JP2024175252A - Anomaly detection device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an abnormality detection device capable of detecting abnormality of a sensor for detecting at least one apparatus and a physical amount about the apparatus by being used by a device or system including a plurality of apparatuses and a plurality of sensors.

SOLUTION: A correlation search part 2 selects at least one correlation sensor having a correlation with an object sensor from among a plurality of sensors S on the basis of a correlation coefficient showing a correlation between a detection value of the object sensor of an abnormality detection object and detection values of non-object sensors other than the object sensor. A virtual output generation part 3 generates a virtual object output and a virtual correlation output obtained by simulating respective detection values of the object sensor and the correlation sensor on the basis of models of an object apparatus and a correlation apparatus being respective detection objects of the object sensor and the correlation sensor among a plurality of apparatuses E. An abnormality determination part 4 determines abnormality of the object apparatus or abnormality of the object sensor on the basis of comparison between the detection value of the correlation sensor and the virtual correlation output in the case that a difference between the detection value of the object sensor and the virtual object output exceeds a prescribed first threshold.

SELECTED DRAWING: Figure 1

COPYRIGHT: (C)2024,JPO&INPIT

Description

This disclosure relates to an anomaly detection device.

Technology for calculating the severity of an anomaly for a detection value of a sensor installed in equipment has been known for some time (see Patent Document 1 below). In Patent Document 1, a prediction value calculation unit calculates a detection prediction value that is predicted to be detected by each sensor if the equipment is operating normally, based on multiple detection value information acquired by a group of sensors when each equipment in a building is operating normally.

In addition, in Patent Document 1, the anomaly degree calculation unit calculates the anomaly degree of each sensor based on the difference between the predicted detection value of each sensor and the actual detection value of each sensor. In addition, the anomaly importance calculation unit calculates the anomaly importance of a sensor of interest based not only on the anomaly degree of the sensor at the time of anomaly detection when the sensor detects an abnormal value, but also on the anomaly degrees of other sensors other than the sensor of interest at the time of anomaly detection.

A method for diagnosing abnormalities in various detectors used in monitoring instruments and control devices in power plants is also known (see Patent Document 2 below). The abnormality diagnosis method in Patent Document 2 is a method for diagnosing abnormalities in detectors that measure process quantities in a plant. In this conventional method, the outputs of multiple detectors that do not require diagnosis are used to estimate the values of multiple detectors that require diagnosis based on dynamic relationship equations between them.

Furthermore, the abnormality evaluation standard quantity is calculated from the difference between the estimated value and the measured value. Then, when the standard quantity exceeds a predetermined value, the values of the remaining detectors, excluding one of the detectors that requires the diagnosis, are re-estimated using the outputs of the multiple detectors that do not require the diagnosis, and the abnormality evaluation standard quantity is recalculated. When the recalculated standard quantity is equal to or less than the predetermined value, the detector that was not estimated is diagnosed as abnormal.

International Publication No. 2018/216197 Japanese Patent Application Publication No. 01-269018

The technology described in Patent Document 1 can calculate the severity of an abnormality, which is an index showing whether an abnormal value detected by a sensor is due to a true malfunction in the equipment, but cannot detect a malfunction in the sensor. Furthermore, Patent Document 2 does not disclose a specific method for selecting multiple detectors that do not require diagnosis. As a result, out of the multiple detectors that require diagnosis, a detector that does not satisfy the conditions may be selected, which may result in inaccurate abnormality diagnosis.

The present disclosure provides an anomaly detection device that is used in an apparatus or system that includes multiple devices and multiple sensors and is capable of detecting an anomaly in at least one device and a sensor that detects a physical quantity related to that device.

One aspect of the present disclosure is an anomaly detection device used in an apparatus or system including multiple devices and multiple sensors, which detects an anomaly in at least one device and at least one sensor that detects a physical quantity related to the device, and which is characterized by comprising: a correlation search unit that calculates a correlation coefficient indicating a correlation between a detection value of a target sensor among the multiple sensors that is an anomaly detection target and a detection value of at least one non-target sensor excluding the target sensor, and selects at least one correlation sensor that has a correlation with the target sensor based on the correlation coefficient; a virtual output generation unit that generates a virtual target output and a virtual correlation output that simulate the detection values of the target sensor and the correlation sensor based on a model of a target device that is a detection target of the target sensor and the correlation sensor among the multiple devices, and an anomaly determination unit that determines an anomaly in the target device or the target sensor based on a comparison between the detection value of the correlation sensor and the virtual correlation output when the difference between the detection value of the target sensor and the virtual target output exceeds a predetermined first threshold value.

