JP6613175B2 - Abnormality detection device, system stability monitoring device, and system thereof - Google Patents

Description

  The present invention relates to an anomaly detection device, a system stability monitoring device, and a system thereof that use time-series information in social infrastructure system operation.

  With the development of social infrastructure systems, many digital systems and communication systems have been widely introduced. In these systems, various detection values and the like are periodically obtained to obtain time-series information and transmitted according to the purpose. In this case, since it is assumed that the time series information includes abnormal values, various abnormality detection techniques have been used in various fields.

  As a background art of this technical field, Patent Document 1 discloses a method and apparatus for detecting a minute fluctuation tendency generated in time-series data, and for quickly detecting the fluctuation tendency. Time series data is A / D converted and stored in the input buffer 3, high frequency noise is removed by the median filter 4, and then the additional confidence is determined from the relative change amount of the data in the fluctuation tendency detection device, and the confidence is combined. The latest confidence factor is obtained using a function, and a minute fluctuation tendency of the time series data is detected by using a threshold value for the certainty factor.

  Further, Non-Patent Document 1 is available as background art in this technical field. In Non-Patent Document 1, abnormality detection is performed by using classification in statistics.

JP-A-5-72005

Manikopoulos, C .; Papavassiliou, S., “Network intrusion and fault detection: a statistical anomaly approach,” in Communications Magazine, IEEE, vol.40, no.10, pp.76-82, Oct 2002

  Patent Document 1 is intended to detect abnormality in signal processing. For this reason, the median filter processing is performed on the input information, and the abnormality detection accuracy is improved by detecting the abnormality from the relative change amount. However, in order to improve abnormality detection accuracy, an input buffer in the median filter is required, resulting in a delay in abnormality detection.

  In Non-Patent Document 1, anomaly detection with high accuracy is performed by using classification in statistics. However, since the calculation processing in classification is complicated, a delay occurs in the abnormality detection.

  Although the methods of Patent Document 1 and Non-Patent Document 1 improve the abnormality detection accuracy, the abnormality detection speed is insufficient, so that it is not suitable for use cases where the abnormality detection speed is required as in infrastructure system operation.

  Therefore, in the present invention, the infrastructure system operation is supported by increasing the speed while maintaining the accuracy of detecting the abnormality of the time series information. Specifically, an abnormality detection device is provided that can increase the speed while maintaining the accuracy of abnormality detection of time-series information. Furthermore, it proposes applying to a system stability monitoring device as a concrete use scene of an abnormality detection device. Moreover, the system stability monitoring system suitable for using a system stability monitoring apparatus is provided.

  In order to solve the above problems, one of the representative aspects of the present invention is an abnormality detection device for detecting an abnormal value of time-series information, an input unit for inputting time-series information, and a change value of time-series information. The change value calculation unit that calculates the value, the analysis value frame adjustment unit that determines the analysis time frame, and the statistical processing on the time series information within the analysis time frame And a statistical abnormality detection unit that determines abnormality of the time series information and gives an abnormality detection result.

  In order to solve the above problem, one of the representative inventions is a system stability monitoring device that uses the abnormality detection result obtained in the abnormality detection device, and a past case database that holds past cases; Using the past time series information database that holds past time series information and the abnormality detection result obtained in the abnormality detection device, the past case similar to the abnormality detection result and the similar to extracting the time series information immediately after the past case And a sex determination unit.

  In addition, a system stability monitoring system is provided which includes a system stability monitoring apparatus in a control room for system operation.

  According to the present invention, real-time operation support can be performed by high-precision and high-speed abnormality detection. Problems, configurations, and effects other than those described above will become apparent from the description of the embodiments.

