Anomaly detection apparatus, method, and storage medium

Patent metadata

Field	Value
Publication number	US-12584822-B2
Application number	US-202318174008-A
Country	US
Kind code	B2
Filing date	Feb 24, 2023
Priority date	Sep 14, 2022
Publication date	Mar 24, 2026
Grant date	Mar 24, 2026

Abstract

According to one embodiment, an anomaly detection apparatus includes a processing circuit. The processing circuit is configured to: acquire measured values from sensors installed in a system, a first function, a first threshold, and a second function to output a second threshold; generate the predicted values based on the measured value and the first function; detect that a deviation between the measured values and the predicted values exceeds the first threshold; calculate the feature quantities based on the measured values; and determine whether a number of consecutive times is equal to or larger than the second threshold to detect an anomaly or a sign of the anomaly.

First claim

What is claimed is:

1 . An anomaly detection apparatus for detecting anomaly in a system comprising a plurality of sensors installed in power plants, water treatment plants, or manufacturing equipment, the anomaly detection apparatus comprising a processing circuit, the processing circuit being configured to:
acquire, via a wired or wireless network, measured values from the plurality of sensors, the measured values including time-series data measured from time to time by each of the plurality of sensors; acquire a first function to output predicted values of the measured values upon receipt of the measured values, the first function being a trained model generated by machine learning using training data generated from history data of measured values of the plurality of sensors; acquire a first threshold; acquire a second function to output a second threshold upon receipt of feature quantities related to a change in the measured values over time, the second function being configured to output a higher value as the second threshold when the feature quantities indicate a rapid change in the measured values and output a lower value as the second threshold when the feature quantities indicate a minimal change; generate the predicted values based on a measured value acquired at a time for monitoring and the first function; temporarily detect that a deviation between the measured values and the predicted values exceeds the first threshold to generate a temporary detection signal related to a result of the temporary detection; count the number of consecutive times of the temporary detection at the time for monitoring based on the temporary detection signal; calculate the feature quantities based on a change in the measured values over time; determine a second threshold based on the feature quantities and the second function; determine whether the number of consecutive times is equal to or larger than the second threshold to detect one of an anomaly of the system to be monitored and a sign of the anomaly; generate a detection signal related to a result of the detection, the detection signal including a plurality of elements corresponding respectively to the plurality of sensors; and output the detection signal to an external device.

2 . The anomaly detection apparatus of claim 1 , wherein the feature quantities include a differential value of the measured values, an absolute value of the differential value, a cumulative value of the differential value, and a cumulative value of the absolute value.

3 . The anomaly detection apparatus of claim 1 , wherein:
the second function outputs a first value as the second threshold upon receipt of a feature quantity with a first frequency and outputs a second value, which is equal to or larger than the first value, as the second threshold upon receipt a feature quantity with a second frequency that is lower than the first frequency, based on frequency distribution of feature quantities calculated based on training data that is a set of measured values used for training the trained model; and the second threshold output from the second function takes two or more different values in accordance with a frequency in the frequency distribution of the feature quantities, which is input to the second function.

4 . The anomaly detection apparatus of claim 2 , wherein a cumulative period related to the cumulative value is equal to or shorter than a time window length of the measured values input to the first function.

5 . The anomaly detection apparatus of claim 1 , wherein the processing circuit is configured to:
generate display screen data for displaying a trend graph of the feature quantities; and output the generated display screen data to an external display.

6 . The anomaly detection apparatus of claim 1 , wherein the processing circuit is configured to:
generate display screen data for displaying a correlation coefficient between the deviation and the feature quantities; and output the generated display screen data to an external display.

7 . The anomaly detection apparatus of claim 3 , wherein the processing circuit is configured to:
generate display screen data for displaying the frequency distribution; and output the generated display screen data to an external display.

8 . The anomaly detection apparatus of claim 1 , wherein the processing circuit is configured to:
generate display screen data for displaying a trend graph of the second threshold value; and output the generated display screen data to an external display.

9 . A method for detecting anomaly in a system comprising a plurality of sensors installed in power plants, water treatment plants, or manufacturing equipment, the method comprising:
acquiring, by a processing circuit via a wired or wireless network, measured values from the plurality of sensors, the measured values including time-series data measured from time to time by each of the plurality of sensors; acquiring, by the processing circuit, a first function to output predicted values of the measured values upon receipt of the measured values, the first function being a trained model generated by machine learning using training data generated from history data of measured values of the plurality of sensors; acquiring, by the processing circuit, a first threshold; acquiring, by the processing circuit, a second function to output a second threshold upon receipt of feature quantities related to a change in the measured values over time, the second function being configured to output a higher value as the second threshold when the feature quantities indicate a rapid change in the measured values and output a lower value as the second threshold when the feature quantities indicate a minimal change; generating, by the processing circuit, the predicted values based on the measured values and the first function; temporarily detecting, by the processing circuit, that a deviation between the measured values and the predicted values exceeds the first threshold to generate a temporary detection signal related to a result of the temporary detection; counting, by the processing circuit, the number of consecutive times of the temporary detection at a time for monitoring based on the temporary detection signal; calculating, by the processing circuit, the feature quantities based on a change in the measured values over time; determining, by the processing circuit, a second threshold based on the feature quantities and the second function; determining, by the processing circuit, whether the number of consecutive times is equal to or larger than the second threshold to detect one of an anomaly of the system to be monitored and a sign of the anomaly, and generating a detection signal related to a result of the detection, the detection signal including a plurality of elements corresponding respectively to the plurality of sensors; and outputting, by the processing circuit, the detection signal to an external device.

10 . A non-transitory computer-readable storage medium storing a program for detecting anomaly in a system comprising a plurality of sensors installed in power plants, water treatment plants, or manufacturing equipment, the program causes a computer to execute:
a function of acquiring, via a wired or wireless network, measured values from the plurality of sensors, the measured values including time-series data measured from time to time by each of the plurality of sensors; a function of acquiring a first function to output predicted values of the measured values upon receipt of the measured values, the first function being a trained model generated by machine learning using training data generated from history data of

Assignees

• Toshiba Kk
• Toshiba Energy Systems & Solutions Corp

Inventors

• Taguchi Yasunori
• Nakata Kouta
• Naito Susumu
• Kato Yuichi
• Tominaga Shinya
• Takado Naoyuki
• Miyake Ryota
• Terakado Yusuke
• Aoki Toshio

Classifications

• G05B23/0262

  Confirmation of fault detection, e.g. extra checks to confirm that a failure has indeed occurred · CPC title

• G05B23/0235

  based on a comparison with predetermined threshold or range, e.g. "classical methods", carried out during normal operation; threshold adaptation or choice; when or how to compare with the threshold · CPC title

• G01M99/005 Primary

  Testing of complete machines, e.g. washing-machines or mobile phones (testing of machine parts G01M13/00; testing of electric apparatus or components G01R31/50) · CPC title

• G05B23/0221 Primary

  Preprocessing measurements, e.g. data collection rate adjustment; Standardization of measurements; Time series or signal analysis, e.g. frequency analysis or wavelets; Trustworthiness of measurements; Indexes therefor; Measurements using easily measured parameters to estimate parameters difficult to measure; Virtual sensor creation; De-noising; Sensor fusion; Unconventional preprocessing inherently present in specific fault detection methods like PCA-based methods · CPC title