According to the above aspect of the present disclosure, it is possible to provide an anomaly detection device that is used in an apparatus or system including multiple devices and multiple sensors and is capable of detecting an anomaly in at least one device and a sensor that detects a physical quantity related to the device.

1 is a block diagram showing a first embodiment of an anomaly detection device according to the present disclosure; FIG. 2 is a flow diagram showing an example of an operation of the anomaly detection device of FIG. 1 . FIG. 3 is a flow diagram showing details of the correlation sensor selection process in FIG. 2 . 3 is an example of a correlation table used in the correlation sensor selection process of FIG. 2 . FIG. 3 is a flow diagram showing details of the virtual output generation process in FIG. 2 . FIG. 3 is a flowchart showing details of the abnormality determination process in FIG. 2 . 7 is a graph showing an example of a case where the target sensor abnormality determination of FIG. 6 is performed; 7 is a graph showing an example of a case where the target device abnormality determination of FIG. 6 is performed. FIG. 11 is a block diagram showing a second embodiment of an anomaly detection device according to the present disclosure. 10 is a flowchart showing the operation of a model adjustment unit of the anomaly detection device of FIG. 9 . 10 is a graph showing an example of an output by a model adjustment unit of the anomaly detection device of FIG. 9 .

Below, an embodiment of an anomaly detection device according to the present disclosure will be described with reference to the drawings.

[Embodiment 1]
1 is a block diagram showing a first embodiment of an anomaly detection device 1 according to the present disclosure. The anomaly detection device 1 of the present embodiment is used, for example, in an apparatus AP or a system SY including a plurality of devices E and a plurality of sensors S. The apparatus AP or the system SY includes, for example, n devices E1, E2, ..., En (n is a natural number of 2 or more) and m sensors S1, S2, ..., Sm (m is a natural number of 2 or more).

Two or more sensors S that detect different physical quantities may be attached to one device E. The physical quantities detected by each sensor S for each device E are not particularly limited, but may include, for example, temperature, pressure, flow rate, humidity, concentration, vibration frequency, rotation speed, speed, acceleration, outside temperature, and rainfall. The device AP or system SY also includes, for example, a control device C that acquires the detection values of each sensor S and transmits them to the anomaly detection device 1 via a network.

The equipment AP in which the anomaly detection device 1 is used includes, for example, industrial plants, chemical plants, energy plants, and environmental plants. The multiple devices E constituting the equipment AP include, for example, pumps, compressors, turbines, heat exchangers, and reactors. The system SY in which the anomaly detection device 1 is used includes, for example, vehicle engine systems, hybrid systems, EV systems, and fuel cell systems. The multiple devices E constituting the system SY include, for example, engines, intake systems, exhaust systems, fuel supply systems, batteries, motors, and fuel cell cells.

The abnormality detection device 1 detects, for example, an abnormality in at least one device E among the multiple devices E that constitute the device AP or the system SY. The abnormality detection device 1 also detects, for example, an abnormality in at least one sensor S that detects a physical quantity related to at least one device E that is the target of abnormality detection among the multiple sensors S that constitute the device AP or the system SY. The abnormality detection device 1 is composed of, for example, one or more microcontrollers or computers including an input/output unit, a central processing unit (CPU), a memory such as ROM or RAM, and a timer.

As shown in FIG. 1, the anomaly detection device 1 includes, for example, a correlation search unit 2, a virtual output generation unit 3, and an anomaly determination unit 4. Each of these units of the anomaly detection device 1 represents a function of the anomaly detection device 1 that is realized, for example, by a CPU executing a program stored in a memory. The anomaly detection device 1 may also include, for example, a memory unit 5. The memory unit 5 may be configured, for example, by a storage device such as a memory or a hard disk. The anomaly detection device 1 may also be connected to a display device 6, for example, a liquid crystal display or an organic EL display.

Figure 2 is a flow diagram showing an example of the operation of the anomaly detection device 1 of Figure 1. For example, before starting the processing flow shown in Figure 2, a user of the anomaly detection device 1 selects a target sensor St to be subjected to anomaly detection from among the multiple sensors S of the device AP or system SY, and inputs the selected target sensor St to an input device of the anomaly detection device 1. Also, for example, information on the selected target sensor St and information on a target device Et, which is a device E whose physical quantity is detected by the target sensor St, are input in advance to the input device of the anomaly detection device 1 and stored in the memory unit 5.