The figure which shows the whole system structure when the abnormality detection apparatus of this invention is applied to a system | strain stability monitoring apparatus. The figure which shows the hardware constitutions of the system | strain stability monitoring apparatus 1, and the whole structural example of the electric power grid | system 12. The example of the flowchart which shows the whole calculation processing content of the system | strain stability monitoring apparatus 1. FIG. The figure which shows an example of the time series information D1. The example of the flowchart of change value calculation in FIG. The figure which shows the example of an output of change value calculation in FIG. The example of the flowchart of the analysis time frame adjustment in FIG. The figure which shows an example of the normal determination reference value database DB2 in FIG. The figure which shows an example of the analysis time frame calculated | required by the analysis time frame adjustment process. The example of the flowchart of abnormality detection by the linear method in FIG. The figure which shows an example of statistical reference value database DB3 in FIG. The figure for demonstrating notionally the flow of the process of the abnormality detection by a linear method. The figure which shows an example of the output of the abnormality detection by a linear method. The example of the flowchart of the detection result correction process in FIG. The figure which shows an example of correction parameter database DB4 in FIG. The figure for demonstrating the effect of abnormality detection result correction | amendment. The figure for demonstrating the necessity of abnormality detection result correction | amendment. The example of the flowchart of the similarity determination in FIG. The figure for demonstrating an example of coordinate-ization of time series information. The figure for demonstrating an example of the effect of similarity determination. The figure for demonstrating the example of similarity determination operation | movement. The example of the flowchart of the operation assistance calculation in FIG. The figure for demonstrating an example of the implementation method of operation assistance calculation. FIG. 6 is a diagram for explaining an example of a display unit according to the first embodiment. The figure which shows the example of a system | strain stability monitoring system. The block diagram at the time of calculating each parameter by artificial intelligence. The figure which shows the example of the flowchart of parameter calculation artificial intelligence.

  Embodiments of the present invention will be described below with reference to the drawings.

  Example 1 is a figure which shows the whole system structure when the abnormality detection apparatus of this invention is applied to a system | strain stability monitoring apparatus.

  The system stability monitoring apparatus 1 shown in FIG. 1 includes at least a plurality of databases DB11 and DB12, a similarity determination unit 7, a driving support calculation unit 7, and an abnormality detection device 9. The abnormality detection device 9 detects various time-series input abnormalities used in the system stability monitoring device 1, and gives presence / absence of abnormality information and a corrected input.

  The abnormality detection device 9 includes a plurality of databases DB2, DB3, DB4 and a plurality of processing units. For example, values such as current and voltage measured at various places in the power system are input to the abnormality detection device 9 as time-series information D1. An example of the time series information D1 is illustrated in FIG. 4 and will be described later. The input time series information D1 is calculated by the change value calculation unit 2 as a difference between the previous input and the current input. Examples of processing contents and processing results of the change value calculation unit 2 are illustrated in FIGS. 5 and 6 and will be described later.

  The normal determination reference value database DB2 stores normal determination reference values in advance, and the analysis time frame adjustment unit 3 adjusts the analysis time frame from the change value and the normal determination reference value. Examples of processing contents, normality determination reference values, and processing results of the analysis time frame adjustment unit 3 are illustrated in FIGS. 7, 8, and 9, which will be described later.

  The statistical reference value database DB3 stores statistical reference values in advance, and the statistical abnormality detection unit 4 detects input abnormality from the statistical reference value and the analysis time frame. Examples of processing contents, statistical reference values, and processing results of the statistical abnormality detection unit 4 are illustrated in FIGS. 10a, 10b, 11a, and 11b, which will be described later.

  Correction parameters are stored in advance in the correction parameter database DB4, and the abnormality detection result correction unit 5 corrects the abnormality detection result from the abnormality detection result and the correction parameter. Examples of processing contents, correction parameters, and processing results of the abnormality detection result correction unit 5 are illustrated in FIGS. 12, 13, 14a, and 14b, which will be described later. The correction result is displayed on the display unit 8.

  The abnormality detection device 9 of FIG. 1 is configured as described above, and the correction result finally obtained is sent to the system stability monitoring device 1 for use. The past case database DB12 of the system stability monitoring apparatus 1 stores past cases, and the past time series information database DB11 stores time series information (past time series information) detected in the past.

