JP2019191836A - Abnormality detection system and program - Google Patents

Abstract

To provide an abnormality detection system and program, capable of rapidly detecting an abnormal state in an object to be monitored.SOLUTION: The abnormality detection system includes: an observation data update section 31 which collects observation data on an object 1 to be monitored and stores the data as time-sequence observation data; an observation data classification section 33 which classifies the observation data into any of training data and verification data; a system identification section 35 which identifies a model parameter of a linear state space model of the object to be monitored on the basis of training data; an estimation section 36 which calculates an estimate value of probability distribution of a state variable of the object to be monitored with the model parameter and verification data as inputs; and an abnormality degree calculation section 37 which calculates an abnormality degree of the object to be monitored, based on the estimate value. The observation data update section 31, after collecting observation data, adds the collected observation data to time-sequence observation data and when the data number of the time-sequence observation data is larger than a threshold value, discards the earliest collected observation data.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an anomaly detection system and program related to a monitoring target that can be modeled by a linear state space model.

  In recent years, electrical equipment and mechanical equipment are provided with a state monitoring function, and efforts to realize so-called CBM (Condition Based Maintenance) have been advanced.

  The principle of a general anomaly detection system is described uniformly in Non-Patent Document 1, and an anomaly detection method based on a state space model is discussed as one of advanced approaches for anomaly detection of time series data. ing.

  Anomaly detection method based on a state space model expresses a monitoring target with a state space model, estimates the internal state of the monitoring target from observation data for the monitoring target, and calculates the degree of abnormality based on the estimated value of the internal state It is.

  FIG. 5 shows a configuration of an anomaly detection system based on an anomaly detection method described as “abnormality detection by a state space model” in Non-Patent Document 1.

  Reference numeral 1 represents a monitoring target. Reference numeral 2 represents an observation data collection unit that collects and records observation data for the monitoring target 1 at a constant period. Reference numeral 21 represents a database in which time-series observation data D generated by the observation data collection unit is stored. Reference numerals 22 and 23 respectively represent databases in which training data Dtr and verification data Dvr generated by dividing the time-series observation data D are stored.

  Reference numeral 3 represents a conventional abnormality detection system. The abnormality detection system 3 includes a system identification unit 35, a Kalman filter estimation unit 36, and an abnormality degree calculation unit 37.

  The internal state (state variable) of the monitoring target 1 at time t is represented by an m-dimensional vector z (t). Observable state quantities (hereinafter referred to as “observation data”) are represented by an M-dimensional vector x (t). At this time, the linear state space model corresponding to the monitoring target can be expressed by the following equation when there is no input to the monitoring target.

  FIG. 6 shows an abnormality detection algorithm published in Non-Patent Document 1 in the form of a flowchart.

  According to this abnormality detection algorithm, the time series observation data D of the monitoring target 1 having a sufficient number of samplings (data number) is prepared first, and the observation data collection unit 2 converts the time series observation data D into the training data Dtr. And verification data Dvr (S61).

Here, _{T 1} the number of data of the training data Dtr, the number of data of the verification data Dvr and _{T 2,} when the number of data series observed data D and _T 1 + _{T 2.}

Next, using the training data Dtr, the system identification unit 35 uses the system identification method such as the subspace identification method for the model parameters A, C, Q, R, Q ₀ , and z ₀ of the monitoring target 1. (Step S62). Details of this processing will be described later. Here, Q is an m × m covariance matrix representing variation in internal state transition. R is an M × M covariance matrix representing the variation of the observation data. Q ₀ is Q at time 0. z ₀ is z (t) at time 0.

Next, the system identification unit 35 obtains μ ₀ by the expression Aμ ₀ = z ₀ (step S63).

The Kalman filter estimation unit 36 performs state estimation calculation using the Kalman filter defined in Non-Patent Document 1 for the observed value x (t) (t = 1,..., T ₂ ) included in the verification data Dvr. First, t = 1 is set (step S64). Kalman filter estimator 36, t is judged whether it is _{T 2} or less (step S65). Here, since t is _{T 2} or less, the process proceeds to the next step S66.

