Anomaly detection and diagnosis/prognosis method, anomaly detection and diagnosis/prognosis system, and anomaly detection and diagnosis/prognosis program

• US 9,483,049 B2
• Filed: 06/16/2010
• Issued: 11/01/2016
• Est. Priority Date: 09/07/2009
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Maeda, Shunji, Shibuya, Hisae
• Primary Examiner(s): Barbee, Manuel L
• Application Number:
  US13/384,463
• Publication Number:
  US 20120166142A1
• Time in Patent Office: 2,330 Days
• Field of Search: 702182-185, 706/45
• US Class Current: 1/1
• CPC Class Codes: G05B 23/0227 Qualitative history assessment, whereby the type of data acted upon, e.g. waveforms, images or patterns, is not relevant, e.g. rule based assessment; if-then decisions
• CPC Class Codes: G06F 18/2137 based on criteria of topology preservation, e.g. multidimensional scaling or self-organising maps
• CPC Class Codes: G06F 2218/12 Classification; Matching

Abstract

Provided is an anomaly detection method and system capable of constructing determination condition rules of anomaly detection from case-based anomaly detection by way of multivariate analysis of a multi-dimensional sensor signal, applying the rules to design-based anomaly detection of individual sensor signals, and also appropriately executing setting and control of threshold values for highly sensitive, early, and clearly visible detection of anomalies. Anomaly detection on the basis of a case base by way of multivariate analysis controls design-based anomaly detection. That is to say, (1) anomaly detection on the basis of a case base performs selection of sensor signals and anomaly detection according to various types of anomalies. Specifically, anomaly detection (characteristic conversion), evaluation of level of effect of each signal, construction of determination conditions (rules), and display and selection of sensor signals corresponding to the anomaly are performed. (2) Design-based anomaly detection for individual sensor signals performs anomaly detection after the above have been performed. Specifically, setting and control of thresholds, display of thresholds, and anomaly detection and display are performed.

Claims

1. An anomaly detection method for early detection of an anomaly of a plant or a facility using an anomaly detection system, comprising:

acquiring an observation data from a plurality of multi-dimensional time-series sensors and modeling learning data composed of normal data;

detecting whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data;

evaluating a level of effect of each sensor signal, based on a result of the anomaly detection;

selecting sensor signals using the level of effect;

controlling threshold values of the observation data from the selected sensor signals;

constructing rules of determination conditions, based on the controlled threshold values; and

implementing a countermeasure based on the detected anomaly.

2. The anomaly detection method according to claim 1, further comprising

modeling learning data via a subspace classifier;

and

detecting the anomaly based on a distance relationship between the observation data and a subspace.

3. The anomaly detection method according to claim 2, wherein the subspace classifier adopts a projection distance method, a CLAFIC method or a local subspace classifier targeting a vicinity of the observation data.

5. The anomaly detection method according to claim 3, wherein a frequency for detecting whether anomaly of observation data exists or not via the similarity between observation data and learning data is performed non-synchronously with collection of data.

6. The anomaly detection method according to claim 3, wherein the determination condition rules obtained with respect to individual sensor signals are either displayed externally or output.

4. An anomaly detection method for early detection of an anomaly of a plant or a facility using an anomaly detection system, comprising:

acquiring an observation data from a plurality of multi-dimensional time-series sensors and modeling learning data composed of normal data;

detecting whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data; and

accumulating an evaluation result of level of effect of each sensor signal together with anomaly cases, evaluating a level of effect of each sensor signal, based on the accumulated data;

selecting sensor signals using the level of effect;

controlling threshold values of the observation data from the selected sensor signals;

constructing rules of determination conditions, based on the controlled threshold values; and

implementing a countermeasure based on the detected anomaly.

7. The anomaly detection method according to claim 4, further comprising:

performing characteristic conversion of the learning data composed substantially of normal data acquired from the plurality of multi-dimensional time-series sensors and the observation data concurrently and simultaneously.