  The similarity determination unit 6 uses the correction result of the abnormality detection result obtained by the abnormality detection device 9, the storage content of the past case database DB 12 and the storage content of the past time series information database DB 11 as inputs, and is obtained by the abnormality detection device 9. The similarity between the latest abnormal case and the extracted past case is determined. An example of the processing content and the processing result of the similarity determination is illustrated in FIGS. 15, 16a, 16b, and 17, which will be described later.

  The operation support calculation unit 7 that receives the similarity determination result calculates an operation support measure and displays one or more of the results on the display unit 8. Examples of processing contents and processing results in the operation support calculation unit 7 are illustrated in FIGS. 18 and 19, and display examples in the display unit 8 are illustrated in FIGS. 20 and 21, which will be described later.

  FIG. 2 is a diagram illustrating a hardware configuration of the system stability monitoring device 1 and an example of the overall configuration of the power system 12. The power system 12 includes a measuring instrument 10a and a measuring instrument 10b (hereinafter simply referred to as a measuring instrument 10). The measuring instrument 10 measures a measured value in the power system, and uses the measurement result as time-series information D1 to establish a communication network. 11 to the communication unit 92 of the system stability monitoring device 1. The measured value D1 received by the system stability monitoring device 1 is held in the memory 93.

  Here, the measuring instrument 10 is a PMU (Phaser Measurement Units), a VT (Voltage Transformer), a PT (Potential Transformer), a CT (Current Transformer), or a telemeter (TM: Telemeter). Equipment and measuring devices. The measuring device 10 may be a measurement value aggregation device installed in the power system, such as SCADA (Supervision Control And Data Acquisition).

  Here, the time series information D1 that is a measurement value is data related to the power system measured by the measuring instrument 10, and is either one of voltage or current that is power information with synchronization time using GPS or the like, or There are multiple. The time series information D1 may include a unique number for identifying data and a time stamp.

  The configuration of the system stability monitoring apparatus 1 will be described. The system stability monitoring apparatus 1 is configured as a computer system, and includes a plurality of databases DB, a CPU 91, a memory 93, a communication unit 92, an input unit 94, a display unit 8, a bus 13, and the like.

  As the plurality of databases DB, a normal determination reference value database DB2, a statistical reference value database DB3, a correction parameter database DB4, a detection result database DB6, and an abnormality detection program database DB13 are provided for abnormality detection processing. For system stability processing, a similarity determination program database DB7, an operation support program database DB8, a past time series information database DB11, and a past case database DB12 are provided. The database DB and various components are connected to each other via a bus 13.

  The display unit 8 may be configured to use a printer device, an audio output device, or the like instead of the display device or together with the display device.

  For example, the input unit 94 can be configured to include at least one of a keyboard switch, a pointing device such as a mouse, a touch panel, and a voice instruction device. The input unit 94 may be a user interface other than the above.

  The communication unit 92 includes a circuit and a communication protocol for connecting to the communication network 11.

  The CPU 91 reads a predetermined computer program from each program database and executes it. Here, each program database refers to an abnormality detection program database DB13, a similarity determination program database DB7, and an operation support program database DB8. The CPU 91 may be configured as one or a plurality of semiconductor chips, or may be configured as a computer device such as a calculation server.

  The memory 93 is configured as a RAM (Random Access Memory), for example, and stores a computer program read from each program database, and stores calculation result data and image data necessary for each process. The screen data stored in the memory 93 is sent to the display unit 8 and displayed.

  Here, the contents stored in each program database will be described. First, each program necessary for detecting an abnormality is stored in the abnormality detection program database DB13. Each program necessary for abnormality detection is one or more of a change value calculation program Pr2, an analysis time frame adjustment program Pr3, a statistical abnormality detection program Pr4, and an abnormality detection result correction program Pr5. The similarity determination program database DB7 stores a program for extracting similar past cases and past time series information from input data. The operation support calculation program database DB8 stores a program for performing operation support based on similar past cases.

