature extraction similar to that during learning, and obtains a feature vector (S1213).

The feature selection unit 1202 creates a feature vector composed of features selected during learning based on the feature vector output from the feature extraction unit 1201 (S1214).

The feature vector created by the feature selection unit 1202 is input to the anomaly measure calculation unit 1205, and the anomaly measure is calculated using the normal model created by the normal model creation unit 1204 during learning (S1210) (S1215). . The calculated abnormality measure is input to the abnormality identification unit 1207, and abnormality determination is performed by comparing with the threshold value set during learning (S1209) (S1216).

Next, the operation of each unit shown in FIG. 12A will be described in detail in order.
For feature extraction in the feature extraction unit 1201, it is conceivable to use the sensor signal as it is. However, a window of ± 1, ± 2,... Is provided for a certain time, and the window width (3, 5,...) × the number of sensors. It is conceivable to extract a feature representing a time change of data using a feature vector. Also, discrete wavelet transform (DWT: Discrete Wavelet Transform) may be applied to decompose into frequency components. Each feature may be canonically converted using an average and standard deviation so that the average is 0 and the variance is 1. The average and standard deviation of each feature is stored so that the same conversion can be performed at the time of evaluation. Or you may normalize using the maximum value and minimum value, or the preset upper limit and lower limit.

A first embodiment of feature selection processing during learning in the feature selection unit 1202 will be described. The purpose of this process is to remove features that cause a decrease in accuracy of the normal model. From this, we consider excluding features with large long-term fluctuations. This is because the use of features with large long-term fluctuations leads to an increase in the number of states in the normal state and causes a shortage of learning data. Here, the thing which only has the big fluctuation | variation by the difference in a driving | running state applies to most characteristics, and should not be excluded. Therefore, the influence of fluctuation due to the difference in the operation state is removed by performing data check for each operation cycle of the equipment.

Specifically, the average and variance for each period are calculated for each feature of all learning data, and features with large variations are excluded. However, data for a period in which it is known in advance that an abnormality has occurred cannot be taken into consideration. FIG. 13 shows an example in which the average and variance are calculated and plotted every day. In this example, the feature A is stable in both mean and variance, whereas the feature B has a large variation and should be excluded. In this way, when the operation cycle starts regularly or ends at a fixed time of the day, for example, the average and variance may be calculated by cutting out data for a fixed period, that is, every day. The same applies even if the period is not one day. When the operation start / end times are known, the average and variance may be calculated by cutting out a period that can be regarded as steady operation, and this method can be applied even if the operation cycle is irregular.

Next, a second embodiment of the feature selection process during learning will be described. In this method, a waveform model for one cycle is created and the number of deviations from the model is checked. If the operation cycle is regular,
The waveform for one period is overlaid for each feature of all learning data. Xi (t
), The average μ (t) and the variance σ (t) are calculated by the following equation, and are counted as out of the range of μ (t) ± k · σ (t).

The number of deviations Ci of the waveform xi (t) is represented by the following equation.

FIG. 14 shows an example of a waveform model. The horizontal axis represents time, the vertical axis represents feature values, and μ (t) is a solid line
, Μ (t) ± k · σ (t) was plotted with a dotted line.

Even if the operation cycle is irregular, if the operation start and end times are known, after combining the operation start time and end time, the section that can be regarded as steady operation and the section that can be regarded as complete stop are stretched and overlapped In the same manner, average μ (t) and variance σ (t) are calculated. When checking the number of deviations, the operation start time and end time are matched to expand and contract the waveforms.

The features that should be excluded shall have a large number of misses overall. For example, when the ratio of the average number of deviations to the variance (average / variance) is small, it can be determined that the number of deviations is large as a whole. Alternatively, when the ratio of the average when the predetermined number is removed from the larger number of misses and the overall average is large, it can be determined that the number of misses is overall large. What is necessary is just to calculate these and to judge with an appropriate threshold value.

Next, a third embodiment of feature selection processing during learning will be described with reference to FIGS. 15 and 16. In this embodiment, information on whether the state at each time is normal or abnormal is added to the accumulated sensor signal 102. Although not shown, this is a method of labeling the data of the previous and subsequent times based on the event signal 103 based on the time when the warning or failure occurred, as normal or abnormal.