More specifically, the user of the anomaly detection device 1 can select sensor S1 as the target sensor St from among multiple sensors S. In this case, the target device Et is, for example, device E1 whose physical quantity is detected by sensor S1, and the anomaly detection device 1 detects anomalies in sensor S1 and device E1. Once the target sensor St and target device Et are determined, the anomaly detection device 1 starts the process flow shown in FIG. 2 and sequentially executes process P1 for selecting a correlation sensor Sc, process P2 for generating a virtual output, and process P3 for determining anomalies in the target device Et and the target sensor St.

The correlation sensor Sc selected in process P1 shown in FIG. 2 is one or more sensors S of the multiple sensors S whose detection value has a predetermined correlation with the detection value of the target sensor St. The virtual output generated in process P2 is a virtual output of the target sensor St and the correlation sensor Sc based on a simulation using a model of the target device Et and the correlation device Ec, which are the physical quantity detection targets of the target sensor St and the correlation sensor Sc, among the multiple devices E. In process P3, an abnormality in the target sensor St and the target device Et is detected based on the respective detection values and virtual outputs of the target sensor St and the correlation sensor Sc. Processes P1 to P3 will be described in more detail below.

Figure 3 is a flow diagram showing details of process P1 for selecting a correlation sensor Sc in Figure 2. Figure 4 is an example of a correlation table CT used in process P1 for selecting a correlation sensor Sc in Figure 2. When process P1 shown in Figure 3 is started, the correlation search unit 2 of the anomaly detection device 1 executes process P11 for determining whether or not the correlation table CT has been stored in the memory unit 5. In this process P11, if the correlation search unit 2 determines that the correlation table CT is stored in the memory unit 5 (YES), for example, it executes process P12 for determining whether or not to update the correlation table CT.

In this process P12, the correlation search unit 2 displays, for example, an image on the display device 6 to confirm whether the correlation table CT has been updated, and receives a user instruction as to whether the correlation table CT has been updated via the input device of the anomaly detection device 1. When the user inputs an instruction indicating that the correlation table CT has not been updated to the input device of the anomaly detection device 1, the correlation search unit 2 determines that the correlation table CT has not been updated (NO), and executes process P16 to select a correlation sensor Sc, which will be described later.

On the other hand, in process P12, when the user inputs an instruction to the input device of the anomaly detection device 1 indicating that the correlation table CT has been updated, the correlation search unit 2 determines that the correlation table CT has been updated (YES), and executes process P13 to acquire the detection values of the multiple sensors S. Also, in the above-mentioned process P11, if the correlation search unit 2 determines that the correlation table CT is not stored in the memory unit 5 (NO), process P13 to acquire the detection values of the multiple sensors S is executed.

In process P13, the correlation search unit 2 acquires detection values of multiple sensors S of the device AP or system SY, for example, via the control device C of the device AP or system SY and a network. The correlation search unit 2 also stores the acquired detection values of the multiple sensors S in time series in the memory unit 5. The detection values of the multiple sensors S acquired by the correlation search unit 2 may be, for example, a past time series stored in the control device C, i.e., historical data, but it is desirable to include the most recent detection values that can be acquired.

Next, the correlation search unit 2 executes, for example, a process P14 for calculating a correlation coefficient CF. In this process P14, the correlation search unit 2 calculates the correlation coefficient CF using a time series of detection values of one or more target sensors St pre-selected from among the multiple sensors S, and a time series of detection values of one or more non-target sensors Se, which are the other sensors S. The correlation coefficient CF is, for example, a Pearson correlation coefficient. The correlation coefficient CF may also be found, for example, by using linear regression. The importance calculated by decision tree analysis may also be used as the correlation coefficient CF.

Next, the correlation search unit 2 executes process P15 to generate a correlation table CT shown in FIG. 4, for example. Here, assuming that the target sensor St is sensor S1, the correlation search unit 2 uses the correlation coefficient CF calculated in process P14 to generate a correlation table CT in which one or more other non-target sensors Se, whose correlation coefficients CF with the detection value of the target sensor St have been calculated, are arranged in descending order of correlation coefficient CF. In addition, the correlation search unit 2 displays the generated correlation table CT on the display device 6, for example. This makes it possible to present non-target sensors Se that have a correlation with the detection value of the target sensor St to a user who does not have specialized knowledge.