  In the CPU 91, each calculation program read from each program database to the memory 93 is executed, change value calculation, analysis time frame adjustment, statistical abnormality detection, abnormality detection result correction, similarity determination, operation support calculation, display Processing such as an instruction of image data to be performed, search of data in various databases, and the like are performed.

  The memory 93 is a memory for temporarily storing time series information D1, display image data, calculation temporary data such as calculation result data, and calculation result data. The CPU 91 generates necessary image data by the CPU 91 and displays the display unit 8 ( For example, it is displayed on a display screen. In the arithmetic processing, the physical memory of the memory 93 is used, but a virtual memory may be used.

  The system stability monitoring device 1 stores eight databases roughly divided as described above. Of these, the contents stored in other databases except for the program databases DB7, DB8, and DB13 are as follows.

  The normal determination reference value database DB2 stores reference values for analysis time frame adjustment, the statistical reference value database DB3 stores statistical reference values, the correction parameter database DB4 stores parameters for correction of detection results, and a past time series The information database DB11 stores past time series information, and the past case database DB12 stores past abnormality detection results. Examples of each data will be described later.

  Next, calculation processing contents of the system stability monitoring apparatus 1 will be described with reference to FIG. FIG. 3 is an example of a flowchart showing the entire processing of the system stability monitoring apparatus 1. The contents of processing step S1 to processing step S8 will be described.

  First, in processing step S <b> 1, time series information D <b> 1 is read from the memory 93. Here, the time-series information D1 input using FIG. 4 will be described. In the example of FIG. 4, a change example of the voltage and frequency of the power system is shown as the time series information D1 input in units of 33.3 milliseconds after 17:00:12 on January 23, 2016.

  In this embodiment, the time series information D1 uses a measured value in the power system, that is, a measured value of the PMU. If the information is accumulated along the time series, the measurement value of SCADA may be used instead of the measurement value of PMU, a plurality of information may be accumulated for each time section as shown in FIG. It may also be information other than power system information. Further, the time series information D1 may be read in a streaming format one column at a time. In the embodiment of FIG. 4, the emphasis is placed on the Voltage (frequency) and Frequency (frequency) in the PMU data, and it is assumed that they are input in a streaming format for real-time operation. That is, it is a premise that measurement values are input to streaming in system operation.

  Returning to FIG. 3, in the processing step S2, a change value of the time series information D1 is calculated. Here, the process step S2 will be described in detail with reference to FIG. First, in processing step S201, time series information D1 is read. Next, in processing step S202, a change value of the read time series information D1 is calculated. The change value is calculated using differentiation or integration, and as the change value, one or more of a difference between the differentiation value and the integration value, or a difference from the most recent data is used. Finally, in step S203, this change value is output. In the following description of this embodiment, the difference from the latest data is used as the change value.

  Here, an example of the output of the processing step S2 will be described with reference to FIG. In the time-series information D1 in FIG. 4, the change values of the PMU voltage and frequency are accumulated in each time section. In this embodiment, since the time series information D1 is input in the streaming format, the output of the change value is also output line by line in the streaming format. That is, when the information of the time section “2016/01/23 17: 00: 12.033” in FIG. 4 is read in the change value calculation unit, the change value is calculated in this time section. In FIG. 6, the change value of the time section “2016/01/23 17:00: 12.000” before the information is read is set to 0 because there is no latest data.

  Returning to FIG. 3, in the processing step S3, the analysis time frame that becomes the input value of the processing step S4 is adjusted. Here, the processing step S3 will be described in detail with reference to FIG. In process step S301, various information is read from the memory 93 and each database. The various information includes a change value that is an output result of the processing step S2 and a normal determination reference value stored in the normal determination reference value database DB2.