The Kalman filter estimation unit 36 obtains K ₁ , μ ₁ , V _1, and Q ₁ with t = 1 in the following equation (step S 66).

Kalman filter estimator 36, from the equation Aμ ₁ = _{z 1,} determine the _{z 1.}

  Further, the abnormality degree calculation unit 37 quantitatively evaluates the abnormality state of the monitoring target 1 by calculating the abnormality degree a (x (t)) defined by Equation 3 (step S67).

なお上述した式で、記号「≡」は「定義」を表している。

In the above formula, the symbol “≡” represents “definition”.

  Further, the Kalman filter estimation unit 36 increases t by 1 (step S68).

By repeating the steps S65 to S68 described so far, the Kalman filter estimation unit 36 makes each time t = 1,. . . , T ₂ , an estimate of the probability distribution (mean and variance (μt, Vt)) of the state variable z (t) can be calculated. Further, the abnormality degree calculation unit 37 can calculate the abnormality degree of the monitoring target 1 based on the estimated value calculated by the Kalman filter estimation unit 36.

  FIG. 7 shows the system identification (step S62 in FIG. 6) by the subspace identification method described in Non-Patent Document 1 in the form of a more detailed flowchart. This system identification is implemented by the system identification unit 35 in the abnormality detection system 3.

  Here, it is assumed that M-dimensional time-series observation data D having a length T is given. Further, it is assumed that N is selected to be sufficiently larger than Mw for the window width w and the number N of partial time series. Then, the approximate midpoint of the time series is set at time t.

The system identification unit 35 obtains matrices X (t), _Xp, and _Xf represented by the following equations (step S71).

The system identification unit 35 obtains matrices S _pf , S _pp , S _fp and S _ff defined by the following equations (step S72).

  The system identification unit 35 obtains a matrix W defined by the following equation. Then, m left and right singular vectors with a length normalized to 1 are obtained in descending order of singular values with respect to W (step S73).

The system identification unit 35 obtains an estimated value of the state variable series from α ⁱ and β ⁱ using the following equation (step S75).

  The system identification unit 35 obtains data D ′ including observation data and an estimated value Z ′ of a state variable defined by the following formula. Note that T ′ = T−w.

The system identification unit 35 obtains vectors X, Z, Z ₊ and Z ₋ defined by the following equations (step S77).

  The system identification unit 35 obtains estimated values of the model parameters A, Q, C, and R from the following equations.

As described so far, according to the system identification by the subspace identification method shown in FIG. 7, the estimated values of the parameters A, C, Q, R, Q ₀ , and z ₀ of the linear state space model are converted into time series observation data. It can be obtained from x (t).

Tsuyoshi Ide, “Anomaly Detection by Introductory Machine Learning”, Corona, 2015

  The conventional abnormality detection algorithm described above divides time-series observation data prepared in advance into training data and verification data, and performs offline batch processing of estimation of model parameters related to the state space model to be monitored. There was a need. This batch processing has been performed, for example, after a certain amount of time-series observation data has been accumulated.

  Therefore, for example, when a change occurs in the characteristics of the monitoring target due to deterioration over time, in other words, when a model parameter of the state space model changes, it is necessary to redo the system identification of the monitoring target.

  Accordingly, an object of the present invention is to provide an abnormality detection system and program capable of quickly detecting an abnormal state of a monitoring target.

  The present invention has been developed by developing the anomaly detection algorithm based on the state space model shown in Non-Patent Document 1 and bringing the algorithm online.

  An anomaly detection system according to a first aspect is an anomaly detection system that detects an anomaly of a monitoring target that can be modeled by a linear state space model, and collects observation data for the monitoring target and creates a database as time-series observation data Based on the observation data update unit, the observation data classification unit that classifies at least part of the observation data of the time-series observation data into either training data or verification data, and the training data, A system identification unit for identifying a model parameter of a linear state space model to be monitored, a model parameter identified by the system identification unit, and the verification data as inputs, and an estimate of the probability distribution of the state variable to be monitored Based on the estimated value calculated by the estimating unit and the estimating unit, the abnormality degree of the monitoring target is calculated. The observation data update unit, when collecting the observation data to be monitored, adds the newly collected observation data to the time series observation data and the number of data of the time series observation data When is larger than a threshold value, the earliest collected observation data in the time series observation data is discarded.