FIG. 15 shows the method. The horizontal axis of the figure is the time, the time T when the warning or failure occurred
0 is the center. An anomaly label is attached to data at a time between t1 and a predetermined time before and after T0. Labels are not applied from time T0-t1 to t2 hours before and from time T0 + t1 to t2 hours after. Normal labels are attached before time T0-t1-t2 and after time T0 + t1 + t2. If warnings or failures occur in close proximity, labels are based on the time of each warning or failure, and times with multiple types of labels are labeled in the order of abnormality, no label, and normal. To decide. Using the sensor signal data labeled as described above, optimization is performed based on the maximum evaluation value criterion.

Here, a method for calculating the evaluation value will be described below. First, using data with normal labels,
A normal model is created using the same technique as that used in the normal model creation unit 1204. In addition, data with normal labels is divided into k groups, and each group is removed to create a normal model. As a result, k normal models are created. Next, the abnormality measure of the data with the normal label is calculated using the same method as the method used by the abnormality measure calculation unit 1205 using the normal model created in the group not including the data. A representative value Dn of the abnormality measure of the normal part is obtained from the obtained abnormality measure. As a method for obtaining Dn, an average of all data, a maximum value, a value that reaches a predetermined ratio by arranging data in ascending order, a maximum value after applying a minimum value filter with a certain width, and the like can be considered.

Next, the abnormality measure of the data with the abnormal label is calculated using a normal model created with the whole data with the normal label. A representative value Df of the abnormal measure of the abnormal part is obtained from the obtained abnormal measure. The method for obtaining Df is the average of all abnormally labeled data, the maximum value, the value that reaches the specified ratio by arranging the data in ascending order, the minimum value, the maximum value after applying the minimum value filter with a certain width, and the certain width The minimum value after applying the maximum value filter, the average of data exceeding a predetermined ratio by arranging the data in ascending order, and the like can be considered. In order to cope with a plurality of types of warnings or failures, the above is calculated for each continuous section with an abnormal label, and the minimum value of the values calculated in all the sections is Df. Finally, the ratio Df / Dn of the abnormal measure between the normal part and the abnormal part is used as the evaluation value.

As an optimization method, anything such as brute force, wrapper method, random selection, gene algorithm, etc. may be used. As an example, the backward type wrapper method will be described with reference to FIG. This is a method that starts from all the features and removes one feature at a time, even if it is removed.

First, the process starts from using all d features (S1601). Let n be the number of features being evaluated. The evaluation value E (n) is calculated by the above method using n features (S1602). Each feature is extracted one by one and n evaluation values are calculated (S1603). Next, it is determined whether any of those evaluation values is E (n) or more (S1604). If there is a value equal to or greater than E (n), one feature is extracted so that the evaluation value becomes the highest, and the evaluation value at that time is set to E (n-1) (S1605). n is decremented by 1 (S1606), and the process returns to step S1603.

If there is no more than E (n) in step S1604, the feature extracted immediately before is returned (S16).
07), two features are extracted and n × (n−1) evaluation values are calculated (S1608). It is determined whether there is an evaluation value that is equal to or greater than E (n) (S1609). If there are more than E (n), two features are extracted so that the evaluation value is the highest, and the evaluation value at that time is set to E (n-1) (S1610). n is decremented by 1 (S1606), and the process returns to step S1603. If there is no more than E (n) in step S1609, the process ends and adopts the feature combination at that time (S1611).

There is also a forward method in the wrapper method, which starts from 0 and adds features that improve the evaluation value one by one.

A learning data selection process in the learning data selection unit 1203 will be described. The purpose of this process is to remove abnormal data that should not be used to create a normal model. Therefore, by checking the data for each operation cycle of the equipment to remove the influence of fluctuation due to the difference in the operation state, the data of the period that becomes the outlier is removed from the learning data.

Specifically, the average and variance for each period are calculated for each feature of all the learning data, and the outlier value is searched for and the data of the corresponding period is removed. FIG. 17 shows an example in which the average and variance are calculated and plotted every day. Plot of two types of features, feature C
, The data surrounded by circles for the feature D are outliers. In order to find these, hierarchical clustering is performed based on the distance, and one or a few isolated data are searched.

