WO2021176732A1 - Abnormaility determination device, abnormaility determination method, and abnormaility determination program - Google Patents
Abnormaility determination device, abnormaility determination method, and abnormaility determination program Download PDFInfo
- Publication number
- WO2021176732A1 WO2021176732A1 PCT/JP2020/009876 JP2020009876W WO2021176732A1 WO 2021176732 A1 WO2021176732 A1 WO 2021176732A1 JP 2020009876 W JP2020009876 W JP 2020009876W WO 2021176732 A1 WO2021176732 A1 WO 2021176732A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- unit
- fluctuation
- determination
- abnormality
- classification
- Prior art date
Links
Images
Classifications
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B23/00—Testing or monitoring of control systems or parts thereof
- G05B23/02—Electric testing or monitoring
Definitions
- the present disclosure relates to a technique for determining whether or not data indicates an abnormality.
- Plant equipment may be controlled to release or supply substances in the event of an event such as a decrease in fuel or an increase in concentration.
- the time-series data which is the sensor data acquired by the sensor that detects the value related to the substance provided in the plant equipment, suddenly fluctuates in value when the substance is released or supplied. Therefore, in this time series data, two fluctuation patterns, a fluctuation pattern in which the fluctuation of the value is small and a fluctuation pattern in which the fluctuation of the value is large, are mixed. Fluctuation patterns with large fluctuations in value occur only when a substance is released or supplied, and therefore occur less frequently than fluctuation patterns with small fluctuations in value.
- a detection method using the k-nearest neighbor method is widely used (see Patent Document 1).
- the radius when a circle containing k normal data is drawn around the judgment target data is used as the judgment value of the judgment target data, and the size of the judgment value is large. It is determined whether or not it is abnormal.
- an abnormality is detected by a detection method using the k-nearest neighbor method from time series data in which the above-mentioned two fluctuation patterns coexist.
- learning is biased toward a fluctuation pattern in which the fluctuation of the value is small, which is a fluctuation pattern with a high frequency of occurrence, if a fluctuation pattern in which the fluctuation of the value is large occurs, it may be detected as an abnormality. That is, there is a risk of erroneous detection as an abnormality even though the control is normal for plant equipment. As a result, the load on the observer who monitors the result of abnormality detection increases.
- An object of the present disclosure is to make it possible to appropriately determine whether or not an abnormality occurs even when a variation pattern of a plurality of values having different occurrence frequencies is included.
- the abnormality determination device is A fluctuation amount calculation unit that calculates multiple fluctuation amounts by calculating the fluctuation amount of the value for each unit time for time series data, A classification unit that classifies a plurality of fluctuation amounts calculated by the fluctuation amount calculation unit into a plurality of groups, An abnormality determination unit that determines whether or not the determination target data indicates an abnormality by comparing the determination amount, which is the fluctuation amount of the value of the determination target data, with the fluctuation amount belonging to each group classified by the classification unit. To be equipped.
- a plurality of fluctuation amounts obtained from time series data are classified into a plurality of groups, and the judgment amount is compared with the fluctuation amount belonging to each group to determine whether or not an abnormality is shown.
- FIG. The block diagram of the abnormality determination apparatus 10 which concerns on Embodiment 1.
- FIG. The flowchart which shows the overall operation of the abnormality determination apparatus 10 which concerns on Embodiment 1.
- FIG. Explanatory drawing of time series data which concerns on Embodiment 1.
- FIG. An explanatory diagram of information stored in the time-series data storage unit 31 according to the first embodiment.
- the flowchart of the classification process which concerns on Embodiment 1. The explanatory view of the threshold value calculation process which concerns on Embodiment 1.
- FIG. The explanatory view of the threshold value calculation process which concerns on Embodiment 1.
- FIG. An explanatory diagram of information stored in the variable information storage unit 32 according to the first embodiment.
- FIG. The block diagram of the abnormality determination apparatus 10 which concerns on modification 2.
- FIG. The block diagram of the abnormality determination apparatus 10 which concerns on Embodiment 2.
- FIG. The flowchart which shows the overall operation of the abnormality determination apparatus 10 which concerns on Embodiment 2.
- the abnormality determination device 10 is a computer.
- the abnormality determination device 10 includes hardware for a processor 11, a memory 12, a storage 13, and a communication interface 14.
- the processor 11 is connected to other hardware via a signal line and controls these other hardware.
- the processor 11 is an IC (Integrated Circuit) that performs processing. Specific examples of the processor 11 are a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit).
- a CPU Central Processing Unit
- DSP Digital Signal Processor
- GPU Graphics Processing Unit
- the memory 12 is a storage device that temporarily stores data. Specific examples of the memory 12 are SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory).
- the storage 13 is a storage device for storing data.
- the storage 13 is an HDD (Hard Disk Drive).
- the storage 13 includes SD (registered trademark, Secure Digital) memory card, CF (Compact Flash, registered trademark), NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk, DVD (Digital Versaille Disk), and the like. It may be a portable recording medium.
- the communication interface 14 is an interface for communicating with external devices such as an input device and an output device.
- the communication interface 14 is a port of Ethernet (registered trademark), USB (Universal Serial Bus), HDMI (registered trademark, High-Definition Multimedia Interface).
- the abnormality determination device 10 includes a data acquisition unit 21, a fluctuation amount calculation unit 22, a classification unit 23, and an abnormality determination unit 24 as functional components.
- the classification unit 23 includes a probability distribution allocation unit 231, a threshold value calculation unit 232, and a fluctuation amount classification unit 233.
- the functions of each functional component of the abnormality determination device 10 are realized by software.
- the storage 13 stores a program that realizes the functions of each functional component of the abnormality determination device 10. This program is read into the memory 12 by the processor 11 and executed by the processor 11. As a result, the functions of each functional component of the abnormality determination device 10 are realized.
- the storage 13 realizes the functions of the time-series data storage unit 31 and the variable information storage unit 32.
- processors 11 In FIG. 1, only one processor 11 was shown. However, the number of processors 11 may be plural, and the plurality of processors 11 may execute programs that realize each function in cooperation with each other.
- the operation of the abnormality determination device 10 according to the first embodiment will be described with reference to FIGS. 2 to 9.
- the operation procedure of the abnormality determination device 10 according to the first embodiment corresponds to the abnormality determination method according to the first embodiment.
- the program that realizes the operation of the abnormality determination device 10 according to the first embodiment corresponds to the abnormality determination program according to the first embodiment.
- the data acquisition unit 21 acquires time series data. Specifically, the data acquisition unit 21 acquires sensor data periodically acquired when the target equipment is normal by a sensor provided in the target equipment such as a plant equipment as time series data.
- the time series data includes fluctuation patterns of a plurality of values having different occurrence frequencies.
- the time-series data includes two patterns, a fluctuation pattern having a high frequency of occurrence and a small fluctuation in value, and a fluctuation pattern having a low frequency of occurrence and a large fluctuation in value.
- the portion surrounded by the broken line is the fluctuation pattern in which the fluctuation of the value is large, and the portion not surrounded by the broken line is the fluctuation pattern in which the fluctuation of the value is small.
- the data acquisition unit 21 writes the acquired time-series data to the time-series data storage unit 31.
- the time-series data storage unit 31 stores the sensor ID, the acquisition time, and the sensor value for each sensor data constituting the time-series data.
- the sensor ID is an ID (Identifier) of the sensor from which the sensor data is acquired.
- the acquisition time is the time when the sensor data is acquired by the sensor.
- the sensor value is a value indicated by the sensor data.
- Step S12 Fluctuation amount calculation process
- the fluctuation amount calculation unit 22 calculates a plurality of fluctuation amounts by calculating the fluctuation amount of the value for each unit time with respect to the time series data acquired in step S11.
- the amount of fluctuation is the absolute value of the value obtained by subtracting the minimum value from the maximum value of the sensor value of the sensor data acquired in a unit time.
- the unit time is a time set in advance by the user of the abnormality determination device 10, and may be a different time depending on the time series data.
- the fluctuation amount calculation unit 22 sets the earliest acquisition time of the time-series data stored in the time-series data storage unit 31 as the start time of the target period, and targets the time after the unit time of the start time. The end time of the period.
- the fluctuation amount calculation unit 22 reads out the sensor data whose acquisition time falls into the target period from the start time to the end time from the time series data storage unit 31.
- the fluctuation amount calculation unit 22 specifies the maximum value and the minimum value from the sensor values of the read sensor data.
- the fluctuation amount calculation unit 22 calculates the absolute value of the value obtained by subtracting the minimum value from the maximum value as the fluctuation amount for the target period.
- the fluctuation amount calculation unit 22 sets the end time of the target period as the start time of the next target period, and sets the time after the unit time of the start time as the end time of the next target period, and sets the fluctuation rate of the next target period. To calculate. The fluctuation amount calculation unit 22 repeats this process until the latest acquisition time of the time-series data stored in the time-series data storage unit 31 is included in the target period.
- the fluctuation amount calculation unit 22 writes a plurality of calculated fluctuation amounts in the fluctuation information storage unit 32. For example, as shown in FIG. 5, the fluctuation amount calculation unit 22 writes the fluctuation amount, the unit time, and the start time of the unit time in the fluctuation information storage unit 32 for each sensor ID.
- Step S13 Classification process
- the classification unit 23 classifies the plurality of fluctuation amounts calculated in step S12 into a plurality of groups according to which probability distribution of the plurality of probability distributions each of the plurality of fluctuation amounts is included in. ..
- the time series data includes two fluctuation patterns, that is, a fluctuation pattern in which the fluctuation of the value is small and a fluctuation pattern in which the fluctuation of the value is large. Therefore, the classification unit 23 classifies a plurality of fluctuation amounts into a group F1 having a small value fluctuation, that is, a small fluctuation amount, and a group F2 having a large value fluctuation, that is, a large fluctuation amount.
- Step S131 Probability distribution allocation process
- the probability distribution allocation unit 231 reads out a plurality of fluctuation amounts stored in the fluctuation information storage unit 32. Then, the probability distribution allocation unit 231 allocates a plurality of probability distributions so that a plurality of fluctuation amounts are included in any of the probability distributions. In the first embodiment, a plurality of fluctuation amounts are classified into two groups. Therefore, the probability distribution allocation unit 231 applies the mixed normal distribution to the time series data on the assumption that the time series data follows a mixed normal distribution having two elements. Any method may be used to apply the mixed normal distribution. For example, it is possible to apply a mixed normal distribution by using an EM (Expectation-Maximization) algorithm, which is an existing art. The data having a fluctuation amount of 0 may be excluded before applying the mixed normal distribution.
- EM Extractation-Maximization
- Step S132 Threshold calculation process
- the threshold value calculation unit 232 When there is a fluctuation amount included in two probability distributions among the plurality of probability distributions assigned in step S131, the threshold value calculation unit 232 equally divides the area of the overlapping portion 41 in which the two probability distributions overlap. Is calculated as the classification threshold value T.