  In the anomaly detection system according to the second aspect, it is preferable to obtain the degree of difficulty in achieving each management unit based on the supply capacity of the power supply device included in each of the plurality of management units.

  As described above, the solution of the present invention has been described as an abnormality detection system. However, the present invention can also be realized as a device, a program, or a storage medium that records the program substantially equivalent to these. It should be understood that these are included in the scope of the invention.

  For example, the program according to the third aspect is a program for detecting an abnormality of a monitoring target that can be modeled by a linear state space model in the abnormality detection system according to the first or second aspect.

  According to the present invention, it is possible to remove the restriction that the operation of the abnormality detection system must be stopped for the relearning process of the model parameter of the monitoring target when the characteristic of the monitoring target changes.

  And the abnormality detection system of this invention can calculate the abnormality degree rapidly based on the estimated value of the internal state of a monitoring object after collecting observation data.

It is a figure which shows the structure of embodiment of the abnormality detection system which concerns on this invention. It is a figure which shows the sampling process of the observation data of this embodiment. It is a figure showing the algorithm of embodiment of the abnormality detection system which concerns on this invention. It is a figure showing the Example of the abnormality detection system of this embodiment. It is a figure showing the indication position of each pointer in a certain time, and the indication position of each pointer after new observation data is sampled. It is a figure which shows the structure of the conventional abnormality detection system. It is a figure showing the algorithm of the conventional abnormality detection system. It is a figure which shows the learning algorithm of a subspace identification method.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows a configuration of an embodiment of an abnormality detection system. Reference numeral 1 represents a monitoring target. The code | symbol 3 represents the abnormality detection system of this embodiment.

  The anomaly detection system 3 of this embodiment includes an observation data update unit 31, a database 32 in which observation data is stored, an observation data classification unit 33 that classifies observation data into either training data or verification data, Databases 34a and 34b in which training data and verification data are respectively stored, a system identification unit 35, a Kalman filter estimation unit 36, and an abnormality degree calculation unit 37 are provided.

  FIG. 2 is a diagram illustrating a process of sampling the observation amount of the monitoring target 1 and storing it as observation data x (t). When the observation data of the monitoring object 1 at an arbitrary absolute time k is represented by ξ (k), the observation data x (t) of the linear state space model is defined by the following equation.

Hereinafter, an abnormality detection algorithm performed by the abnormality detection system 3 will be described with reference to FIG. When new observation data ξ (k + T ₁ + T ₂ ) of the monitoring object 1 is obtained (step S31), the time series observation data of the observation data x (t) is updated by the following equation (step S32).

The above-described processing, the time-series observation data D ₀ is updated to D _1. As shown in FIG. 2, in the time series observation data D ₁ after the update, the oldest observation data among the time series observation data before the update, that is, ξ (k) that was the earliest collected observation data is It has been destroyed. The observation data update unit 31 performs this data discarding process when the number of time-series observation data is larger than a threshold value (T ₁ + T _{2 in} this embodiment). The number of data of the time-series observation data D ₁ of the updated time series observed data D ₀ before update is the same.

Then, the observation data classifying unit 33, when dividing the series observed data _{D 1} in the training data Dtr and the verification data Dvr (step S33). In addition, time-series observation all of the data D ₁ can be divided into any of the verification data Dvr and training for data Dtr, and when a part of the series observed data D ₁ and training for data Dtr of verification data Dvr It can be divided into either.

Thereafter, the system identification unit 35 performs system identification shown in detail in the flowchart described above and shown in FIG. 7 to obtain new model parameters A, C, Q, R, Q ₀ , and z ₀ (step S34).

Next, the system identification unit 35 obtains μ ₀ by the expression Aμ ₀ = z ₀ (step S35).