In addition, a method of creating a waveform model for one period and checking the number of deviations from the model is also conceivable. The average μ (t) and variance σ (t) are calculated by the same method as in the second embodiment of feature selection, and are counted as out of the range of μ (t) ± k · σ (t). An average of the number of deviations is calculated for each feature, and if a certain feature has an extremely large number of deviations for one period compared to the average (for example, several times or more), data for that period is removed. Alternatively, the number of features whose number of outliers exceeds the average is counted for each period, and data with a large period is removed.

Another embodiment of the learning data selection process in the learning data selection unit 1203 will be described with reference to FIG. First, a feature vector composed of selected features output from the feature selection unit 1202 is input (S1801). Next, the input data is divided every one operation cycle (S1802). When the operation cycle is unknown, a unit that is easy to handle, such as every day, may be used.

Next, one cycle of data is determined as a check target (S1803), and normal models are created by sampling for several cycles at random from the remainder excluding the check target to create k1 models. (S1804). The model creation method at this time is the same as the method used in the normal model creation unit 1204. The abnormality measure to be checked is calculated using k1 normal models, respectively (S1805). As a result, k1 abnormality measures are calculated at each time. Next, k2 out of k1 abnormal measures at each time are selected from the smaller ones, an average is calculated, and this is used as the abnormal measure at that time (S1806).

The maximum value in one cycle of the average of the calculated anomaly measure is obtained, and this is set as a representative value of the anomaly measure in that cycle (S1807). If the calculation of representative values has not been completed for all cycles (S18)
08) The data of the next cycle is determined as a check target (S1809), and the processing from step S1804 is repeated. If completed, data having a period with a large representative value of the abnormality measure is excluded from the learning data (S1810).

In this example, by creating a plurality of normal models by random sampling,
Some models are expected to be created with data that does not contain anomalies, even if the data contains anomalous conditions. If the check target is normal, the anomaly measure calculated using a model created with normal data is small, so the average of several anomaly measures selected from the smaller one is small. If the check target is abnormal, the anomaly measure calculated using a model created with data containing the same anomaly will be small, but by using several models, all of them will not contain anomalies. Taking an average increases the anomaly measure. It is possible to exclude abnormal data by this method on the premise that the ratio of abnormalities to be mixed is low.

According to the method described above, it is possible to automatically select a feature to be used and learning data based on a feature vector data check. As a result, the user can create a high-accuracy normal model simply by inputting the entire sensor signal without examining usage characteristics and learning data, and can realize highly sensitive abnormality detection with less effort.

In the present embodiment shown in FIG. 12A, only the sensor signal is used.
Similarly to the embodiment shown in A, an event signal is input, mode division is performed based on the event signal, and a threshold value is set for each mode by creating a normal model and checking the sufficiency of learning data. Are included in the present invention.

In this case, it is conceivable to use an event signal for learning data selection processing in the learning data selection unit 1203. Hereinafter, an embodiment of learning data selection processing using an event signal will be described. The basic policy is to determine whether or not an abnormal state is included in a predetermined basic unit based on the event signal, and to remove the basic unit including the abnormal state from the learning data. The predetermined basic unit is, for example, one day. This is determined from the two viewpoints of covering various operating states and removing the influence of abnormal states with a margin.

Conditions for determining an abnormality are, for example, as follows. (1) A failure or warning event occurs, (2) An abnormal startup sequence is included, (3) The number of startup sequences is different from the others, (4) The interval between the startup sequence and the end sequence is different from others (5 ) Infrequent events or event sequences occur. To check (1), it is only necessary to search for a failure / warning from the event signal and check the date and time. In order to check (2), (3), and (4), the start sequence and the end sequence are cut out by the method described with reference to FIG. 2, and it is determined whether the cut out sequence is normal.

A normal sequence ends with a pre-designated end event, and when it ends with a failure or warning event or a pre-designated sequence start event, it is determined as an abnormal sequence. Also, it is determined whether it is normal or abnormal based on knowledge about the normal sequence such as the number of specific events in the sequence and the order of events. For the check of (5), the frequency of the event or event sequence is checked in advance. However, the frequency of event sequences may be counted as similar event sequences by the method shown in FIG.