In the example shown in FIG. 4, the correlation table CT includes the correlation coefficient CF of each sensor S, as well as information on the physical quantity (e.g., pressure, flow rate, temperature, etc.) detected by each sensor S and the installation location (e.g., equipment E1, E2, area A1, etc.). The correlation search unit 2 stores the correlation table CT generated in process P15, for example, in the memory unit 5. Note that when an instruction to update the correlation table CT is input by the user of the anomaly detection device 1 in the above-mentioned process P12, the correlation search unit 2 updates the existing correlation table CT stored in the memory unit 5. This makes it possible to reflect the time series of the latest detection values of the multiple sensors S in the correlation table CT.

Next, the correlation search unit 2 executes a process P16 for selecting a correlation sensor Sc. In this process P16, the correlation search unit 2, for example, uses the correlation table CT to select one or more sensors S having a higher correlation coefficient CF and a higher ranking as the correlation sensor Sc. More specifically, the correlation search unit 2 can select, for example, a sensor S having a correlation coefficient CF equal to or greater than a predetermined threshold as the correlation sensor Sc.

For example, in the example shown in FIG. 4, if the threshold value of the correlation coefficient CF is 0.95, only sensor S2 is selected as the correlation sensor Sc, and if the threshold value of the correlation coefficient CF is 0.9, sensors S2 and S3 are selected as the correlation sensors Sc. After that, the anomaly detection device 1 ends process P1 shown in FIG. 3, and executes process P2 in which the virtual output generation unit 3 generates the virtual output shown in FIG. 2.

Figure 5 is a flow diagram showing the details of process P2 for generating the virtual output in Figure 2. When the virtual output generating unit 3 starts process P2 shown in Figure 5, it first executes process P21 for selecting a model. Here, the memory unit 5 of the anomaly detection device 1 stores in advance, for example, models of each of the multiple devices E that make up the device AP or system SY. The models stored in the memory unit 5 are model formulas that simulate physical quantities such as temperature, pressure, and flow rate in each device E to generate virtual outputs of the detection values of each sensor S.

The model stored in the memory unit 5 is, for example, a physical model or a data-driven model. More specifically, the model is a physical model including equations based on basic science, engineering, and physics, such as the law of conservation of mass, the law of conservation of energy, and the law of conservation of momentum. The model is also, for example, a data-driven model generated by machine learning such as a neural network. For example, if the device E1 is a heat exchanger, the model of the device E1 simulates the outlet temperature of the device E1 to generate a virtual output of the detection value of the sensor S1 that detects the outlet temperature.

In process P21 for selecting a model, the virtual output generating unit 3 selects models of the target device Et and the correlated device Ec, which are the detection targets of the target sensor St and the correlated sensor Sc, respectively, from among the models of multiple devices E stored in the memory unit 5. Next, the virtual output generating unit 3 executes process P22 for generating a virtual output.

In this process P22, the virtual output generation unit 3 generates a virtual target output and a virtual correlation output that simulate the detection values of the target sensor St and the correlation sensor Sc, respectively, based on the model selected in the previous process P21, and stores them in the memory unit 5. Note that when the target sensor St and the correlation sensor Sc are installed in the same device E, the models of the target device Et and the correlation device Ec will be the same, but this model can generate the virtual target output of the target sensor St and the virtual correlation output of the correlation sensor Sc, respectively.

The process P22 for generating the virtual output may include, for example, setting the conditions and parameters of the model selected in the previous process P21. For example, if the equipment E1 is a heat exchanger, the conditions of the model for generating the virtual target output of the sensor S1 for detecting the outlet temperature of the equipment E1 include the inlet temperature and flow rate of the fluid (e.g., steam) used in the equipment E1, the air temperature around the equipment E1, etc. The virtual output generating unit 3 can set the conditions of the model for generating the virtual target output of the sensor S1, for example, using the time series of the detection values of the sensor S1 stored in the memory unit 5.

In addition, when the equipment E1 is a heat exchanger, the parameters of the model of the equipment E1 that generates the virtual target output of the sensor S1 include, for example, the physical characteristics and thermal characteristics of the equipment E1, such as dimensions and heat transfer coefficient. The model conditions and parameters are, for example, stored in advance in the storage unit 5. After the process P22 is completed, the anomaly detection device 1 terminates the process P2 shown in FIG. 5, and executes the anomaly determination process P3 shown in FIG. 2 by the anomaly determination unit 4.