- a mixed normal distribution having two elements is assigned as a plurality of probability distributions. That is, the distribution G1 of the group F1 having a small fluctuation amount and the distribution G2 of the group F2 having a large fluctuation amount are assigned.
- the threshold value calculation unit 232 calculates the amount of variation that equally divides the area of the overlapping portion 41 as the classification threshold value T.
- the threshold value calculation unit 232 calculates the classification threshold value T using a binary search. In this case, as shown in FIG. 8, the threshold calculation unit 232 uses the fluctuation amount V1 having the highest probability density in the distribution G1 and the fluctuation amount V2 having the highest probability density in the distribution G2 as two reference values. The median C1 of the two reference values is specified. The threshold value calculation unit 232 determines whether or not the area of the overlapping portion 41 is equally divided when the median value C1 is set as the classification threshold value T. The threshold value calculation unit 232 sets the median value C1 as the classification threshold value T when it is equally divided. When not equally divided, the threshold value calculation unit 232 determines which of the distribution G1 side (left side in FIG.
- the threshold value calculation unit 232 specifies the median value C2 of the two reference values, with the reference value having the larger area (variation amount V2 in FIG. 8) and the median value C1 as two new reference values. Then, when the median value C2 is set as the classification threshold value T, it is determined whether or not the area of the overlapping portion 41 is equally divided. If it is equally divided, the median C2 is set as the classification threshold T. When not equally divided, the threshold value calculation unit 232 determines which of the distribution G1 side (left side in FIG. 8) and the distribution G2 side (right side in FIG. 8) has a larger area.
- the threshold calculation unit 232 specifies the median C3 of the two reference values, with the larger reference value (median C1 in FIG. 8) and the median C2 as two new reference values. Then, when the median value C3 is set as the classification threshold value T, it is determined whether or not the area of the overlapping portion 41 is equally divided. The threshold value calculation unit 232 repeats this process until the classification threshold value T at which the area of the overlapping portion 41 is equally divided is specified.
- Step S133 Fluctuation amount classification process
- the fluctuation amount classification unit 233 classifies a plurality of fluctuation amounts into a group corresponding to a probability distribution in which each of the plurality of fluctuation amounts is included. Further, the fluctuation amount classification unit 233 classifies the fluctuation amount included in the two probability distributions into a group corresponding to one of the two probability distributions based on the classification threshold value T calculated in step S132. In the first embodiment, the fluctuation amount classification unit 233 classifies the fluctuation amount on the left side of the classification threshold value T in FIG. 7 into the group F1 in which the fluctuation amount is small, and the fluctuation amount on the right side of the classification threshold value T in FIG. Is classified into group F2, which has a large amount of fluctuation.
- the classification unit 23 writes the classification result in the variable information storage unit 32. For example, as shown in FIG. 9, the classification unit 23 adds a classification threshold value T and a classification result to each record of the fluctuation information storage unit 32.
- the classification result shows the group in which the fluctuation amount is classified.
- Step S14 Abnormality determination process
- the abnormality determination unit 24 compares the determination amount, which is the fluctuation amount of the value of the determination target data, with the fluctuation amount belonging to each group classified in step S13, and determines whether or not the determination target data shows an abnormality. .. Specifically, the abnormality determination unit 24 acquires sensor data for a certain period acquired by the same sensor as the time series data acquired in step S11 as determination target data. The abnormality determination unit 24 calculates the fluctuation amount of the determination target data as the determination amount. Then, the abnormality determination unit 24 calculates the determination value of the determination target data by, for example, comparing the fluctuation amount classified into the target group by the k-nearest neighbor method with the determination amount, with each group as the target group.
- the abnormality determination unit 24 determines that the determination target data indicates an abnormality when the determination value calculated when all the groups are the target groups is higher than the abnormality threshold value. On the other hand, the abnormality determination unit 24 determines that the determination target data indicates normality when the determination value calculated when at least one of the groups is the target group is equal to or less than the abnormality threshold value.
- step S14 is repeatedly executed for the number of determination target data.
- the abnormality determination device 10 classifies the plurality of fluctuation amounts obtained from the time series data into a plurality of groups, and compares the determination amount with the fluctuation amount belonging to each group. Determine if it indicates an abnormality. That is, the abnormality determination device 10 according to the first embodiment learns the normal fluctuation amount for each group, and determines whether or not it is abnormal based on the learning result for each group. Thereby, even when a variation pattern of a plurality of values having different occurrence frequencies is included, it is possible to appropriately determine whether or not it is abnormal.
- the abnormality determination device 10 classifies a plurality of fluctuation amounts into a plurality of groups by allocating a plurality of probability distributions to the time series data. This makes it possible to appropriately classify a plurality of fluctuation amounts. As a result, it is possible to appropriately determine whether or not it is abnormal.
- the processes of steps S11 to S13 of FIG. 2 and the processes of step S14 are executed as a series of processes.
- the processing of steps S11 to S13 is a learning process based on the sensor data in the normal state
- the process of step S14 is an abnormality detection process using the result of the learning process. Therefore, the processes of steps S11 to S13 and the processes of step S14 may be separate processes instead of a series of processes.
- the abnormality determination device 10 may periodically execute the processes of steps S11 to S13, and continuously execute the processes of step S14 based on the latest classification result.
- each functional component is realized by software.
- each functional component may be realized by hardware. The difference between the second modification and the first embodiment will be described.
- the abnormality determination device 10 includes an electronic circuit 15 instead of the processor 11, the memory 12, and the storage 13.
- the electronic circuit 15 is a dedicated circuit that realizes the functions of each functional component, the memory 12, and the storage 13.
- Examples of the electronic circuit 15 include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), and an FPGA (Field-Programmable Gate Array). is assumed.
- Each functional component may be realized by one electronic circuit 15, or each functional component may be distributed and realized by a plurality of electronic circuits 15.
- Modification example 3 As a modification 3, some functional components may be realized by hardware, and other functional components may be realized by software.
- the processor 11, the memory 12, the storage 13, and the electronic circuit 15 are called processing circuits. That is, the function of each functional component is realized by the processing circuit.
- Embodiment 2 is different from the first embodiment in that it determines whether or not the time series data is suitable for classification. In the second embodiment, these different points will be described, and the same points will be omitted.
- the configuration of the abnormality determination device 10 according to the second embodiment will be described with reference to FIG.
- the abnormality determination device 10 is different from the abnormality determination device 10 shown in FIG. 1 in that the target determination unit 25 is provided as a functional component.
- the target determination unit 25 is realized by software or hardware like other functional components.
- the operation of the abnormality determination device 10 according to the second embodiment will be described with reference to FIGS. 12 and 13.
- the operation procedure of the abnormality determination device 10 according to the second embodiment corresponds to the abnormality determination method according to the second embodiment.
- the program that realizes the operation of the abnormality determination device 10 according to the second embodiment corresponds to the abnormality determination program according to the second embodiment.
- step S21 to step S23 is the same as the process from step S11 to step S13 in FIG. Further, the process of step S25 is the same as the process of step S14 of FIG.
- Step S24 Target determination process
- the target determination unit 25 determines whether or not the appearance probability at which the classification threshold value T appears is lower than the reference value in either of the two probability distributions. As a result, it is determined whether or not the time series data is suitable for classification. That is, it is determined whether or not the sensor from which the time series data is acquired is suitable for classification. Not suitable for classification means that the time series data is likely not data containing multiple variation patterns. As a specific example, as shown in FIG. 7, it is assumed that a mixed normal distribution having two elements is assigned as a plurality of probability distributions. In this case, the target determination unit 25 determines whether or not the classification threshold T is outside the range of the average value ⁇ 3 ⁇ of the target normal distribution for each normal distribution. If the classification threshold value T is outside the range of the average value ⁇ 3 ⁇ of the normal distribution of the target, the target determination unit 25 determines that the appearance probability of the classification threshold value T appearing is lower than the reference value.
- the target determination unit 25 determines that the appearance probability at which the classification threshold value T appears is lower than the reference value in either probability distribution, the target determination unit 25 determines that the time series data is suitable for classification, and performs the process in step S25. Proceed to.
- the target determination unit 25 determines that the time series data is not suitable for classification and ends the process. ..
- the target determination unit 25 writes the determination result in the fluctuation information storage unit 32. For example, as shown in FIG. 13, the target determination unit 25 writes the determination result in each record of the fluctuation information storage unit 32.
- step S25 If the user of the abnormality determination device 10 gives only time-series data suitable for classification, the process of step S25 is unnecessary.
- the abnormality determination device 10 determines whether or not the time series data is suitable for classification. As a result, when it is highly possible that the time series data is not data containing a plurality of fluctuation patterns, it is possible to prevent unnecessary classification and rather a state in which it cannot be appropriately determined whether or not the data is abnormal. ..
Landscapes
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Engineering & Computer Science (AREA)
- Automation & Control Theory (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
A data acquisition unit (21) acquires time series data. A change amount calculation unit (22) calculates a plurality of change amounts by calculating the change amount of a value for each unit of time in the time series data acquired by the data acquisition unit (21). A classification unit (23) classifies the plurality of change amounts calculated by the change amount calculation unit (22) into a plurality of groups. An abnormality determination unit (24) compares a determination amount, which is the change amount of a value of the determination-object data, to a change amount belonging to each group classified by the classification unit (23), and determines whether or not the determination-object data indicates an abnormality.
Description
本開示は、データが異常を示すか否かを判定する技術に関する。
The present disclosure relates to a technique for determining whether or not data indicates an abnormality.
プラント設備では、燃料低下と濃度上昇といった事象が発生した場合に、物質を放出又は供給するような制御がされる場合がある。このような場合には、プラント設備に設けられた物質に関する値を検出するセンサによって取得されたセンサデータである時系列データは、物質が放出又は供給された際に値が急変動する。
そのため、この時系列データには、値の変動が小さい変動パターンと、値の変動が大きい変動パターンとの2つの変動パターンが混在する。値の変動が大きい変動パターンは、物質が放出又は供給された際にだけ起こるため、値の変動が小さい変動パターンに比べ発生頻度が低い。 Plant equipment may be controlled to release or supply substances in the event of an event such as a decrease in fuel or an increase in concentration. In such a case, the time-series data, which is the sensor data acquired by the sensor that detects the value related to the substance provided in the plant equipment, suddenly fluctuates in value when the substance is released or supplied.
Therefore, in this time series data, two fluctuation patterns, a fluctuation pattern in which the fluctuation of the value is small and a fluctuation pattern in which the fluctuation of the value is large, are mixed. Fluctuation patterns with large fluctuations in value occur only when a substance is released or supplied, and therefore occur less frequently than fluctuation patterns with small fluctuations in value.