  Here, the storage contents of the normal determination reference value database DB2 will be described with reference to FIG. The normal determination reference value includes a data type, a maximum change value, a standard value, and an adjustment value. In the example shown in FIG. 8, the data type is “Voltage” or “Frequency” in PMU_A. There is a maximum change value, a standard value, and an adjustment value for each data type. In the example of FIG. 8, the maximum change value, standard value, and adjustment value for Voltage are 0.010 and 300.150, respectively, and the maximum change value, standard value, and adjustment value for Frequency are 0.015, respectively. 600 and 150. There is no restriction on the distinction of the data type, and the distinction may be made by the period of the time series information D1 or the type of measuring instrument (PMU or SCADA).

  The standard value and the adjustment value in the normal determination reference value database DB2 correspond to the number of data, that is, the number of time sections in the time series information D1. For example, when the analysis frame is 300, which is the standard value of PMU_A (Voltage), the latest 300 lines are set as the analysis target.

  Returning to FIG. 7, in the process step S302, the input change value of the time series information D1 is compared with the maximum change value in each data type of the normal determination reference value database DB2. If the absolute value of the change value exceeds the maximum change value, the process proceeds to process step S304, and if not, the process proceeds to process step S303.

  In processing step S304, the analysis time frame is set to the adjustment value. This is the adjustment value for each data type. For example, when the change value of PMU_A (Voltage) exceeds the maximum change value, 150 is set as the adjustment value of PMU_A (Voltage), and then the process proceeds to processing step S305.

  In processing step S303, the analysis time frame is set to 300 which is a standard value, and the process proceeds to processing step S305. In processing step S305, an analysis time frame is output in each time section. According to this process, when the change value of PMU_A (Voltage) exceeds the maximum change value, the analysis time frame is set short, and when the maximum change value is not exceeded, the analysis time frame is set long. become.

  Here, the output of the processing step S3 will be described with reference to FIG. Since the output analysis time frame is a kind of time-series information D1, the analysis time frame in each time section is output for each data type as shown in FIG.

  Note that the series of analysis time frame calculation in the processing step S3 may be calculated for all time sections or periodically. Moreover, the analysis time frame adjusted once may be fixed under a certain condition. For example, the analysis time frame once set as the adjustment value may be fixed for a certain period. As a result, the analysis time frame can be prevented from alternating between the adjustment value and the reference value in a short period, and the detection accuracy can be maintained.

  Returning to FIG. 3, in processing step S4, an abnormality is detected by a statistical method. The statistical detection method is performed in accordance with the method described in Non-Patent Document 1, for example. Here, details of the processing step S4 will be described with reference to FIG. 10a. In processing step S401, various information is read into the memory 93. Here, the various types of information are statistical reference values stored in the statistical reference value database DB3, time series information D1, and the analysis time frame calculated in the processing step S3.

  Here, the statistical reference values stored in the statistical reference value database DB3 will be described with reference to FIG. The statistical reference value database DB3 has a threshold value α and a threshold value β for each data type. α is a threshold value in the information distribution, and β is a threshold value in continuity. In the example of FIG. 10B, when the data type is PMU_A (Voltage), for example, the threshold α is 1 and the threshold β is 2, and when the data type is PMU_A (Frequency), for example, the threshold α is 1.2 and the threshold β is It is set to 1. The method of using the threshold value α and the threshold value β will be described later in processing step S403 and processing step S406.

  Returning to FIG. 10a, in processing step S402, an average value and a standard deviation within the analysis time frame are calculated for the time series information D1. For example, when the analysis time frame is 300, an average value and a standard deviation of a plurality of time series information D1 obtained within this period are calculated. Even when 150 is designated as the analysis time frame, the average value and standard deviation of the plurality of time series information D1 obtained within this period are calculated.

  Next, in processing step S403, the degree of abnormality of the latest time series information is determined. The latest time series information is the latest time series information D1 received during this series of calculations. When the analysis time frame is 300 and 300 continuous time series information D1 is obtained, the time series information D1 input last is the latest time series information. In the process of process step S403, if the latest time series information is a 留 times the standard deviation from the average value, the process proceeds to process step S404, and if not, the process proceeds to process step S405.