Figure 6 is a flow diagram showing details of the abnormality determination process P3 in Figure 2. When the abnormality determination unit 4 starts the abnormality determination process P3 shown in Figure 6, it first executes a process P31 to acquire a virtual output. In this process P31, the abnormality determination unit 4 acquires, for example, a virtual target output and a virtual correlation output, which are the virtual outputs of the target sensor St and the correlation sensor Sc, respectively, generated in the aforementioned virtual output generation process P2 and stored in the memory unit 5. In addition, the abnormality determination unit 4 acquires, for example, a time series of the detection values of the target sensor St and the correlation sensor Sc acquired in the aforementioned process P13 to acquire the detection values of the sensor S and stored in the memory unit 5.

Next, the abnormality determination unit 4 executes a process P32 to determine whether the difference ΔDt between the detection value of the target sensor St and the virtual target output exceeds a predetermined first threshold value Th1. The difference ΔDt is, for example, the absolute value of the difference between the detection value of the target sensor St and the virtual target output. In this process P32, if the abnormality determination unit 4 determines that the difference ΔDt does not exceed the first threshold value Th1 (NO), it ends the processing flow shown in FIG. 6 without determining an abnormality in either the target sensor St or the target device Et.

In addition, in process P32, when the anomaly determination unit 4 determines that the difference ΔDt exceeds the first threshold value Th1 (YES), it executes process P33 to determine whether the difference ΔDc between the detection value of the correlation sensor Sc and the virtual correlation output exceeds a predetermined second threshold value Th2. The difference ΔDc is, for example, the absolute value of the difference between the detection value of the correlation sensor Sc and the virtual correlation output. Note that the first threshold value Th1 and the second threshold value Th2 are, for example, set in advance by the user of the anomaly detection device 1 or input and stored in the memory unit 5.

In process P33, if the abnormality determination unit 4 determines that the difference ΔDc exceeds the second threshold value Th2 (YES), it executes process P34 to determine an abnormality in the target device Et. Also, in process P33, if the abnormality determination unit 4 determines that the difference ΔDc does not exceed the second threshold value Th2 (NO), it executes process P35 to determine an abnormality in the target sensor St.

Figure 7 is a graph showing an example of a case where process P35 of Figure 6 for determining an abnormality of the target sensor St is performed. Also, Figure 8 is a graph showing an example of a case where process P34 of Figure 6 for determining an abnormality of the target device Et is performed. The vertical axes of the upper and lower graphs in Figures 7 and 8 respectively represent the difference ΔDt between the detection value of the target sensor St and the virtual target output, and the difference ΔDc between the detection value of the correlation sensor Sc and the virtual correlation output. Also, the horizontal axes of the upper and lower graphs in Figures 7 and 8 both represent time.

In the period T1 between time t1 and time t2 shown in FIG. 7, the difference ΔDt exceeds the first threshold value Th1, and the difference ΔDc is below the second threshold value Th2. In this case, the condition of the above-mentioned process P32 (ΔDt>Th1) is met, but the condition of the process P33 (ΔDc>Th2) is not met, so process P35 is executed and an abnormality in the target sensor St is determined.

In addition, in the period T2 from time t3 to time t4 shown in FIG. 8, the difference ΔDt exceeds the first threshold Th1, and the difference ΔDc also exceeds the second threshold Th2. In this case, the condition of the above-mentioned process P32 (ΔDt>Th1) is satisfied, and the condition of the process P33 (ΔDc>Th2) is also satisfied, so the process P34 is executed and an abnormality in the target device Et is determined.

After completion of process P34 or process P35, the abnormality determination unit 4 executes process P36, for example, to output the determination result. In this process P36, the abnormality determination unit 4, for example, causes the display device 6 to display the determination result of process P34 or process P35, i.e., the abnormality determination of the target sensor St or the abnormality determination of the target device Et, and notifies the user of the determination result. Thereafter, the abnormality detection device 1 ends process P3 shown in FIG. 6 and ends the process flow shown in FIG. 2.

The operation of the anomaly detection device 1 of this embodiment is described below.