そのため、この時系列データには、値の変動が小さい変動パターンと、値の変動が大きい変動パターンとの2つの変動パターンが混在する。値の変動が大きい変動パターンは、物質が放出又は供給された際にだけ起こるため、値の変動が小さい変動パターンに比べ発生頻度が低い。 Plant equipment may be controlled to release or supply substances in the event of an event such as a decrease in fuel or an increase in concentration. In such a case, the time-series data, which is the sensor data acquired by the sensor that detects the value related to the substance provided in the plant equipment, suddenly fluctuates in value when the substance is released or supplied.
Therefore, in this time series data, two fluctuation patterns, a fluctuation pattern in which the fluctuation of the value is small and a fluctuation pattern in which the fluctuation of the value is large, are mixed. Fluctuation patterns with large fluctuations in value occur only when a substance is released or supplied, and therefore occur less frequently than fluctuation patterns with small fluctuations in value.
時系列データから異常を検出する方法として、k近傍法を用いた検知方法が広く用いられている(特許文献1参照)。
k近傍法を用いた検知方法では、例えば、判定対象データを中心としてk個の正常なデータが含まれる円を描いた場合の半径が、判定対象データの判定値として用いられ、判定値の大きさによって異常であるか否かが判定される。 As a method for detecting an abnormality from time-series data, a detection method using the k-nearest neighbor method is widely used (see Patent Document 1).
In the detection method using the k-nearest neighbor method, for example, the radius when a circle containing k normal data is drawn around the judgment target data is used as the judgment value of the judgment target data, and the size of the judgment value is large. It is determined whether or not it is abnormal.
k近傍法を用いた検知方法では、例えば、判定対象データを中心としてk個の正常なデータが含まれる円を描いた場合の半径が、判定対象データの判定値として用いられ、判定値の大きさによって異常であるか否かが判定される。 As a method for detecting an abnormality from time-series data, a detection method using the k-nearest neighbor method is widely used (see Patent Document 1).
In the detection method using the k-nearest neighbor method, for example, the radius when a circle containing k normal data is drawn around the judgment target data is used as the judgment value of the judgment target data, and the size of the judgment value is large. It is determined whether or not it is abnormal.
上述した2つの変動パターンが混在する時系列データから、k近傍法を用いた検知方法により異常を検出するとする。この場合には、発生頻度が高い変動パターンである、値の変動が小さい変動パターンに偏った学習が行われるため、値の変動が大きい変動パターンが発生すると異常として検出される恐れがある。
つまり、プラント設備としては正常な制御であるにも関わらず、異常として誤検出される恐れがある。その結果、異常検出の結果を監視する監視員の負荷が増えてしまう。
本開示は、発生頻度の異なる複数の値の変動パターンが含まれる場合であっても、適切に異常であるか否かを判定可能にすることを目的とする。 It is assumed that an abnormality is detected by a detection method using the k-nearest neighbor method from time series data in which the above-mentioned two fluctuation patterns coexist. In this case, since learning is biased toward a fluctuation pattern in which the fluctuation of the value is small, which is a fluctuation pattern with a high frequency of occurrence, if a fluctuation pattern in which the fluctuation of the value is large occurs, it may be detected as an abnormality.
That is, there is a risk of erroneous detection as an abnormality even though the control is normal for plant equipment. As a result, the load on the observer who monitors the result of abnormality detection increases.
An object of the present disclosure is to make it possible to appropriately determine whether or not an abnormality occurs even when a variation pattern of a plurality of values having different occurrence frequencies is included.
つまり、プラント設備としては正常な制御であるにも関わらず、異常として誤検出される恐れがある。その結果、異常検出の結果を監視する監視員の負荷が増えてしまう。
本開示は、発生頻度の異なる複数の値の変動パターンが含まれる場合であっても、適切に異常であるか否かを判定可能にすることを目的とする。 It is assumed that an abnormality is detected by a detection method using the k-nearest neighbor method from time series data in which the above-mentioned two fluctuation patterns coexist. In this case, since learning is biased toward a fluctuation pattern in which the fluctuation of the value is small, which is a fluctuation pattern with a high frequency of occurrence, if a fluctuation pattern in which the fluctuation of the value is large occurs, it may be detected as an abnormality.
That is, there is a risk of erroneous detection as an abnormality even though the control is normal for plant equipment. As a result, the load on the observer who monitors the result of abnormality detection increases.
An object of the present disclosure is to make it possible to appropriately determine whether or not an abnormality occurs even when a variation pattern of a plurality of values having different occurrence frequencies is included.
本開示に係る異常判定装置は、
時系列データについて単位時間毎の値の変動量を計算することにより、複数の変動量を計算する変動量計算部と、
前記変動量計算部によって計算された複数の変動量を複数のグループに分類する分類部と、
判定対象データの値の変動量である判定量を、前記分類部によって分類された各グループに属する変動量と比較して、前記判定対象データが異常を示すか否かを判定する異常判定部と
を備える。 The abnormality determination device according to the present disclosure is
A fluctuation amount calculation unit that calculates multiple fluctuation amounts by calculating the fluctuation amount of the value for each unit time for time series data,
A classification unit that classifies a plurality of fluctuation amounts calculated by the fluctuation amount calculation unit into a plurality of groups,
An abnormality determination unit that determines whether or not the determination target data indicates an abnormality by comparing the determination amount, which is the fluctuation amount of the value of the determination target data, with the fluctuation amount belonging to each group classified by the classification unit. To be equipped.
時系列データについて単位時間毎の値の変動量を計算することにより、複数の変動量を計算する変動量計算部と、
前記変動量計算部によって計算された複数の変動量を複数のグループに分類する分類部と、
判定対象データの値の変動量である判定量を、前記分類部によって分類された各グループに属する変動量と比較して、前記判定対象データが異常を示すか否かを判定する異常判定部と
を備える。 The abnormality determination device according to the present disclosure is
A fluctuation amount calculation unit that calculates multiple fluctuation amounts by calculating the fluctuation amount of the value for each unit time for time series data,
A classification unit that classifies a plurality of fluctuation amounts calculated by the fluctuation amount calculation unit into a plurality of groups,
An abnormality determination unit that determines whether or not the determination target data indicates an abnormality by comparing the determination amount, which is the fluctuation amount of the value of the determination target data, with the fluctuation amount belonging to each group classified by the classification unit. To be equipped.
本開示では、時系列データから得られた複数の変動量を複数のグループに分類して、判定量を各グループに属する変動量と比較して異常を示すか否かを判定する。これにより、発生頻度の異なる複数の値の変動パターンが含まれる場合であっても、適切に異常であるか否かを判定可能である。
In the present disclosure, a plurality of fluctuation amounts obtained from time series data are classified into a plurality of groups, and the judgment amount is compared with the fluctuation amount belonging to each group to determine whether or not an abnormality is shown. Thereby, even when a variation pattern of a plurality of values having different occurrence frequencies is included, it is possible to appropriately determine whether or not it is abnormal.
実施の形態1.
***構成の説明***
図1を参照して、実施の形態1に係る異常判定装置10の構成を説明する。
異常判定装置10は、コンピュータである。
異常判定装置10は、プロセッサ11と、メモリ12と、ストレージ13と、通信インタフェース14とのハードウェアを備える。プロセッサ11は、信号線を介して他のハードウェアと接続され、これら他のハードウェアを制御する。Embodiment 1.
*** Explanation of configuration ***
The configuration of theabnormality determination device 10 according to the first embodiment will be described with reference to FIG.
Theabnormality determination device 10 is a computer.
Theabnormality determination device 10 includes hardware for a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to other hardware via a signal line and controls these other hardware.
***構成の説明***
図1を参照して、実施の形態1に係る異常判定装置10の構成を説明する。
異常判定装置10は、コンピュータである。
異常判定装置10は、プロセッサ11と、メモリ12と、ストレージ13と、通信インタフェース14とのハードウェアを備える。プロセッサ11は、信号線を介して他のハードウェアと接続され、これら他のハードウェアを制御する。
*** Explanation of configuration ***
The configuration of the
The
The
プロセッサ11は、プロセッシングを行うIC(Integrated Circuit)である。プロセッサ11は、具体例としては、CPU(Central Processing Unit)、DSP(Digital Signal Processor)、GPU(Graphics Processing Unit)である。
The processor 11 is an IC (Integrated Circuit) that performs processing. Specific examples of the processor 11 are a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit).
メモリ12は、データを一時的に記憶する記憶装置である。メモリ12は、具体例としては、SRAM(Static Random Access Memory)、DRAM(Dynamic Random Access Memory)である。
The memory 12 is a storage device that temporarily stores data. Specific examples of the memory 12 are SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory).
ストレージ13は、データを保管する記憶装置である。ストレージ13は、具体例としては、HDD(Hard Disk Drive)である。また、ストレージ13は、SD(登録商標,Secure Digital)メモリカード、CF(CompactFlash,登録商標)、NANDフラッシュ、フレキシブルディスク、光ディスク、コンパクトディスク、ブルーレイ(登録商標)ディスク、DVD(Digital Versatile Disk)といった可搬記録媒体であってもよい。
The storage 13 is a storage device for storing data. As a specific example, the storage 13 is an HDD (Hard Disk Drive). The storage 13 includes SD (registered trademark, Secure Digital) memory card, CF (Compact Flash, registered trademark), NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk, DVD (Digital Versaille Disk), and the like. It may be a portable recording medium.
通信インタフェース14は、入力装置及び出力装置といった外部の装置と通信するためのインタフェースである。通信インタフェース14は、具体例としては、Ethernet(登録商標)、USB(Universal Serial Bus)、HDMI(登録商標,High-Definition Multimedia Interface)のポートである。
The communication interface 14 is an interface for communicating with external devices such as an input device and an output device. As a specific example, the communication interface 14 is a port of Ethernet (registered trademark), USB (Universal Serial Bus), HDMI (registered trademark, High-Definition Multimedia Interface).
異常判定装置10は、機能構成要素として、データ取得部21と、変動量計算部22と、分類部23と、異常判定部24とを備える。分類部23は、確率分布割当部231と、閾値計算部232と、変動量分類部233とを備える。異常判定装置10の各機能構成要素の機能はソフトウェアにより実現される。
ストレージ13には、異常判定装置10の各機能構成要素の機能を実現するプログラムが格納されている。このプログラムは、プロセッサ11によりメモリ12に読み込まれ、プロセッサ11によって実行される。これにより、異常判定装置10の各機能構成要素の機能が実現される。 Theabnormality determination device 10 includes a data acquisition unit 21, a fluctuation amount calculation unit 22, a classification unit 23, and an abnormality determination unit 24 as functional components. The classification unit 23 includes a probability distribution allocation unit 231, a threshold value calculation unit 232, and a fluctuation amount classification unit 233. The functions of each functional component of the abnormality determination device 10 are realized by software.
Thestorage 13 stores a program that realizes the functions of each functional component of the abnormality determination device 10. This program is read into the memory 12 by the processor 11 and executed by the processor 11. As a result, the functions of each functional component of the abnormality determination device 10 are realized.