8. An anomaly detection method for early detection of an anomaly of a plant or a facility, comprising:

acquiring an observation data from a plurality of multi-dimensional time-series sensors and modeling learning data composed of normal data;

detecting whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data;

evaluating a level of effect of each sensor signal, based on a result of the anomaly detection;

selecting sensor signals using the level of effect, thereby creating a relevance network diagram of each sensor signal and modeling the target facility;

controlling threshold values of the observation data from the selected sensor signals;

constructing rules of determination conditions, based on the controlled threshold values; and

implementing a countermeasure based on the detected anomaly.

9. The anomaly detection method according to claim 8, wherein the relevance network diagram of each sensor signal is used for the diagnosis/prognosis of a cause of the anomaly.

10. An anomaly detection method for early detection of an anomaly of a plant or a facility, comprising:

acquiring an observation data from a plurality of multi-dimensional time-series sensors and modeling learning data composed of normal data;

detecting whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data;

using data stored in a database storing data including anomaly cases, level of effect of each sensor signal, past selection results for anomaly diagnosis/prognosis;

evaluating a level of effect of each sensor signal, based on a result of the anomaly detection;

selecting sensor signals using the level of effect;

controlling threshold values of the observation data from the selected sensor signals;

constructing rules of determination conditions, based on the controlled threshold values; and

implementing a countermeasure based on the detected anomaly.

11. An anomaly detection and diagnosis/prognosis method for early detection and diagnosis/prognosis of an anomaly of a plant or a facility, comprising:

acquiring an observation data from a plurality of multi-dimensional time-series sensors and modeling learning data composed of normal data;

detecting whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data;

providing a list of possible countermeasures when a phenomenon related to a new anomaly occurs using data stored in a database storing data including anomaly cases, level of effect of each sensor signal, past selection results, based on a connectivity among elements representing phenomenon, areas and measures of a plurality of cases;

evaluating a level of effect of each sensor signal, based on a result of the anomaly detection;

selecting sensor signals using the level of effect;

controlling threshold values of the observation data from the selected sensor signals;

constructing rules of determination conditions, based on the controlled threshold values; and

implementing a countermeasure based on the detected anomaly.

12. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a processor that acquires an observation data from a plurality of multi-dimensional time-series sensors, wherein the processor models learning data composed of normal data, and the processor detects whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data, wherein

the processor, evaluates a level of effect of each sensor signal, constructing determination condition rules, and a displaying section for displaying sensor signals corresponding to the anomaly,

the processor evaluates a level of effect of each sensor signal based on a result of the anomaly detection, selects sensor signals using the level of effect, controls threshold values of the observation data from the selected sensor signals, and constructs rules of determination conditions based on the controlled threshold values, and

a countermeasure is implemented based on the detected anomaly.

16. The anomaly detection system according to claim 12, wherein:

the processor models learning data via a subspace classifier, and the processor detects an anomaly based on a distance relationship between the observation data and subspace, wherein

the system models learning data via a subspace classifier, and

detects anomaly based on a distance relationship between the observation data and subspace.

17. The anomaly detection system according to claim 16, wherein the subspace classifier adopts a projection distance method, a CLAFIC method or a local subspace classifier targeting a vicinity of the observation data.

13. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a processor that acquires an observation data from a plurality of multi-dimensional time-series sensors, wherein the processor also models learning data composed of normal data, and the processor detects whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data;

a data storage section for storing a result of evaluation of level of effect of each sensor signal and anomaly cases, wherein

the processor constructs determination condition rules, and selecting and displaying sensor signals corresponding to the anomaly,

the processor evaluates a level of effect of each sensor signal based on accumulated data, selects sensor signals using the level of effect, controls threshold values of the observation data from the selected sensor signals, and constructs rules of determination conditions based on the controlled threshold values, and

a countermeasure is implemented based on the detected anomaly.