In recent years, interest in cyber-physical systems (CPS) has grown, and as the Internet of Things (IoT) advances, there is an increasing reliance on sensors S to remotely monitor the health and operating status of equipment AP and systems SY. For example, in equipment AP of industrial plants, the widespread use of sensors S eliminates the need to constantly have workers on-site to measure the status of equipment E, which is expected to reduce labor costs and improve work efficiency. These advantages are particularly evident in equipment E that is installed in harsh environments or remote locations.

However, there is a risk that the sensor S may malfunction or become damaged. If an abnormality occurs in the sensor S, there is a risk that the actual state of the device E, which is the object of the physical quantity detected by the sensor S, may deviate from the actual state. Therefore, detecting abnormalities in the sensor S is important in order to avoid problems such as damage to the device E. It is also important to determine whether an abnormality in the detection value of the sensor S is an abnormality in the sensor S itself, or an abnormality in the device E, which is the object of the physical quantity detected by the sensor S.

The technology described in Patent Document 1 can calculate the severity of an abnormality, which is an index showing whether an abnormal value detected by a sensor is due to a true malfunction in the equipment, but cannot detect a malfunction in the sensor. Furthermore, Patent Document 2 does not disclose a specific method for selecting multiple detectors that do not require diagnosis. As a result, out of the multiple detectors that require diagnosis, a detector that does not satisfy the conditions may be selected, which may result in inaccurate abnormality diagnosis.

In contrast, the anomaly detection device 1 of this embodiment is used in an apparatus AP or system SY including multiple devices E and multiple sensors S, and is a device that detects anomalies in at least one device E and at least one sensor S that detects physical quantities related to the device E. The anomaly detection device 1 includes a correlation search unit 2, a virtual output generation unit 3, and an anomaly determination unit 4. The correlation search unit 2 calculates a correlation coefficient CF that indicates the correlation between the detection value of a target sensor St that is an anomaly detection target among the multiple sensors S and the detection value of at least one non-target sensor Se excluding the target sensor St, and selects at least one correlation sensor Sc that has a correlation with the target sensor St based on the correlation coefficient CF. The virtual output generation unit 3 generates a virtual target output and a virtual correlation output that simulate the detection values of the target sensor St and the correlation sensor Sc based on a model of a target device Et and a correlation device Ec that are detection targets of the target sensor St and the correlation sensor Sc, among the multiple devices E. When the difference ΔDt between the detection value of the target sensor St and the virtual target output exceeds a predetermined first threshold value Th1, the abnormality determination unit 4 determines an abnormality in the target device Et or the target sensor St based on a comparison between the detection value of the correlation sensor Sc and the virtual correlation output.

With this configuration, according to the anomaly detection device 1 of this embodiment, the correlation search unit 2 can automatically select from among the multiple sensors S a correlation sensor Sc that outputs a detection value having a predetermined correlation with the detection value of the target sensor St that is the target for anomaly detection. This makes it possible for even a user without specialized knowledge or experience to select a correlation sensor Sc that has a predetermined correlation with the detection value of the target sensor St, thereby improving the accuracy of anomaly detection of the target sensor St and the target device Et. In addition, it is possible to prevent a decrease in the accuracy of anomaly detection due to human error when selecting the correlation sensor Sc. In addition, it is possible to detect that an abnormality has occurred in either the target sensor St or the target device Et based on the difference ΔDt between the detection value of the target sensor St and the virtual target output. Then, by comparing the detection value of the correlation sensor Sc with the virtual correlation output, it is possible to identify which of the target sensor St or the target device Et is abnormal. This makes it possible for a worker performing maintenance on the device AP or the system SY to take appropriate measures against the target sensor St or the target device Et that has been determined to be abnormal.

In addition, in the anomaly detection device 1 of this embodiment, the anomaly determination unit 4 determines an anomaly in the target device Et when the difference ΔDc between the detection value of the correlation sensor Sc and the virtual correlation output exceeds a predetermined second threshold Th2, and determines an anomaly in the target sensor St when the difference ΔDc does not exceed the second threshold Th2. In this way, by the anomaly determination unit 4 comparing the difference ΔDc between the detection value of the correlation sensor Sc and the virtual correlation output with the predetermined second threshold Th2, it becomes possible to more accurately determine anomalies in the target sensor St and the target device Et.

In addition, in the anomaly detection device 1 of this embodiment, the models of the target device Et and the correlated device Ec are physical models or data-driven models. This configuration makes it possible to more accurately simulate the states of the target device Et and the correlated device Ec, and to generate virtual target outputs and virtual correlation outputs that are closer to the actual detection values of the target sensor St and the correlated sensor Sc.