ストレージ13には、異常判定装置10の各機能構成要素の機能を実現するプログラムが格納されている。このプログラムは、プロセッサ11によりメモリ12に読み込まれ、プロセッサ11によって実行される。これにより、異常判定装置10の各機能構成要素の機能が実現される。 The
The
また、ストレージ13は、時系列データ記憶部31と、変動情報記憶部32との機能を実現する。
Further, the storage 13 realizes the functions of the time-series data storage unit 31 and the variable information storage unit 32.
図1では、プロセッサ11は、1つだけ示されていた。しかし、プロセッサ11は、複数であってもよく、複数のプロセッサ11が、各機能を実現するプログラムを連携して実行してもよい。
In FIG. 1, only one processor 11 was shown. However, the number of processors 11 may be plural, and the plurality of processors 11 may execute programs that realize each function in cooperation with each other.
***動作の説明***
図2から図9を参照して、実施の形態1に係る異常判定装置10の動作を説明する。
実施の形態1に係る異常判定装置10の動作手順は、実施の形態1に係る異常判定方法に相当する。また、実施の形態1に係る異常判定装置10の動作を実現するプログラムは、実施の形態1に係る異常判定プログラムに相当する。 *** Explanation of operation ***
The operation of theabnormality determination device 10 according to the first embodiment will be described with reference to FIGS. 2 to 9.
The operation procedure of theabnormality determination device 10 according to the first embodiment corresponds to the abnormality determination method according to the first embodiment. Further, the program that realizes the operation of the abnormality determination device 10 according to the first embodiment corresponds to the abnormality determination program according to the first embodiment.
図2から図9を参照して、実施の形態1に係る異常判定装置10の動作を説明する。
実施の形態1に係る異常判定装置10の動作手順は、実施の形態1に係る異常判定方法に相当する。また、実施の形態1に係る異常判定装置10の動作を実現するプログラムは、実施の形態1に係る異常判定プログラムに相当する。 *** Explanation of operation ***
The operation of the
The operation procedure of the
図2を参照して、実施の形態1に係る異常判定装置10の全体的な動作を説明する。
(ステップS11:データ取得処理)
データ取得部21は、時系列データを取得する。
具体的には、データ取得部21は、プラント設備等の対象設備に設けられたセンサによって、対象設備が正常な時に周期的に取得されたセンサデータを時系列データとして取得する。実施の形態1では、図3に示すように、時系列データには、発生頻度の異なる複数の値の変動パターンが含まれる。図3では、時系列データには、発生頻度が高い、値の変動が小さい変動パターンと、発生頻度が低い、値の変動が大きい変動パターンとの2つのパターンが含まれる。図3では、破線で囲まれた部分が値の変動が大きい変動パターンであり、破線で囲まれていない部分が値の変動が小さい変動パターンである。 The overall operation of theabnormality determination device 10 according to the first embodiment will be described with reference to FIG.
(Step S11: Data acquisition process)
Thedata acquisition unit 21 acquires time series data.
Specifically, thedata acquisition unit 21 acquires sensor data periodically acquired when the target equipment is normal by a sensor provided in the target equipment such as a plant equipment as time series data. In the first embodiment, as shown in FIG. 3, the time series data includes fluctuation patterns of a plurality of values having different occurrence frequencies. In FIG. 3, the time-series data includes two patterns, a fluctuation pattern having a high frequency of occurrence and a small fluctuation in value, and a fluctuation pattern having a low frequency of occurrence and a large fluctuation in value. In FIG. 3, the portion surrounded by the broken line is the fluctuation pattern in which the fluctuation of the value is large, and the portion not surrounded by the broken line is the fluctuation pattern in which the fluctuation of the value is small.
(ステップS11:データ取得処理)
データ取得部21は、時系列データを取得する。
具体的には、データ取得部21は、プラント設備等の対象設備に設けられたセンサによって、対象設備が正常な時に周期的に取得されたセンサデータを時系列データとして取得する。実施の形態1では、図3に示すように、時系列データには、発生頻度の異なる複数の値の変動パターンが含まれる。図3では、時系列データには、発生頻度が高い、値の変動が小さい変動パターンと、発生頻度が低い、値の変動が大きい変動パターンとの2つのパターンが含まれる。図3では、破線で囲まれた部分が値の変動が大きい変動パターンであり、破線で囲まれていない部分が値の変動が小さい変動パターンである。 The overall operation of the
(Step S11: Data acquisition process)
The
Specifically, the
データ取得部21は、取得された時系列データを時系列データ記憶部31に書き込む。図4に示すように、時系列データ記憶部31には、時系列データを構成する各センサデータについて、センサIDと、取得時刻と、センサ値とが記憶される。センサIDは、センサデータの取得元のセンサのID(IDentifier)である。取得時刻は、センサデータがセンサによって取得された時刻である。センサ値は、センサデータが示す値である。
The data acquisition unit 21 writes the acquired time-series data to the time-series data storage unit 31. As shown in FIG. 4, the time-series data storage unit 31 stores the sensor ID, the acquisition time, and the sensor value for each sensor data constituting the time-series data. The sensor ID is an ID (Identifier) of the sensor from which the sensor data is acquired. The acquisition time is the time when the sensor data is acquired by the sensor. The sensor value is a value indicated by the sensor data.
(ステップS12:変動量計算処理)
変動量計算部22は、ステップS11で取得された時系列データについて単位時間毎の値の変動量を計算することにより、複数の変動量を計算する。変動量は、単位時間において取得されたセンサデータのセンサ値の最大値から最小値を減算して得られた値の絶対値である。単位時間は、異常判定装置10の使用者によって事前に設定される時間であり、時系列データに応じて異なる時間であってもよい。 (Step S12: Fluctuation amount calculation process)
The fluctuationamount calculation unit 22 calculates a plurality of fluctuation amounts by calculating the fluctuation amount of the value for each unit time with respect to the time series data acquired in step S11. The amount of fluctuation is the absolute value of the value obtained by subtracting the minimum value from the maximum value of the sensor value of the sensor data acquired in a unit time. The unit time is a time set in advance by the user of the abnormality determination device 10, and may be a different time depending on the time series data.
変動量計算部22は、ステップS11で取得された時系列データについて単位時間毎の値の変動量を計算することにより、複数の変動量を計算する。変動量は、単位時間において取得されたセンサデータのセンサ値の最大値から最小値を減算して得られた値の絶対値である。単位時間は、異常判定装置10の使用者によって事前に設定される時間であり、時系列データに応じて異なる時間であってもよい。 (Step S12: Fluctuation amount calculation process)
The fluctuation
具体的には、変動量計算部22は、時系列データ記憶部31に記憶された時系列データのうち最も早い取得時刻を対象期間の開始時刻とし、開始時刻の単位時間だけ後の時刻を対象期間の終了時刻とする。変動量計算部22は、時系列データ記憶部31から取得時刻が開始時刻から終了時刻までの対象期間に入るセンサデータを読み出す。変動量計算部22は、読み出されたセンサデータのセンサ値から最大値と最小値とを特定する。変動量計算部22は、最大値から最小値を減算して得られた値の絶対値を、対象期間についての変動量として計算する。
そして、変動量計算部22は、対象期間の終了時刻を次の対象期間の開始時刻とし、開始時刻の単位時間だけ後の時刻を次の対象期間の終了時刻として、次の対象期間の変動率を計算する。変動量計算部22は、この処理を時系列データ記憶部31に記憶された時系列データのうち最も遅い取得時刻が対象期間に含まれるまで繰り返す。 Specifically, the fluctuationamount calculation unit 22 sets the earliest acquisition time of the time-series data stored in the time-series data storage unit 31 as the start time of the target period, and targets the time after the unit time of the start time. The end time of the period. The fluctuation amount calculation unit 22 reads out the sensor data whose acquisition time falls into the target period from the start time to the end time from the time series data storage unit 31. The fluctuation amount calculation unit 22 specifies the maximum value and the minimum value from the sensor values of the read sensor data. The fluctuation amount calculation unit 22 calculates the absolute value of the value obtained by subtracting the minimum value from the maximum value as the fluctuation amount for the target period.
Then, the fluctuationamount calculation unit 22 sets the end time of the target period as the start time of the next target period, and sets the time after the unit time of the start time as the end time of the next target period, and sets the fluctuation rate of the next target period. To calculate. The fluctuation amount calculation unit 22 repeats this process until the latest acquisition time of the time-series data stored in the time-series data storage unit 31 is included in the target period.
そして、変動量計算部22は、対象期間の終了時刻を次の対象期間の開始時刻とし、開始時刻の単位時間だけ後の時刻を次の対象期間の終了時刻として、次の対象期間の変動率を計算する。変動量計算部22は、この処理を時系列データ記憶部31に記憶された時系列データのうち最も遅い取得時刻が対象期間に含まれるまで繰り返す。 Specifically, the fluctuation
Then, the fluctuation
変動量計算部22は、計算された複数の変動量を変動情報記憶部32に書き込む。例えば、図5に示すように、変動量計算部22は、センサID毎に、変動量と、単位時間と、単位時間の開始時刻とを変動情報記憶部32に書き込む。
The fluctuation amount calculation unit 22 writes a plurality of calculated fluctuation amounts in the fluctuation information storage unit 32. For example, as shown in FIG. 5, the fluctuation amount calculation unit 22 writes the fluctuation amount, the unit time, and the start time of the unit time in the fluctuation information storage unit 32 for each sensor ID.
(ステップS13:分類処理)
分類部23は、複数の変動量それぞれが複数の確率分布のうちのどの確率分布に含まれる変動量であるかに応じて、ステップS12で計算された複数の変動量を複数のグループに分類する。
実施の形態1では、時系列データには、値の変動が小さい変動パターンと、値の変動が大きい変動パターンとの2つの変動パターンが含まれている。そこで、分類部23は、値の変動が小さい、つまり変動量が小さいグループF1と、値の変動が大きい、つまり変動量が大きいグループF2とに複数の変動量を分類する。 (Step S13: Classification process)
Theclassification unit 23 classifies the plurality of fluctuation amounts calculated in step S12 into a plurality of groups according to which probability distribution of the plurality of probability distributions each of the plurality of fluctuation amounts is included in. ..
In the first embodiment, the time series data includes two fluctuation patterns, that is, a fluctuation pattern in which the fluctuation of the value is small and a fluctuation pattern in which the fluctuation of the value is large. Therefore, theclassification unit 23 classifies a plurality of fluctuation amounts into a group F1 having a small value fluctuation, that is, a small fluctuation amount, and a group F2 having a large value fluctuation, that is, a large fluctuation amount.