14. The anomaly detection system according to claim 13, wherein a frequency for detecting whether anomaly of observation data exists or not based on the similarity between the observation data and the learning data is performed non-synchronously with collection of data.

15. The anomaly detection system according to claim 13, wherein the determination condition rules obtained with respect to individual sensor signals are either displayed externally or output.

18. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a processor that acquires an observation data from a plurality of multi-dimensional time-series sensors, wherein the processor models learning data composed of normal data, and the processor detects whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data, and the processor also evaluates a level of effect of each sensor signal, wherein

the processor creates a relevance network diagram of each sensor signal,

the processor evaluates a level of effect of each sensor signal based on a result of the anomaly detection, selects sensor signals using the level of effect, controls threshold values of the observation data from the selected sensor signals, and constructs rules of determination conditions based on the controlled threshold values, and

a countermeasure is implemented based on the detected anomaly.

19. The anomaly detection system according to claim 18, wherein a relevance network diagram of each sensor signal is used for the diagnosis/prognosis of a cause of the anomaly.

20. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a processor that acquires an observation data from a plurality of multi-dimensional time-series sensors, wherein the processor models learning data composed of normal data, and the processor detects whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data, and the processor also evaluates the level of effect of each sensor signal, wherein the processor creates a relevance network diagram of each sensor signal; and

a database for accumulating data composed of anomaly cases, level of effect of each sensor signal, and past selection results, wherein

the processor evaluates a level of effect of each sensor signal based on a result of the anomaly detection, selects sensor signals using the level of effect, controls threshold values of the observation data from the selected sensor signals, and constructs rules of determination conditions based on the controlled threshold values, and

a countermeasure is implemented based on the detected anomaly.

21. An anomaly detection and diagnosis/prognosis system for early detection and diagnosis/prognosis of an anomaly of a plant or a facility, comprising:

a processor that acquires an observation data from a plurality of multi-dimensional time-series sensors, wherein the processor models learning data composed of normal data, and the processor detects whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data, and the processor also evaluates the level of effect of each sensor signal, wherein the processor creates a relevance network diagram of each sensor signal;

a database for storing data including anomaly cases, level of effect of each sensor signal, and past selection results;

wherein

the processor evaluates the connectivity among elements representing phenomenon, areas and measures of a plurality of cases,

the processor evaluates a level of effect of each sensor signal based on a result of the anomaly detection, selects sensor signals using the level of effect, controls threshold values of the observation data from the selected sensor signals, and constructs rules of determination conditions based on the controlled threshold values, and

a countermeasure is implemented based on the detected anomaly.

22. A non-transitory computer readable medium storing an anomaly detection program for early detection of an anomaly of a plant or a facility, wherein when executed the anomaly detection program causes a computer to perform the following steps:

acquiring an observation data from a plurality of multi-dimensional time-series sensors and modeling learning data composed of normal data;

detecting whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data;

evaluating a level of effect of each sensor signal, based on a result of the anomaly detection;

selecting sensor signals using the level of effect;

controlling threshold values of the observation data from the selected sensor signals;

constructing rules of determination conditions, based on the controlled threshold values, and

implementing a countermeasure based on the detected anomaly.

23. A non-transitory computer readable medium storing an anomaly detection program for early detection of an anomaly of a plant or a facility, wherein when executed the anomaly detection program causes a computer to perform the following steps via a medium or an online service:

acquiring an observation data from a plurality of multi-dimensional time-series sensors and modeling learning data composed of normal data;

detecting whether anomaly of observation data exists or not based on a similarity between the observation data and the modeled learning data;

evaluating a level of effect of each sensor signal, based on a result of the anomaly detection;

selecting sensor signals using the level of effect;

controlling threshold values of the observation data from the selected sensor signals;

constructing rules of determination conditions, based on the controlled threshold values; and

implementing a countermeasure based on the detected anomaly.