In addition, in the anomaly detection device 1 of this embodiment, the correlation search unit 2 calculates the correlation coefficient CF based on the time series of the detection values of the target sensor St and the time series of the detection values of the non-target sensor Se. With this configuration, the accuracy of the calculated correlation coefficient CF is improved, making it possible to select a more appropriate correlation sensor Sc.

As described above, according to this embodiment, it is possible to provide an anomaly detection device 1 that is used in an apparatus AP or a system SY that includes multiple devices E and multiple sensors S, and that can detect an anomaly in at least one device E and a sensor S that detects a physical quantity related to that device E.

[Embodiment 2]
Next, a second embodiment of the anomaly detection device according to the present disclosure will be described with reference to Fig. 9 to Fig. 11. Fig. 9 is a block diagram showing the second embodiment of the anomaly detection device according to the present disclosure. The anomaly detection device 1A of this embodiment differs from the anomaly detection device 1 of the first embodiment described above in that it further includes a model adjustment unit 7. Other configurations of the anomaly detection device 1A of this embodiment are similar to the configurations of the anomaly detection device 1 of the first embodiment described above, so similar parts are denoted by the same reference numerals and description thereof will be omitted.

The model adjustment unit 7, like the correlation search unit 2, the virtual output generation unit 3, and the anomaly determination unit 4, represents the functions of the anomaly detection device 1A that are realized by the CPU constituting the anomaly detection device 1A executing a program stored in the storage unit 5. The model adjustment unit 7 tunes the parameters of the models of the target device Et and the correlated device Ec based on the detection values of the target sensor St and the correlation sensor Sc, respectively.

Figure 10 is a flow diagram showing the operation of the model adjustment unit 7 of the anomaly detection device 1A of Figure 9. When the model adjustment unit 7 starts the tuning process P4 shown in Figure 10, it first executes a process P41 to initialize the parameter k of the model. In this process P41, the model adjustment unit 7 initializes the models of the target device Et and the correlated device Ec, for example, by specifying the initial state of the model, the initial value of the parameter k, and the end time te of tuning. The initial value of the parameter k, etc. are stored in advance in the memory unit 5, for example.

Next, the model adjustment unit 7 executes process P42 to generate a virtual output. In this process P42, the model adjustment unit 7 generates a virtual target output and a virtual correlation output using the models of the target device Et and the correlated device Ec initialized in the previous process P41. More specifically, if the target device Et is a heat exchanger, a virtual target output corresponding to the detection value of the target sensor St that detects the outlet temperature of the heat exchanger is generated.

Next, the model adjustment unit 7 executes process P43 to acquire the detection value of the sensor S. In this process P43, the model adjustment unit 7 acquires the detection values of the target sensor St and the correlation sensor Sc from, for example, the device AP or the system SY via the control device C. More specifically, if the target device Et is a heat exchanger, the detection value of the target sensor St that detects the outlet temperature of the heat exchanger is acquired.

Next, the model adjustment unit 7 executes a process P44 for tuning the parameter k of the model. More specifically, the model adjustment unit 7 tunes the parameter k using a data assimilation method such as an ensemble Kalman filter (EnKF) or a particle filter. This allows the error e between the detection value of the target sensor St and the virtual target output and the error e between the detection value of the correlation sensor Sc and the virtual correlation output to be obtained.

The model adjustment unit 7 then performs process P45 to determine whether the time t of tuning process P4 has reached the end time te. If it determines that the end time te has not been reached (NO), it performs process P46 to add time t, and repeats processes P42 to P45. After that, if the model adjustment unit 7 determines in process P45 that the time t of tuning process P4 has reached the end time te (YES), it performs process P47 to update parameter k based on the result of process P44. In addition, the model adjustment unit 7, for example, causes the generated output to be displayed on the display device 6.

Figure 11 is a graph showing an example of the output by the model adjustment unit 7 of the anomaly detection device 1A of Figure 9. The upper graph of Figure 11 shows the change over time of the parameter k, and the lower graph of Figure 11 shows the change over time of the error e. As shown in the upper graph of Figure 11, at time t5 the value of the tuned parameter k begins to stabilize at the average value k'. At the same time, as shown in the lower graph of Figure 11, the value of the error e begins to stabilize at an error e' that is smaller than the initial value e'0.