分類部23は、複数の変動量それぞれが複数の確率分布のうちのどの確率分布に含まれる変動量であるかに応じて、ステップS12で計算された複数の変動量を複数のグループに分類する。
実施の形態1では、時系列データには、値の変動が小さい変動パターンと、値の変動が大きい変動パターンとの2つの変動パターンが含まれている。そこで、分類部23は、値の変動が小さい、つまり変動量が小さいグループF1と、値の変動が大きい、つまり変動量が大きいグループF2とに複数の変動量を分類する。 (Step S13: Classification process)
The
In the first embodiment, the time series data includes two fluctuation patterns, that is, a fluctuation pattern in which the fluctuation of the value is small and a fluctuation pattern in which the fluctuation of the value is large. Therefore, the
図6を参照して、実施の形態1に係る分類処理を説明する。
(ステップS131:確率分布割当処理)
確率分布割当部231は、変動情報記憶部32に記憶された複数の変動量を読み出す。そして、確率分布割当部231は、複数の変動量がいずれかの確率分布に含まれるように、複数の確率分布を割り当てる。
実施の形態1では、複数の変動量が2つのグループに分類される。そこで、確率分布割当部231は、時系列データが要素数2の混合正規分布に従うと仮定して、時系列データに対して混合正規分布を適用する。混合正規分布の適用方法はどのような方法であっても構わない。例えば、既存時術であるEM(Expectation Maximization)アルゴリズムを利用して混合正規分布を適用することが可能である。
なお、変動量が0のデータについては、混合正規分布を適用する前に除外してもよい。 The classification process according to the first embodiment will be described with reference to FIG.
(Step S131: Probability distribution allocation process)
The probabilitydistribution allocation unit 231 reads out a plurality of fluctuation amounts stored in the fluctuation information storage unit 32. Then, the probability distribution allocation unit 231 allocates a plurality of probability distributions so that a plurality of fluctuation amounts are included in any of the probability distributions.
In the first embodiment, a plurality of fluctuation amounts are classified into two groups. Therefore, the probabilitydistribution allocation unit 231 applies the mixed normal distribution to the time series data on the assumption that the time series data follows a mixed normal distribution having two elements. Any method may be used to apply the mixed normal distribution. For example, it is possible to apply a mixed normal distribution by using an EM (Expectation-Maximization) algorithm, which is an existing art.
The data having a fluctuation amount of 0 may be excluded before applying the mixed normal distribution.
(ステップS131:確率分布割当処理)
確率分布割当部231は、変動情報記憶部32に記憶された複数の変動量を読み出す。そして、確率分布割当部231は、複数の変動量がいずれかの確率分布に含まれるように、複数の確率分布を割り当てる。
実施の形態1では、複数の変動量が2つのグループに分類される。そこで、確率分布割当部231は、時系列データが要素数2の混合正規分布に従うと仮定して、時系列データに対して混合正規分布を適用する。混合正規分布の適用方法はどのような方法であっても構わない。例えば、既存時術であるEM(Expectation Maximization)アルゴリズムを利用して混合正規分布を適用することが可能である。
なお、変動量が0のデータについては、混合正規分布を適用する前に除外してもよい。 The classification process according to the first embodiment will be described with reference to FIG.
(Step S131: Probability distribution allocation process)
The probability
In the first embodiment, a plurality of fluctuation amounts are classified into two groups. Therefore, the probability
The data having a fluctuation amount of 0 may be excluded before applying the mixed normal distribution.
(ステップS132:閾値計算処理)
閾値計算部232は、ステップS131で割り当てられた複数の確率分布のうち2つの確率分布に含まれる変動量がある場合には、2つの確率分布が重なる重複部分41の面積を等分する変動量を分類閾値Tとして計算する。
実施の形態1では、図7に示すように、要素数2の混合正規分布が複数の確率分布として割り当てられる。つまり、変動量が小さいグループF1の分布G1と、変動量が大きいグループF2の分布G2とが割り当てられる。このとき、分布G1と分布G2とが重なる重複部分41が存在する可能性がある。重複部分41が存在するということは、2つの確率分布に含まれる変動量があるということである。この場合には、閾値計算部232は、重複部分41の面積を等分する変動量を分類閾値Tとして計算する。 (Step S132: Threshold calculation process)
When there is a fluctuation amount included in two probability distributions among the plurality of probability distributions assigned in step S131, the thresholdvalue calculation unit 232 equally divides the area of the overlapping portion 41 in which the two probability distributions overlap. Is calculated as the classification threshold value T.
In the first embodiment, as shown in FIG. 7, a mixed normal distribution having two elements is assigned as a plurality of probability distributions. That is, the distribution G1 of the group F1 having a small fluctuation amount and the distribution G2 of the group F2 having a large fluctuation amount are assigned. At this time, there is a possibility that there is an overlapping portion 41 in which the distribution G1 and the distribution G2 overlap. The existence of the overlapping portion 41 means that there is a fluctuation amount included in the two probability distributions. In this case, the thresholdvalue calculation unit 232 calculates the amount of variation that equally divides the area of the overlapping portion 41 as the classification threshold value T.
閾値計算部232は、ステップS131で割り当てられた複数の確率分布のうち2つの確率分布に含まれる変動量がある場合には、2つの確率分布が重なる重複部分41の面積を等分する変動量を分類閾値Tとして計算する。
実施の形態1では、図7に示すように、要素数2の混合正規分布が複数の確率分布として割り当てられる。つまり、変動量が小さいグループF1の分布G1と、変動量が大きいグループF2の分布G2とが割り当てられる。このとき、分布G1と分布G2とが重なる重複部分41が存在する可能性がある。重複部分41が存在するということは、2つの確率分布に含まれる変動量があるということである。この場合には、閾値計算部232は、重複部分41の面積を等分する変動量を分類閾値Tとして計算する。 (Step S132: Threshold calculation process)
When there is a fluctuation amount included in two probability distributions among the plurality of probability distributions assigned in step S131, the threshold
In the first embodiment, as shown in FIG. 7, a mixed normal distribution having two elements is assigned as a plurality of probability distributions. That is, the distribution G1 of the group F1 having a small fluctuation amount and the distribution G2 of the group F2 having a large fluctuation amount are assigned. At this time, there is a possibility that there is an overlapping portion 41 in which the distribution G1 and the distribution G2 overlap. The existence of the overlapping portion 41 means that there is a fluctuation amount included in the two probability distributions. In this case, the threshold
具体例としては、閾値計算部232は、二分探索を用いて分類閾値Tを計算する。
この場合には、図8に示すように、閾値計算部232は、分布G1で最も確率密度が高い変動量V1と、分布G2で最も確率密度が高い変動量V2とを2つの基準値として、2つの基準値の中央値C1を特定する。閾値計算部232は、中央値C1を分類閾値Tとした場合に、重複部分41の面積が等分されているか否かを判定する。閾値計算部232は、等分されている場合には、中央値C1を分類閾値Tに設定する。
閾値計算部232は、等分されていない場合には、分布G1側(図8の左側)と、分布G2側(図8の右側)とのどちらの方が面積が大きいかを判定する。閾値計算部232は、面積が大きい方の基準値(図8では、変動量V2)と、中央値C1とを新たに2つの基準値として、2つの基準値の中央値C2を特定する。そして、中央値C2を分類閾値Tとした場合に、重複部分41の面積が等分されているか否かを判定する。等分されている場合には、中央値C2を分類閾値Tに設定する。
閾値計算部232は、等分されていない場合には、分布G1側(図8の左側)と、分布G2側(図8の右側)とのどちらの方が面積が大きいかを判定する。閾値計算部232は、面積が大きい方の基準値(図8では、中央値C1)と、中央値C2とを新たに2つの基準値として、2つの基準値の中央値C3を特定する。そして、中央値C3を分類閾値Tとした場合に、重複部分41の面積が等分されているか否かを判定する。
この処理を、閾値計算部232は、重複部分41の面積が等分される分類閾値Tが特定されるまで繰り返す。 As a specific example, the thresholdvalue calculation unit 232 calculates the classification threshold value T using a binary search.
In this case, as shown in FIG. 8, thethreshold calculation unit 232 uses the fluctuation amount V1 having the highest probability density in the distribution G1 and the fluctuation amount V2 having the highest probability density in the distribution G2 as two reference values. The median C1 of the two reference values is specified. The threshold value calculation unit 232 determines whether or not the area of the overlapping portion 41 is equally divided when the median value C1 is set as the classification threshold value T. The threshold value calculation unit 232 sets the median value C1 as the classification threshold value T when it is equally divided.
When not equally divided, the thresholdvalue calculation unit 232 determines which of the distribution G1 side (left side in FIG. 8) and the distribution G2 side (right side in FIG. 8) has a larger area. The threshold value calculation unit 232 specifies the median value C2 of the two reference values, with the reference value having the larger area (variation amount V2 in FIG. 8) and the median value C1 as two new reference values. Then, when the median value C2 is set as the classification threshold value T, it is determined whether or not the area of the overlapping portion 41 is equally divided. If it is equally divided, the median C2 is set as the classification threshold T.
When not equally divided, the thresholdvalue calculation unit 232 determines which of the distribution G1 side (left side in FIG. 8) and the distribution G2 side (right side in FIG. 8) has a larger area. The threshold calculation unit 232 specifies the median C3 of the two reference values, with the larger reference value (median C1 in FIG. 8) and the median C2 as two new reference values. Then, when the median value C3 is set as the classification threshold value T, it is determined whether or not the area of the overlapping portion 41 is equally divided.
The thresholdvalue calculation unit 232 repeats this process until the classification threshold value T at which the area of the overlapping portion 41 is equally divided is specified.
この場合には、図8に示すように、閾値計算部232は、分布G1で最も確率密度が高い変動量V1と、分布G2で最も確率密度が高い変動量V2とを2つの基準値として、2つの基準値の中央値C1を特定する。閾値計算部232は、中央値C1を分類閾値Tとした場合に、重複部分41の面積が等分されているか否かを判定する。閾値計算部232は、等分されている場合には、中央値C1を分類閾値Tに設定する。
閾値計算部232は、等分されていない場合には、分布G1側(図8の左側)と、分布G2側(図8の右側)とのどちらの方が面積が大きいかを判定する。閾値計算部232は、面積が大きい方の基準値(図8では、変動量V2)と、中央値C1とを新たに2つの基準値として、2つの基準値の中央値C2を特定する。そして、中央値C2を分類閾値Tとした場合に、重複部分41の面積が等分されているか否かを判定する。等分されている場合には、中央値C2を分類閾値Tに設定する。
閾値計算部232は、等分されていない場合には、分布G1側(図8の左側)と、分布G2側(図8の右側)とのどちらの方が面積が大きいかを判定する。閾値計算部232は、面積が大きい方の基準値(図8では、中央値C1)と、中央値C2とを新たに2つの基準値として、2つの基準値の中央値C3を特定する。そして、中央値C3を分類閾値Tとした場合に、重複部分41の面積が等分されているか否かを判定する。
この処理を、閾値計算部232は、重複部分41の面積が等分される分類閾値Tが特定されるまで繰り返す。 As a specific example, the threshold
In this case, as shown in FIG. 8, the
When not equally divided, the threshold
When not equally divided, the threshold
The threshold
(ステップS133:変動量分類処理)
変動量分類部233は、複数の変動量それぞれが含まれる確率分布に対応するグループに複数の変動量を分類する。また、変動量分類部233は、2つの確率分布に含まれる変動量についてはステップS132で計算された分類閾値Tに基づき2つの確率分布のうちどちらかの確率分布に対応するグループに分類する。
実施の形態1では、変動量分類部233は、図7の分類閾値Tよりも左側の変動量については、変動量が小さいグループF1に分類し、図7の分類閾値Tよりも右側の変動量については、変動量が大きいグループF2に分類する。 (Step S133: Fluctuation amount classification process)
The fluctuationamount classification unit 233 classifies a plurality of fluctuation amounts into a group corresponding to a probability distribution in which each of the plurality of fluctuation amounts is included. Further, the fluctuation amount classification unit 233 classifies the fluctuation amount included in the two probability distributions into a group corresponding to one of the two probability distributions based on the classification threshold value T calculated in step S132.