The Kalman filter estimation unit 36 performs a state estimation calculation by the Kalman filter on the observation data x (t) (t = 1,..., T ₂ ) included in the verification data Dvr. First, t = 1 is set (step S36). Kalman filter estimator 36, t is judged whether it is _{T 2} or less (step S37). Here, since t is _{T 2} or less, the process proceeds to the next step S38.

The Kalman filter estimation unit 36 obtains K ₁ , μ ₁ , V _1, and Q ₁ with t = 1 in the following equation (step S38).

Kalman filter estimator 36, from the equation Aμ ₁ = _{z 1,} determine the _{z 1.}

  Furthermore, the abnormality degree calculation unit 37 quantitatively evaluates the abnormality state of the monitoring target 1 by calculating the abnormality degree a (x (t)) defined by the following equation (step S39).

  When the degree of abnormality a (x (t)) exceeds a predetermined threshold value, for example, the degree of abnormality calculation unit 37 can warn the operator. Thus, the abnormality detection system 3 can promptly detect a state abnormality and warn the operator.

  Further, the Kalman filter estimation unit 36 increases t by 1 (step S40).

By repeating the steps S37 to S40 described so far, the Kalman filter estimation unit 36 performs each time t = 1,. . . , T ₂ , an estimate of the probability distribution (mean and variance (μt, Vt)) of the state variable z (t) can be calculated. Further, the abnormality degree calculation unit 37 can calculate the abnormality degree of the monitoring target based on the estimated value calculated by the Kalman filter estimation unit 36.

When t = T ₂ +1, the Kalman filter estimation unit 36 determines that t is not equal to or less than T _{2 in} step S37. Thereafter, the process returns to step S31.

  In this embodiment, the Kalman filter estimation unit 36 performs the state estimation calculation based on the Kalman filter, but the state estimation calculation can also be performed by other identification methods.

Thereafter, in this embodiment for the monitoring target, when a certain sampling period has elapsed and new observation data ξ (k + T ₁ + T ₂ +1) of the monitoring target 1 is obtained (step S31), the observation data is the same as described above. The time series data of x (t) is updated by the following equation (step S32).

Thus, time-series observation data D ₁ is updated to D ₂ as shown in FIG. Then, by executing S40 from step S33 including the above-described system identification and abnormality calculation (step S38), the abnormality detection system 3 can obtain a degree of abnormality based on the time-series observation data D ₂ new.

  In this way, every time new observation data to be monitored is obtained, the time series observation data is updated, and the above-mentioned system identification and abnormality degree calculation are repeated, so that the abnormality degree based on the latest observation data is obtained in real time. Obtainable.

  As described above, by applying the abnormality detection system of the present embodiment, the system identification of the state space model can be brought online in the abnormality detection algorithm, and it is not necessary to provide a period for system identification separately. For example, specifically, it is not necessary to transfer the time-series observation data to a system outside the vehicle and obtain the degree of abnormality by the system outside the vehicle.

  Furthermore, since the system identification of the state space model is performed based on the latest observation data of the monitoring target, it is possible to follow the characteristic variation of the monitoring target 1. Therefore, according to the abnormality detection system 3 of this embodiment, the detection accuracy of a state abnormality can be improved.

  FIG. 4A shows a configuration in an embodiment of the abnormality detection system of the present invention.

  Reference numeral 4 represents an abnormality detection system. The basic configuration of the anomaly detection system of this embodiment is the same as that of the anomaly detection system 3 shown in FIG. 1, but in FIG. 1, a database 32 storing observation data and a database 34a storing training data The database 34b in which the verification data is stored is implemented as a specific memory device 42. 4A is not provided with the observation data classification unit 33 shown in FIG. 1, and the observation data update unit 31 classifies the observation data into either training data or verification data, as will be described later. .

  The memory device 42 is addressed for each area of one point of observation data (observation data acquired at a certain time). Reference numeral 42a represents a pointer that indicates the start position of the training data Dtr. Reference numeral 42b represents a pointer indicating the start position of the verification data Dvr. Reference numeral 42c represents a pointer that indicates a position where new observation data to be acquired next is written.