The output of the model adjustment unit 7 shown in FIG. 11 indicates that the model adjustment unit 7 has been able to successfully tune the parameter k from time t5. Therefore, in process P47 of updating the model, the model adjustment unit 7 replaces the existing parameter k with the tuned parameter k'.

As described above, the anomaly detection device 1A of this embodiment further includes a model adjustment unit 7 that tunes the parameter k of the model of the target device Et and the correlated device Ec based on the detection values of the target sensor St and the correlated sensor Sc, respectively.

With this configuration, even if the behavior of the target device Et and the correlated device Ec changes over time due to degradation or the like, the behavior of the models of the target device Et and the correlated device Ec can be made to follow the actual behavior of the target device Et and the correlated device Ec. This makes it possible to more accurately determine abnormalities in the target device Et and the target sensor St. Note that the frequency of the tuning process P4 by the model adjustment unit 7 can be defined by the user, for example, once a year.

In the anomaly detection device 1A of this embodiment, the model adjustment unit 7 can also automatically set, for example, the first threshold Th1 and the second threshold Th2 shown in FIG. 7. Specifically, after tuning the parameter k, the model adjustment unit 7 sets the first threshold Th1 based on the difference ΔDt between the virtual target output and the detection value of the target sensor St, and sets the second threshold Th2 based on the difference ΔDc between the virtual correlation output and the detection value of the correlation sensor.

This configuration makes it possible to automatically set the first threshold Th1 and the second threshold Th2. This prevents the user from mistakenly setting inappropriate first threshold Th1 and second threshold Th2, and prevents the abnormality of the target sensor St and the target device Et from being erroneously determined or from not being detected. The model adjustment unit 7 may provide information via the display device 6 to enable the user to set the correct first threshold Th1 and second threshold Th2.

Although the embodiments of the present disclosure have been described in detail above using the drawings, the specific configuration is not limited to this embodiment, and even if there are design changes, etc., within the scope that does not deviate from the gist of this disclosure, they are included in this disclosure.

1 Anomaly detection device 1A Anomaly detection device 2 Correlation search unit 3 Virtual output generation unit 4 Anomaly determination unit 7 Model adjustment unit AP Device CF Correlation coefficient E Device Ec Correlated device Et Target device S Sensor Sc Correlated sensor Se Non-target sensor St Target sensor SY System Th1 First threshold Th2 Second threshold ΔDc Difference ΔDt Difference

Claims (6)

An anomaly detection device for use in an apparatus or system including a plurality of devices and a plurality of sensors, the anomaly detection device detecting an anomaly in at least one device and at least one sensor for detecting a physical quantity related to the device, comprising:
a correlation search unit that calculates a correlation coefficient indicating a correlation between a detection value of a target sensor that is an anomaly detection target among the plurality of sensors and a detection value of at least one non-target sensor other than the target sensor, and selects at least one correlation sensor that has a correlation with the target sensor based on the correlation coefficient;
a virtual output generating unit configured to generate a virtual target output and a virtual correlation output by simulating detection values of the target sensor and the correlation sensor, respectively, based on a model of a target device and a correlation device that are detection targets of the target sensor and the correlation sensor, respectively, among the plurality of devices;
an anomaly determination unit that determines an anomaly of the target device or the target sensor based on a comparison between the detection value of the correlation sensor and the virtual correlation output when a difference between the detection value of the target sensor and the virtual target output exceeds a predetermined first threshold;
An anomaly detection device comprising: The anomaly detection device according to claim 1, characterized in that the anomaly determination unit determines an anomaly in the target device when the difference between the detection value of the correlation sensor and the virtual correlation output exceeds a predetermined second threshold, and determines an anomaly in the target sensor when the difference does not exceed the second threshold. The anomaly detection device according to claim 2, further comprising a model adjustment unit that tunes the parameters of the models of the target device and the correlated device based on the detection values of the target sensor and the correlated sensor, respectively. The anomaly detection device according to claim 1, characterized in that the models of the target device and the correlated device are physical models or data-driven models. The anomaly detection device according to claim 1, characterized in that the correlation search unit calculates the correlation coefficient based on a time series of detection values of the target sensor and a time series of detection values of the non-target sensor. The anomaly detection device according to claim 3, characterized in that the model adjustment unit sets the first threshold based on the difference between the virtual target output and the detection value of the target sensor, and sets the second threshold based on the difference between the virtual correlation output and the detection value of the correlation sensor.

Images