In the first embodiment, the fluctuationamount classification unit 233 classifies the fluctuation amount on the left side of the classification threshold value T in FIG. 7 into the group F1 in which the fluctuation amount is small, and the fluctuation amount on the right side of the classification threshold value T in FIG. Is classified into group F2, which has a large amount of fluctuation.
変動量分類部233は、複数の変動量それぞれが含まれる確率分布に対応するグループに複数の変動量を分類する。また、変動量分類部233は、2つの確率分布に含まれる変動量についてはステップS132で計算された分類閾値Tに基づき2つの確率分布のうちどちらかの確率分布に対応するグループに分類する。
実施の形態1では、変動量分類部233は、図7の分類閾値Tよりも左側の変動量については、変動量が小さいグループF1に分類し、図7の分類閾値Tよりも右側の変動量については、変動量が大きいグループF2に分類する。 (Step S133: Fluctuation amount classification process)
The fluctuation
In the first embodiment, the fluctuation
分類部23は、分類した結果を変動情報記憶部32に書き込む。例えば、図9に示すように、分類部23は、変動情報記憶部32の各レコードに、分類閾値Tと、分類結果とを追記する。分類結果は、変動量が分類されたグループを示す。
The classification unit 23 writes the classification result in the variable information storage unit 32. For example, as shown in FIG. 9, the classification unit 23 adds a classification threshold value T and a classification result to each record of the fluctuation information storage unit 32. The classification result shows the group in which the fluctuation amount is classified.
(ステップS14:異常判定処理)
異常判定部24は、判定対象データの値の変動量である判定量を、ステップS13で分類された各グループに属する変動量と比較して、判定対象データが異常を示すか否かを判定する。
具体的には、異常判定部24は、ステップS11で取得された時系列データと同じセンサによって取得されたある期間のセンサデータを判定対象データとして取得する。異常判定部24は、判定対象データの変動量を判定量として計算する。そして、異常判定部24は、各グループを対象のグループとして、例えばk近傍法により対象のグループに分類された変動量と判定量とを比較して、判定対象データの判定値を計算する。そして、異常判定部24は、全てのグループを対象のグループとした場合に計算された判定値が異常閾値よりも高い場合には、判定対象データが異常を示すと判定する。一方、異常判定部24は、少なくともいずれかのグループを対象のグループとした場合に計算された判定値が異常閾値以下の場合には、判定対象データが正常を示すと判定する。 (Step S14: Abnormality determination process)
Theabnormality determination unit 24 compares the determination amount, which is the fluctuation amount of the value of the determination target data, with the fluctuation amount belonging to each group classified in step S13, and determines whether or not the determination target data shows an abnormality. ..
Specifically, theabnormality determination unit 24 acquires sensor data for a certain period acquired by the same sensor as the time series data acquired in step S11 as determination target data. The abnormality determination unit 24 calculates the fluctuation amount of the determination target data as the determination amount. Then, the abnormality determination unit 24 calculates the determination value of the determination target data by, for example, comparing the fluctuation amount classified into the target group by the k-nearest neighbor method with the determination amount, with each group as the target group. Then, the abnormality determination unit 24 determines that the determination target data indicates an abnormality when the determination value calculated when all the groups are the target groups is higher than the abnormality threshold value. On the other hand, the abnormality determination unit 24 determines that the determination target data indicates normality when the determination value calculated when at least one of the groups is the target group is equal to or less than the abnormality threshold value.
異常判定部24は、判定対象データの値の変動量である判定量を、ステップS13で分類された各グループに属する変動量と比較して、判定対象データが異常を示すか否かを判定する。
具体的には、異常判定部24は、ステップS11で取得された時系列データと同じセンサによって取得されたある期間のセンサデータを判定対象データとして取得する。異常判定部24は、判定対象データの変動量を判定量として計算する。そして、異常判定部24は、各グループを対象のグループとして、例えばk近傍法により対象のグループに分類された変動量と判定量とを比較して、判定対象データの判定値を計算する。そして、異常判定部24は、全てのグループを対象のグループとした場合に計算された判定値が異常閾値よりも高い場合には、判定対象データが異常を示すと判定する。一方、異常判定部24は、少なくともいずれかのグループを対象のグループとした場合に計算された判定値が異常閾値以下の場合には、判定対象データが正常を示すと判定する。 (Step S14: Abnormality determination process)
The
Specifically, the
なお、判定対象データが複数存在する場合には、ステップS14の処理が判定対象データの数だけ繰り返し実行される。
If there are a plurality of determination target data, the process of step S14 is repeatedly executed for the number of determination target data.
***実施の形態1の効果***
以上のように、実施の形態1に係る異常判定装置10は、時系列データから得られた複数の変動量を複数のグループに分類して、判定量を各グループに属する変動量と比較して異常を示すか否かを判定する。つまり、実施の形態1に係る異常判定装置10は、グループ毎に正常な変動量を学習しておき、各グループについての学習結果に基づき異常であるか否かを判定する。
これにより、発生頻度の異なる複数の値の変動パターンが含まれる場合であっても、適切に異常であるか否かを判定可能である。 *** Effect ofEmbodiment 1 ***
As described above, theabnormality determination device 10 according to the first embodiment classifies the plurality of fluctuation amounts obtained from the time series data into a plurality of groups, and compares the determination amount with the fluctuation amount belonging to each group. Determine if it indicates an abnormality. That is, the abnormality determination device 10 according to the first embodiment learns the normal fluctuation amount for each group, and determines whether or not it is abnormal based on the learning result for each group.
Thereby, even when a variation pattern of a plurality of values having different occurrence frequencies is included, it is possible to appropriately determine whether or not it is abnormal.
以上のように、実施の形態1に係る異常判定装置10は、時系列データから得られた複数の変動量を複数のグループに分類して、判定量を各グループに属する変動量と比較して異常を示すか否かを判定する。つまり、実施の形態1に係る異常判定装置10は、グループ毎に正常な変動量を学習しておき、各グループについての学習結果に基づき異常であるか否かを判定する。
これにより、発生頻度の異なる複数の値の変動パターンが含まれる場合であっても、適切に異常であるか否かを判定可能である。 *** Effect of
As described above, the
Thereby, even when a variation pattern of a plurality of values having different occurrence frequencies is included, it is possible to appropriately determine whether or not it is abnormal.
特に、実施の形態1に係る異常判定装置10は、時系列データに対して複数の確率分布を割り当てることにより、複数の変動量を複数のグループに分類する。これにより、複数の変動量を適切に分類することが可能である。その結果、適切に異常であるか否かを判定可能である。
In particular, the abnormality determination device 10 according to the first embodiment classifies a plurality of fluctuation amounts into a plurality of groups by allocating a plurality of probability distributions to the time series data. This makes it possible to appropriately classify a plurality of fluctuation amounts. As a result, it is possible to appropriately determine whether or not it is abnormal.
***他の構成***
<変形例1>
実施の形態1では、図2のステップS11からステップS13の処理と、ステップS14の処理とが一連の処理として実行された。しかし、ステップS11からステップS13の処理は、正常時のセンサデータに基づく学習処理であり、ステップS14の処理は、学習処理の結果を利用した異常検知処理である。そのため、ステップS11からステップS13の処理と、ステップS14の処理とは、一連の処理ではなく、別々の処理としてもよい。
例えば、異常判定装置10は、定期的にステップS11からステップS13の処理を実行し、直近の分類結果に基づきステップS14の処理を継続的に実行するようにしてもよい。 *** Other configurations ***
<Modification example 1>
In the first embodiment, the processes of steps S11 to S13 of FIG. 2 and the processes of step S14 are executed as a series of processes. However, the processing of steps S11 to S13 is a learning process based on the sensor data in the normal state, and the process of step S14 is an abnormality detection process using the result of the learning process. Therefore, the processes of steps S11 to S13 and the processes of step S14 may be separate processes instead of a series of processes.
For example, theabnormality determination device 10 may periodically execute the processes of steps S11 to S13, and continuously execute the processes of step S14 based on the latest classification result.
<変形例1>
実施の形態1では、図2のステップS11からステップS13の処理と、ステップS14の処理とが一連の処理として実行された。しかし、ステップS11からステップS13の処理は、正常時のセンサデータに基づく学習処理であり、ステップS14の処理は、学習処理の結果を利用した異常検知処理である。そのため、ステップS11からステップS13の処理と、ステップS14の処理とは、一連の処理ではなく、別々の処理としてもよい。
例えば、異常判定装置10は、定期的にステップS11からステップS13の処理を実行し、直近の分類結果に基づきステップS14の処理を継続的に実行するようにしてもよい。 *** Other configurations ***
<Modification example 1>
In the first embodiment, the processes of steps S11 to S13 of FIG. 2 and the processes of step S14 are executed as a series of processes. However, the processing of steps S11 to S13 is a learning process based on the sensor data in the normal state, and the process of step S14 is an abnormality detection process using the result of the learning process. Therefore, the processes of steps S11 to S13 and the processes of step S14 may be separate processes instead of a series of processes.
For example, the
<変形例2>
実施の形態1では、各機能構成要素がソフトウェアで実現された。しかし、変形例2として、各機能構成要素はハードウェアで実現されてもよい。この変形例2について、実施の形態1と異なる点を説明する。 <Modification 2>
In the first embodiment, each functional component is realized by software. However, as amodification 2, each functional component may be realized by hardware. The difference between the second modification and the first embodiment will be described.
実施の形態1では、各機能構成要素がソフトウェアで実現された。しかし、変形例2として、各機能構成要素はハードウェアで実現されてもよい。この変形例2について、実施の形態1と異なる点を説明する。 <
In the first embodiment, each functional component is realized by software. However, as a
図10を参照して、変形例2に係る異常判定装置10の構成を説明する。
各機能構成要素がハードウェアで実現される場合には、異常判定装置10は、プロセッサ11とメモリ12とストレージ13とに代えて、電子回路15を備える。電子回路15は、各機能構成要素と、メモリ12と、ストレージ13との機能とを実現する専用の回路である。 The configuration of theabnormality determination device 10 according to the second modification will be described with reference to FIG.