  Here, the state where the latest time series information is within α times the standard deviation from the average value is considered normal, and the state where the latest time series information is more than α times the standard deviation from the average value is considered abnormal. In process step S404, the latest time series information processed in process step S403 is accumulated in the abnormality candidate queue, and the process proceeds to process step S406. Conversely, in process step S405, the abnormal candidate queue is deleted, and the process proceeds to process step S48.

  In processing step S406, it is confirmed whether there are consecutive abnormality candidates. If time series information is accumulated β times or more in the abnormality candidate queue, the process proceeds to step S407. In processing step S407, the abnormality detection signal is output together with the time series information D1. In processing step S408, a normal signal is output together with the time-series information D1.

  Here, the process flow of process step 4 will be conceptually described with reference to FIG. In FIG. 11a, an example of PMU_A (Voltage) is shown in the upper part of the graph as time on the horizontal axis and time series information D1 on the vertical axis. The time-series information obtained by measuring PMU_A (Voltage) is shown as time-series information E1, and the time range indicated by the dotted line is the analysis time frame F. In any analysis time frame F, for example, the analysis time frame is 300, and 300 continuous time-series information D1 is obtained. Therefore, the latest time series information T1 at the time of the analysis time frame F1 is a value at the time t1, and the latest time series information T2 at the time of the analysis time frame F2 is a value at the time t2, and is the latest at the time of the analysis time frame F3. The time series information T3 is a value at time t3. However, the analysis time frame F3 represents a state immediately after (next time) the analysis time frame F2. In this case, the time series information E1 is repeatedly fluctuated, but the latest time series information T2 and T3 measure a continuous increase that is unprecedented until the continuous time t2 and t3.

  In the lower part of FIG. 11a, a distribution situation W by 300 time series information D1 obtained in the analysis time frame F is shown. The distribution situation W is represented by, for example, an average value μ and a standard deviation σ. The distribution status W1 represents, for example, a probability density function in the analysis time frame F1 before occurrence of an abnormality, and the latest time series information T1 in this case is assumed to be at the position of the standard deviation σ. The distribution statuses W2 and W3 represent probability density functions, for example, in the analysis time frames F2 and F3 after the occurrence of an abnormality. In this case, the latest time series information T2 and T3 exist at a position larger than the standard deviation σ. doing. The latest time series information T2 and T3 are continuously present at a position larger than the standard deviation 2σ.

  Thus, time sections t1 to t3 are shown in FIG. 11a. The time section t1 represents before the occurrence of the fluctuation, the time section t2 represents the time when the fluctuation occurred, and the time section t3 represents the time when the fluctuation was detected. In each time section, the probability density functions W1, W2, W3 within the analysis time frame are shown in the lower part of FIG. 11a. What extracted only these important information is processing step S402.

  According to the probability density function W1, a probability density function similar to a normal distribution is set in the time section t1 before the occurrence of fluctuation. Here, the main purpose of power system operation is to maintain the voltage and frequency within a certain range, and therefore, it is assumed that there is a high possibility that the power system operation is similar to a normal distribution in a stable system state. A normal distribution may be assumed in this way, but other distributions may be assumed.

  The probability density function changes from the normal distribution at the time section t2 when the fluctuation occurs. This is because the system state changes outside the normal distribution because the system state deviates from the stable system state in the event of a system failure. Here, if a point that is α times the standard deviation σ from the average value that is the central value of the probability density function is detected, it is determined as an abnormality detection candidate. Here, the standard deviation σ × α is a threshold value. This is processing of processing step S403 and processing step S404. When the abnormality detection candidate detected at the time section t2 exceeds the threshold α × σ β times continuously as in the time section t3, abnormality detection is performed. This corresponds to process step S406. Thereafter, an abnormality detection signal is output together with time-series information in processing step S47. On the other hand, if the state returns to the state of the time section t1 before exceeding β times, the abnormality is not detected and a normal signal is output together with the time series information. This corresponds to processing step S48.