FIG. 19 shows a configuration example of a system that realizes the facility state monitoring method according to the third embodiment.
The system for monitoring the equipment state of the present embodiment includes a sensor signal analysis unit 1900 corresponding to the sensor signal analysis unit 1200 of FIG. 12 described in the second embodiment and a mode corresponding to the mode division unit 104 described in the first embodiment. The dividing unit 1908 is combined.

This system receives a sensor signal 102 output from the equipment 101, performs signal feature extraction, obtains a feature vector, a feature extraction unit 1901, receives a feature extraction unit 1901, and outputs a feature selection unit 1902 that performs feature selection. A learning data selection unit 1903 that selects learning data to be used in response to the event signal 103 output from the facility 101 and the output of the feature selection unit 1902;
A normal model creation unit 190 that creates a normal model in response to the output of the learning data selection unit 1903
4. An anomaly measure calculation unit 19 that calculates an anomaly measure from a feature vector obtained through a feature extraction unit 1901 and a feature selection unit 1902 using the normal model created by the normal model creation unit 1904
05, the abnormality measure calculation unit 1905 for the normal model created by the normal model creation unit 1904
A learning data check unit 1906 that checks the normal model based on the abnormality measure calculated in step 1906.
The normal model data checked by the learning data check unit 1906 and the abnormal measure calculation unit 1
From the equipment 101, a sensor signal analysis unit 1900 having an abnormality identification unit 1907 for identifying an abnormality based on an abnormality measure calculated from a feature vector obtained from the sensor signal 102 through a feature extraction unit 1901 and a feature selection unit 1902 in 905 A mode dividing unit 1908 that receives the output event signal 103 and divides the time according to a change in the operating state of the equipment 101 is provided.

The flow of processing during learning of this system will be described.
The sensor signal 102 output from the facility 101 is accumulated for learning in advance. The feature extraction unit 1901 receives the accumulated sensor signal 102 and performs feature extraction to obtain a feature vector. The feature selection unit 1902 performs data check on the feature vector output from the feature extraction unit 1901 and selects the feature to be used. The learning data selection unit 1903 performs data check of the feature vector composed of the selected feature and the event signal 103, and selects learning data to be used for normal model creation.

On the other hand, the mode division unit 1908 performs mode division that divides time for each operating state based on the event signal 103. The selected learning data is divided into k groups, one of which is excluded and input to the normal model creation unit 1904, and the normal model creation unit 190
4 performs learning using this to create a normal model. Depending on the type of normal model,
A normal model is created for each mode.

The anomaly measure calculating unit 1905 calculates the anomaly measure by using the created normal model and inputting the data of the group removed when creating the normal model. If the calculation of the anomaly measure has not been completed for the data of all groups, the normal model creation and the anomaly measure calculation steps are repeated for the other groups. When the calculation of the abnormality measure is completed for the data of all groups, the process proceeds to the next step. The learning data check unit 1906 sets a threshold value for identifying an abnormality for each mode based on the abnormality measure calculated for the data of all groups.
The normal model creation unit 1904 learns using all selected learning data, and creates a normal model.

Next, the flow of processing during evaluation of this system will be described.
A feature extraction unit 1901 receives the sensor signal 102 and performs feature extraction in the same manner as in learning to obtain a feature vector. A feature selection unit 1902 learns based on the feature vector output from the feature extraction unit 1901. Create a feature vector composed of the features selected at times. The feature vector created by the feature selection unit 1902 is input to the anomaly measure calculation unit 1905, and the anomaly measure is calculated using the normal model created by the normal model creation unit 1904 during learning.
When a normal model is created for each mode, the abnormality measure is calculated using the normal models of all modes, and the minimum value is obtained. On the other hand, the mode division unit 1908 performs mode division that divides time for each operating state based on the event signal 103. The calculated abnormality measure is input to the abnormality identification unit 1907, and abnormality determination is performed by comparing with the corresponding mode among the threshold values for each mode set during learning.