  Here, since the memory area for observation data is limited, it is assumed that the addressing of each pointer is managed so as to form a logical ring buffer.

FIG. 4B shows the designated position of each pointer at a certain time point and the designated position of each pointer after the new observation data is sampled and the time series observation data is updated by the observation data update unit 41. For example shown in the left side in FIG. 4B, the time-series observation data at a certain point in time, corresponds to the time-series observation data D ₀ in FIG. Further, time-series observation data after shown on the right, the time-series observation data is updated in FIG. 4B corresponds to the time-series observation data D ₁ of the FIG.

  A pointer 42a 'shown in FIG. 4B points to data next to the data pointed to by the pointer 42a. The same applies to the pointers 42b 'and 42c'. When new observation data is sampled, the observation data update unit 41 shifts the pointer in this way so that the oldest observation data, that is, the observation data collected earliest is not referred to. Further, newly collected observation data is written at a position where the oldest observation data is stored.

  As described above, a part of the time series observation data is updated using the addressing of each pointer. As a result, the contents of the training data and the verification data can be shifted by one sampling time, and the updating of each data and the matrix operation used in the system identification unit can be executed efficiently.

  Although the abnormality detection systems 3 and 4 have been described above, a computer can be suitably used to function as the abnormality detection systems 3 and 4. Such a computer stores a program describing the processing contents for realizing the functions of the abnormality detection systems 3 and 4 in a storage unit of the computer, and the CPU of the computer reads and executes the program. Can be realized.

  The program may be recorded on a computer readable medium. If a computer-readable medium is used, it can be installed on a computer. Here, the computer-readable medium on which the program is recorded may be a non-transitory recording medium. The non-transitory recording medium is not particularly limited, but may be a recording medium such as a CD-ROM or a DVD-ROM.

  The above-described embodiment has been described as a representative example. However, it will be apparent to those skilled in the art that many changes and substitutions can be made within the spirit and scope of the invention. Therefore, the present invention should not be construed as being limited by the above-described embodiments, and various modifications or changes can be made without departing from the scope of the claims. For example, it is possible to combine a plurality of constituent blocks described in the configuration diagram of the embodiment into one, or to divide one constituent block.

  The present invention can be applied not only to an electronic device as long as the system can be modeled by a linear state space model, but also to an abnormality diagnosis system for a mechanical system (for example, a drive system) by including an appropriate sensor. It is.

DESCRIPTION OF SYMBOLS 1 ... Monitoring object 3 ... Abnormality detection system 31 ... Observation data update part 32 ... Database 33 ... Observation data classification part 34a ... Database 34b ... Database 35 ... System identification part 36 ... Kalman filter estimation part 37 ... Abnormality degree calculation part 4 ... Abnormality detection System 41 ... Observation data update unit 42 ... Memory device 42a, 42a '... Pointer 42b, 42b' ... Pointer 42c, 42c '... Pointer 45 ... System identification unit 46 ... Kalman filter estimation unit 47 ... Abnormality degree calculation unit

Claims (3)

An anomaly detection system for detecting an anomaly of a monitoring target that can be modeled by a linear state space model,
An observation data update unit that collects observation data for the monitoring target and stores it in a database as time-series observation data;
An observation data classification unit for classifying at least a part of the observation data of the time series observation data into one of training data and verification data;
A system identification unit for identifying a model parameter of the linear state space model to be monitored based on the training data;
An estimation unit that calculates an estimated value of a probability distribution of the state variable to be monitored, using the model parameter identified by the system identification unit and the verification data as inputs, and
Based on the estimated value calculated by the estimation unit, an abnormality degree calculation unit that calculates the abnormality degree of the monitoring target,
The observation data update unit, when collecting observation data to be monitored, adds newly collected observation data to the time series observation data, and when the number of data of the time series observation data is larger than a threshold value, An anomaly detection system, wherein the observation data collected most recently in the time-series observation data is discarded.   The anomaly detection system according to claim 1, wherein the estimation unit calculates an estimated value of the probability distribution based on a Kalman filter.   The program for functioning a computer as an abnormality detection system of Claim 1 or 2.

Images