When each functional component is realized by hardware, theabnormality determination device 10 includes an electronic circuit 15 instead of the processor 11, the memory 12, and the storage 13. The electronic circuit 15 is a dedicated circuit that realizes the functions of each functional component, the memory 12, and the storage 13.
各機能構成要素がハードウェアで実現される場合には、異常判定装置10は、プロセッサ11とメモリ12とストレージ13とに代えて、電子回路15を備える。電子回路15は、各機能構成要素と、メモリ12と、ストレージ13との機能とを実現する専用の回路である。 The configuration of the
When each functional component is realized by hardware, the
電子回路15としては、単一回路、複合回路、プログラム化したプロセッサ、並列プログラム化したプロセッサ、ロジックIC、GA(Gate Array)、ASIC(Application Specific Integrated Circuit)、FPGA(Field-Programmable Gate Array)が想定される。
各機能構成要素を1つの電子回路15で実現してもよいし、各機能構成要素を複数の電子回路15に分散させて実現してもよい。 Examples of theelectronic circuit 15 include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), and an FPGA (Field-Programmable Gate Array). is assumed.
Each functional component may be realized by oneelectronic circuit 15, or each functional component may be distributed and realized by a plurality of electronic circuits 15.
各機能構成要素を1つの電子回路15で実現してもよいし、各機能構成要素を複数の電子回路15に分散させて実現してもよい。 Examples of the
Each functional component may be realized by one
<変形例3>
変形例3として、一部の各機能構成要素がハードウェアで実現され、他の各機能構成要素がソフトウェアで実現されてもよい。 <Modification example 3>
As amodification 3, some functional components may be realized by hardware, and other functional components may be realized by software.
変形例3として、一部の各機能構成要素がハードウェアで実現され、他の各機能構成要素がソフトウェアで実現されてもよい。 <Modification example 3>
As a
プロセッサ11とメモリ12とストレージ13と電子回路15とを処理回路という。つまり、各機能構成要素の機能は、処理回路により実現される。
The processor 11, the memory 12, the storage 13, and the electronic circuit 15 are called processing circuits. That is, the function of each functional component is realized by the processing circuit.
実施の形態2.
実施の形態2は、時系列データが分類に適しているか否かを判定する点が実施の形態1と異なる。実施の形態2では、この異なる点を説明し、同一の点については説明を省略する。Embodiment 2.
The second embodiment is different from the first embodiment in that it determines whether or not the time series data is suitable for classification. In the second embodiment, these different points will be described, and the same points will be omitted.
実施の形態2は、時系列データが分類に適しているか否かを判定する点が実施の形態1と異なる。実施の形態2では、この異なる点を説明し、同一の点については説明を省略する。
The second embodiment is different from the first embodiment in that it determines whether or not the time series data is suitable for classification. In the second embodiment, these different points will be described, and the same points will be omitted.
***構成の説明***
図11を参照して、実施の形態2に係る異常判定装置10の構成を説明する。
異常判定装置10は、機能構成要素として、対象判定部25を備える点が図1に示す異常判定装置10と異なる。対象判定部25は、他の機能構成要素と同様に、ソフトウェア又はハードウェアによって実現される。 *** Explanation of configuration ***
The configuration of theabnormality determination device 10 according to the second embodiment will be described with reference to FIG.
Theabnormality determination device 10 is different from the abnormality determination device 10 shown in FIG. 1 in that the target determination unit 25 is provided as a functional component. The target determination unit 25 is realized by software or hardware like other functional components.
図11を参照して、実施の形態2に係る異常判定装置10の構成を説明する。
異常判定装置10は、機能構成要素として、対象判定部25を備える点が図1に示す異常判定装置10と異なる。対象判定部25は、他の機能構成要素と同様に、ソフトウェア又はハードウェアによって実現される。 *** Explanation of configuration ***
The configuration of the
The
***動作の説明***
図12及び図13を参照して、実施の形態2に係る異常判定装置10の動作を説明する。
実施の形態2に係る異常判定装置10の動作手順は、実施の形態2に係る異常判定方法に相当する。また、実施の形態2に係る異常判定装置10の動作を実現するプログラムは、実施の形態2に係る異常判定プログラムに相当する。 *** Explanation of operation ***
The operation of theabnormality determination device 10 according to the second embodiment will be described with reference to FIGS. 12 and 13.
The operation procedure of theabnormality determination device 10 according to the second embodiment corresponds to the abnormality determination method according to the second embodiment. Further, the program that realizes the operation of the abnormality determination device 10 according to the second embodiment corresponds to the abnormality determination program according to the second embodiment.
図12及び図13を参照して、実施の形態2に係る異常判定装置10の動作を説明する。
実施の形態2に係る異常判定装置10の動作手順は、実施の形態2に係る異常判定方法に相当する。また、実施の形態2に係る異常判定装置10の動作を実現するプログラムは、実施の形態2に係る異常判定プログラムに相当する。 *** Explanation of operation ***
The operation of the
The operation procedure of the
図12を参照して、実施の形態2に係る異常判定装置10の全体的な動作を説明する。
ステップS21からステップS23の処理は、図2のステップS11からステップS13の処理と同じである。また、ステップS25の処理は、図2のステップS14の処理と同じである。 The overall operation of theabnormality determination device 10 according to the second embodiment will be described with reference to FIG.
The process from step S21 to step S23 is the same as the process from step S11 to step S13 in FIG. Further, the process of step S25 is the same as the process of step S14 of FIG.
ステップS21からステップS23の処理は、図2のステップS11からステップS13の処理と同じである。また、ステップS25の処理は、図2のステップS14の処理と同じである。 The overall operation of the
The process from step S21 to step S23 is the same as the process from step S11 to step S13 in FIG. Further, the process of step S25 is the same as the process of step S14 of FIG.
(ステップS24:対象判定処理)
対象判定部25は、2つの確率分布のどちらの確率分布においても分類閾値Tが出現する出現確率が基準値よりも低いか否かを判定する。これにより、時系列データが分類に適しているか否かが判定される。つまり、時系列データの取得元のセンサが分類に適しているか否かが判定される。分類に適していないとは、時系列データが複数の変動パターンを含むデータではない可能性が高いという意味である。
具体例としては、図7に示すように、要素数2の混合正規分布が複数の確率分布として割り当てられたとする。この場合には、対象判定部25は、各正規分布を対象として、分類閾値Tが、対象の正規分布の平均値±3σの範囲外であるか否かを判定する。対象判定部25は、分類閾値Tが、対象の正規分布の平均値±3σの範囲外であれば、分類閾値Tが出現する出現確率が基準値よりも低いと判定する。 (Step S24: Target determination process)
Thetarget determination unit 25 determines whether or not the appearance probability at which the classification threshold value T appears is lower than the reference value in either of the two probability distributions. As a result, it is determined whether or not the time series data is suitable for classification. That is, it is determined whether or not the sensor from which the time series data is acquired is suitable for classification. Not suitable for classification means that the time series data is likely not data containing multiple variation patterns.
As a specific example, as shown in FIG. 7, it is assumed that a mixed normal distribution having two elements is assigned as a plurality of probability distributions. In this case, thetarget determination unit 25 determines whether or not the classification threshold T is outside the range of the average value ± 3σ of the target normal distribution for each normal distribution. If the classification threshold value T is outside the range of the average value ± 3σ of the normal distribution of the target, the target determination unit 25 determines that the appearance probability of the classification threshold value T appearing is lower than the reference value.
対象判定部25は、2つの確率分布のどちらの確率分布においても分類閾値Tが出現する出現確率が基準値よりも低いか否かを判定する。これにより、時系列データが分類に適しているか否かが判定される。つまり、時系列データの取得元のセンサが分類に適しているか否かが判定される。分類に適していないとは、時系列データが複数の変動パターンを含むデータではない可能性が高いという意味である。
具体例としては、図7に示すように、要素数2の混合正規分布が複数の確率分布として割り当てられたとする。この場合には、対象判定部25は、各正規分布を対象として、分類閾値Tが、対象の正規分布の平均値±3σの範囲外であるか否かを判定する。対象判定部25は、分類閾値Tが、対象の正規分布の平均値±3σの範囲外であれば、分類閾値Tが出現する出現確率が基準値よりも低いと判定する。 (Step S24: Target determination process)
The
As a specific example, as shown in FIG. 7, it is assumed that a mixed normal distribution having two elements is assigned as a plurality of probability distributions. In this case, the
対象判定部25は、どちらの確率分布においても分類閾値Tが出現する出現確率が基準値よりも低いと判定した場合には、時系列データが分類に適していると判定し、処理をステップS25に進める。一方、対象判定部25は、少なくともいずれかの確率分布において分類閾値Tが出現する出現確率が基準値以上である場合には、時系列データが分類に適していないと判定し、処理を終了する。
When the target determination unit 25 determines that the appearance probability at which the classification threshold value T appears is lower than the reference value in either probability distribution, the target determination unit 25 determines that the time series data is suitable for classification, and performs the process in step S25. Proceed to. On the other hand, when the probability of appearance of the classification threshold value T in at least one of the probability distributions is equal to or higher than the reference value, the target determination unit 25 determines that the time series data is not suitable for classification and ends the process. ..
対象判定部25は、判定した結果を変動情報記憶部32に書き込む。例えば、図13に示すように、対象判定部25は、変動情報記憶部32の各レコードに、判定した結果を書き込む。
The target determination unit 25 writes the determination result in the fluctuation information storage unit 32. For example, as shown in FIG. 13, the target determination unit 25 writes the determination result in each record of the fluctuation information storage unit 32.
なお、異常判定装置10の使用者が分類に適した時系列データのみを対象として与えるような場合には、ステップS25の処理は不要である。
If the user of the abnormality determination device 10 gives only time-series data suitable for classification, the process of step S25 is unnecessary.
***実施の形態2の効果***
以上のように、実施の形態2に係る異常判定装置10は、時系列データが分類に適しているか否かを判定する。
これにより、時系列データが複数の変動パターンを含むデータではない可能性が高い場合に、不要な分類を行い、かえって適切に異常であるか否かを判定できない状態にすることを防止可能である。 *** Effect ofEmbodiment 2 ***
As described above, theabnormality determination device 10 according to the second embodiment determines whether or not the time series data is suitable for classification.
As a result, when it is highly possible that the time series data is not data containing a plurality of fluctuation patterns, it is possible to prevent unnecessary classification and rather a state in which it cannot be appropriately determined whether or not the data is abnormal. ..
以上のように、実施の形態2に係る異常判定装置10は、時系列データが分類に適しているか否かを判定する。
これにより、時系列データが複数の変動パターンを含むデータではない可能性が高い場合に、不要な分類を行い、かえって適切に異常であるか否かを判定できない状態にすることを防止可能である。 *** Effect of
As described above, the
As a result, when it is highly possible that the time series data is not data containing a plurality of fluctuation patterns, it is possible to prevent unnecessary classification and rather a state in which it cannot be appropriately determined whether or not the data is abnormal. ..