Next, the operation of each unit shown in FIG. 19 will be described in detail in order.
The mode division method in the mode division unit 1908 is the same as the method described with reference to FIGS. Operations in the feature extraction unit 1901 and the feature selection unit 1902 are the same as those in the embodiment described with reference to FIG.

The learning data selection processing in the learning data selection unit 1903 may be a method using an event signal in addition to the same method as in the embodiment described with reference to FIG. An embodiment of learning data selection processing using event signals will be described. The basic policy is to determine whether or not an abnormal state is included in a predetermined basic unit based on the event signal, and to remove the basic unit including the abnormal state from the learning data. The predetermined basic unit is, for example, one day. This is determined from the two viewpoints of covering various operating states and removing the influence of abnormal states with a margin.

Conditions for determining an abnormality are, for example, as follows. (1) A failure or warning event occurs, (2) An abnormal startup sequence is included, (3) The number of startup sequences is different from the others, (4) The interval between the startup sequence and the end sequence is different from others (5 ) Infrequent events or event sequences occur. To check (1), it is only necessary to search for a failure / warning from the event signal and check the date and time. In order to check (2), (3), and (4), the start sequence and the end sequence are cut out by the method described with reference to FIG. 2, and it is determined whether the cut out sequence is normal.

A normal sequence ends with a pre-designated end event, and when it ends with a failure or warning event or a pre-designated sequence start event, it is determined as an abnormal sequence. Also, it is determined whether it is normal or abnormal based on knowledge about the normal sequence such as the number of specific events in the sequence and the order of events. For the check of (5), the frequency of the event or event sequence is checked in advance. However, the frequency of event sequences may be counted as similar event sequences by the method shown in FIG.

The normal model creation method processed by the normal model creation unit 1904 is the same as the method described with reference to FIGS.

The abnormality measure calculation method processed by the abnormality measure calculation unit 1905 is the same as the method described with reference to FIGS.

The learning data check method processed by the learning data check unit 1906 is shown in FIGS.
This is the same as the method described using.

DESCRIPTION OF SYMBOLS 101 ... Equipment 102 ... Sensor signal 103 ... Event signal 104 ... Mode division part 105 ... Feature extraction part 106 ... Normal model creation part 107 ... Abnormality measure calculation part 108 ... Learning data check unit 109 ... abnormality identification unit 110 ... abnormality diagnosis unit 1201 ... feature extraction unit 1202 ... feature selection unit 1203 ... learning data selection unit 1204 ... normal model creation unit 1205 ... Abnormality measure calculation unit 1206 ... Learning data check unit 1207 ... Abnormality identification unit.

Claims (3)

A facility state monitoring method for detecting an abnormality based on a time-series sensor signal and event signal output from a facility or apparatus,
Based on the event signal, mode division is performed for each operating state, a feature vector is extracted based on the sensor signal, a normal model is created for each mode based on the feature vector, and a normal model is created for each mode. A learning step of checking the sufficiency of the learning data, and setting a threshold according to the sufficiency of the learning data
Based on the event signal, mode division is performed for each operation state, a feature vector is extracted based on the sensor signal, an abnormality measure is calculated by comparing the normal model and the feature vector, and the abnormality measure and the threshold value are calculated. possess an abnormality detection process of the abnormality identified by comparison,
In the learning step, the feature vector at the time when the abnormality is determined by the abnormality identification is quantized as a cause event, a failure event that occurs until a predetermined time has elapsed from the time of the abnormality determination is a result event, and the cause event Creating a frequency matrix of the combination of the outcome events;
The facility state monitoring characterized in that, in the abnormality detection step, the event occurrence is predicted based on the frequency matrix created in the learning step and the feature vector at the time when abnormality is determined by the abnormality identification. Method. The normal sensor signal calculated based on the normal model and the feature vector and the actual sensor signal are displayed in a superimposed manner for a predetermined time before and after the abnormality determination when predicting the occurrence of the consequent event. Item 1. The equipment state monitoring method according to Item 1 . When predicting the occurrence of the result event, the normal sensor signal calculated based on the normal model and the feature vector and the actual sensor signal are superimposed and displayed for the learning data in which the predicted result event and the input cause event match. The facility state monitoring method according to claim 1, wherein:

Images