10 異常判定装置、11 プロセッサ、12 メモリ、13 ストレージ、14 通信インタフェース、15 電子回路、21 データ取得部、22 変動量計算部、23 分類部、231 確率分布割当部、232 閾値計算部、233 変動量分類部、24 異常判定部、25 対象判定部、31 時系列データ記憶部、32 変動情報記憶部、41 重複部分。
10 anomaly determination device, 11 processor, 12 memory, 13 storage, 14 communication interface, 15 electronic circuit, 21 data acquisition unit, 22 fluctuation amount calculation unit, 23 classification unit, 231 probability distribution allocation unit, 232 threshold calculation unit, 233 fluctuation Quantity classification unit, 24 abnormality judgment unit, 25 target judgment unit, 31 time series data storage unit, 32 fluctuation information storage unit, 41 overlapping part.
Claims (6)
- 時系列データについて単位時間毎の値の変動量を計算することにより、複数の変動量を計算する変動量計算部と、
前記変動量計算部によって計算された前記複数の変動量を複数のグループに分類する分類部と、
判定対象データの値の変動量である判定量を、前記分類部によって分類された各グループに属する変動量と比較して、前記判定対象データが異常を示すか否かを判定する異常判定部と
を備える異常判定装置。 A fluctuation amount calculation unit that calculates multiple fluctuation amounts by calculating the fluctuation amount of the value for each unit time for time series data,
A classification unit that classifies the plurality of fluctuation amounts calculated by the fluctuation amount calculation unit into a plurality of groups, and a classification unit.
An abnormality determination unit that determines whether or not the determination target data indicates an abnormality by comparing the determination amount, which is the fluctuation amount of the value of the determination target data, with the fluctuation amount belonging to each group classified by the classification unit. An abnormality determination device including. - 前記分類部は、前記複数の変動量それぞれが複数の確率分布のうちのどの確率分布に含まれる変動量であるかに応じて、前記複数の変動量を複数のグループに分類する
請求項1に記載の異常判定装置。 The classification unit according to claim 1 classifies the plurality of fluctuation amounts into a plurality of groups according to which probability distribution of the plurality of probability distributions each of the plurality of fluctuation amounts is included in. The described abnormality determination device. - 前記分類部は、
前記複数の変動量がいずれかの確率分布に含まれるように、前記複数の確率分布を割り当てる確率分布割当部と、
前記確率分布割当部によって割り当てられた前記複数の確率分布のうち2つの確率分布に含まれる変動量がある場合には、前記2つの確率分布が重なる重複部分の面積を等分する変動量を分類閾値として計算する閾値計算部と、
前記複数の変動量それぞれが含まれる確率分布に対応するグループに前記複数の変動量を分類するとともに、前記2つの確率分布に含まれる変動量については前記閾値計算部によって計算された前記分類閾値に基づき前記2つの確率分布のうちどちらかの確率分布に対応するグループに分類する変動量分類部と
を備える請求項2に記載の異常判定装置。 The classification unit
A probability distribution allocation unit that allocates the plurality of probability distributions so that the plurality of fluctuation amounts are included in any of the probability distributions, and a probability distribution allocation unit.
When there is a fluctuation amount included in two probability distributions out of the plurality of probability distributions assigned by the probability distribution allocation unit, the fluctuation amount that equally divides the area of the overlapping portion where the two probability distributions overlap is classified. A threshold calculation unit that calculates as a threshold, and
The plurality of fluctuation amounts are classified into groups corresponding to the probability distributions including each of the plurality of fluctuation amounts, and the fluctuation amounts included in the two probability distributions are classified into the classification threshold calculated by the threshold calculation unit. The abnormality determination device according to claim 2, further comprising a variable amount classification unit that classifies into a group corresponding to either of the two probability distributions based on the above two probability distributions. - 前記異常判定装置は、さらに、
前記2つの確率分布のどちらの確率分布においても前記分類閾値が出現する出現確率が基準値よりも低いか否かを判定する対象判定部
を備え、
前記異常判定部は、前記対象判定部によってどちらの確率分布においても前記分類閾値が出現する出現確率が基準値よりも低いと判定された場合に、前記判定対象データが異常を示すか否かを判定する
請求項3に記載の異常判定装置。 The abnormality determination device further
A target determination unit for determining whether or not the appearance probability at which the classification threshold appears is lower than the reference value in either of the two probability distributions is provided.
The abnormality determination unit determines whether or not the determination target data indicates an abnormality when the target determination unit determines that the probability of appearance of the classification threshold value is lower than the reference value in either probability distribution. The abnormality determination device according to claim 3. - 変動量計算部が、時系列データについて単位時間毎の値の変動量を計算することにより、複数の変動量を計算し、
分類部が、前記複数の変動量を複数のグループに分類し、
異常判定部が、判定対象データの値の変動量である判定量を、各グループに属する変動量と比較して、前記判定対象データが異常を示すか否かを判定する異常判定方法。 The fluctuation amount calculation unit calculates a plurality of fluctuation amounts by calculating the fluctuation amount of the value for each unit time for the time series data.
The classification unit classifies the plurality of fluctuation amounts into a plurality of groups, and the classification unit classifies the plurality of fluctuation amounts into a plurality of groups.
An abnormality determination method in which an abnormality determination unit compares a determination amount, which is a fluctuation amount of a value of determination target data, with a fluctuation amount belonging to each group, and determines whether or not the determination target data indicates an abnormality. - 時系列データについて単位時間毎の値の変動量を計算することにより、複数の変動量を計算する変動量計算処理と、
前記変動量計算処理によって計算された前記複数の変動量を複数のグループに分類する分類処理と、
判定対象データの値の変動量である判定量を、前記分類処理によって分類された各グループに属する変動量と比較して、前記判定対象データが異常を示すか否かを判定する異常判定処理と
を行う異常判定装置としてコンピュータを機能させる異常判定プログラム。 Fluctuation amount calculation processing that calculates multiple fluctuation amounts by calculating the fluctuation amount of the value for each unit time for time series data,
A classification process for classifying the plurality of fluctuation amounts calculated by the fluctuation amount calculation process into a plurality of groups, and
An abnormality determination process for determining whether or not the determination target data indicates an abnormality by comparing the determination amount, which is the fluctuation amount of the value of the determination target data, with the fluctuation amount belonging to each group classified by the classification process. An abnormality judgment program that makes a computer function as an abnormality judgment device.
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2021566593A JP7106020B2 (en) | 2020-03-06 | 2020-03-06 | Abnormality determination device, abnormality determination method, and abnormality determination program |
PCT/JP2020/009876 WO2021176732A1 (en) | 2020-03-06 | 2020-03-06 | Abnormaility determination device, abnormaility determination method, and abnormaility determination program |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/JP2020/009876 WO2021176732A1 (en) | 2020-03-06 | 2020-03-06 | Abnormaility determination device, abnormaility determination method, and abnormaility determination program |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2021176732A1 true WO2021176732A1 (en) | 2021-09-10 |
Family
ID=77614015
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2020/009876 WO2021176732A1 (en) | 2020-03-06 | 2020-03-06 | Abnormaility determination device, abnormaility determination method, and abnormaility determination program |
Country Status (2)
Country | Link |
---|---|
JP (1) | JP7106020B2 (en) |
WO (1) | WO2021176732A1 (en) |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2006275303A (en) * | 2005-03-28 | 2006-10-12 | Daikin Ind Ltd | Abnormality detection system |
JP2009298260A (en) * | 2008-06-12 | 2009-12-24 | Furukawa Electric Co Ltd:The | Abnormal electric current detecting device and abnormal electric current detecting method |
JP2011070635A (en) * | 2009-08-28 | 2011-04-07 | Hitachi Ltd | Method and device for monitoring state of facility |
-
2020
- 2020-03-06 WO PCT/JP2020/009876 patent/WO2021176732A1/en active Application Filing
- 2020-03-06 JP JP2021566593A patent/JP7106020B2/en active Active
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2006275303A (en) * | 2005-03-28 | 2006-10-12 | Daikin Ind Ltd | Abnormality detection system |
JP2009298260A (en) * | 2008-06-12 | 2009-12-24 | Furukawa Electric Co Ltd:The | Abnormal electric current detecting device and abnormal electric current detecting method |
JP2011070635A (en) * | 2009-08-28 | 2011-04-07 | Hitachi Ltd | Method and device for monitoring state of facility |
Also Published As
Publication number | Publication date |
---|---|
JPWO2021176732A1 (en) | 2021-09-10 |
JP7106020B2 (en) | 2022-07-25 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN107850925B (en) | Thermal monitoring of memory resources | |
US8296274B2 (en) | Considering multiple lookups in bloom filter decision making | |
CN109358816B (en) | Flow control method and device of distributed storage system | |
EP3699914B1 (en) | Artificial intelligence based monitoring of solid state drives and dual in-line memory modules | |
US9681577B2 (en) | System and method for improving fan life in an information handling system | |
US20190272470A1 (en) | Rule-Based Classification for Detected Anomalies | |
JP6456580B1 (en) | Abnormality detection device, abnormality detection method and abnormality detection program | |
CN102448626B (en) | Product sorting device, product sorting method | |
US20150212742A1 (en) | Memory control device, information processing apparatus, memory control method, and, storage medium storing memory control program | |
US11507484B2 (en) | Ethod and computer storage node of shared storage system for abnormal behavior detection/analysis | |
KR20200116530A (en) | Onboard monitoring of voltage levels and droop events | |
WO2021176732A1 (en) | Abnormaility determination device, abnormaility determination method, and abnormaility determination program | |
US20210080924A1 (en) | Diagnosis Method and Diagnosis System for a Processing Engineering Plant and Training Method | |
CN108509154B (en) | Method and device for dynamically recombining raid according to bad block distribution | |
US20190222524A1 (en) | Information processing apparatus, data management system, data management method, and non-transitory computer readable medium storing program | |
US20120054548A1 (en) | Data processing device and method for controlling test process of electronic device using the same | |
CN107990929B (en) | Method and device for controlling filter time constant, computer device and storage medium | |
US20210033734A1 (en) | Fog determination apparatus, fog determination method, and computer readable medium | |
US20170124179A1 (en) | Data categorizing system, method, program software and recording medium therein | |
TW202127226A (en) | Recording device, recording method, recording program, and magnetic tape | |
TWI775114B (en) | Setting changing device, setting changing method and setting changing program product | |
WO2023112167A1 (en) | Factor analysis device, factor analysis method, and factor analysis program | |
CN115563622B (en) | Method, device and system for detecting operation environment | |
WO2024042636A1 (en) | Processing device, processing method, and program | |
CN117554385B (en) | Method, device, equipment and storage medium for permitting and alarming in same-direction continuous scrapping |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 20923339 Country of ref document: EP Kind code of ref document: A1 |
|
ENP | Entry into the national phase |
Ref document number: 2021566593 Country of ref document: JP Kind code of ref document: A |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 20923339 Country of ref document: EP Kind code of ref document: A1 |