  As described above, the parameter α, the parameter β, and the analysis time frame used in the processing step S4 play an important role in abnormality detection. If the analysis time frame is expanded, a probability density close to a normal distribution can be obtained, but calculation time and calculation load increase. Therefore, it is possible to reduce the calculation time and the calculation load by effectively extracting places where there is a high possibility that the time series information is abnormal in the processing steps S2 and S3. Also, the detection accuracy can be adjusted by adjusting α and β. For example, system noise can be reduced by setting α and β high.

  Next, the output of processing step 4 will be described with reference to FIG. The abnormality detection result in FIG. 11b is the abnormality detection signal and the normal signal output in processing step S407 and processing step S408. In FIG. 11b, the abnormality detection signal 407 is represented by “1” and the normal signal 408 is represented by “0”. However, the abnormality detection signal and the normal signal such as “T”, “F”, “Yes”, “No”, etc. It only needs to be distinguished.

  Returning to FIG. 3, the processing step S5 will be described. In processing step S5, the abnormality detection result is corrected. Here, the abnormality detection result correction will be described with reference to FIG. In processing step S501, the time series information D1, the abnormality detection result, and the correction parameters stored in the correction parameter database DB4 are read into the memory 93.

  Here, an example of the correction parameter will be described with reference to FIG. In the correction parameter database DB4, as in the normal determination reference value database DB2 and the statistical reference value database DB3, the numerical value of the correction section G1 is set for each data type. In the case of FIG. 13, the correction section G1 is set to 3 for the data type PMU_A (Voltage) and 4 for the data type PMU_A (Frequency). In this case, the time series information D1 obtained continuously is set such that three consecutive data or four consecutive data is set as the correction section G1.

  Returning to FIG. 12, in processing step S502, the position of the normal signal is examined for three consecutive data or four consecutive data in the correction section G1. If the normal signal in the correction section G1 is sandwiched between the abnormality detection signals, the process proceeds to processing step S503, and if not, the process proceeds to processing step S504. In processing step S503, the normal signal sandwiched between the abnormality detection signals in the correction section G1 is corrected to the abnormality detection signal, and the process proceeds to processing step S505. In process step S504, the detection result is bypassed, and the process proceeds to process step S505. The bypass process is to pass data without correcting the detection result. In processing step S505, the time series information and the corrected abnormality detection result are output.

  FIG. 14A is a diagram for explaining the effect of the abnormality detection result correction. The specific processing content of processing step S502 to processing step S504 will be described with reference to FIG. In FIG. 14a, an example of the abnormality detection result of PMU_A (Voltage) and PMU_A (Frequency) in this embodiment is described in time series. A transition example of the time-series abnormality detection result of PMU_A (Voltage) is “0-0-0-1-1”, and a transition example of the time-series abnormality detection result of PMU_A (Frequency) is “0-1”. −0-1-0 ”. In FIG. 14a, three consecutive data sections 502a are described as the correction section G1 for PMU_A (Voltage), and four consecutive data sections 502b are described as the correction section G1 for PMU_A (Frequency).

  The position of the normal signal 0 is examined with respect to the relationship between 1 and 0 of three consecutive data or four consecutive data in the correction section G1. As a result, if the normal signal in the correction section G1 is sandwiched between the abnormality detection signals, the normal signal 1 sandwiched between the abnormality detection signals 0 in the correction section G1 is corrected to the abnormality detection signal 0. I do. The state after this processing is shown in the lower part of FIG. 14a, and the transition example of the time-series abnormality detection result of PMU_A (Frequency) is initially “0-1-0-1-0”. , “0-1-1-1-0”.

  Thus, in each time section, abnormality detection correction is performed based on the abnormality detection result in the correction section G1. In 502a, the correction section is for three time sections, whereas in 502b, the correction section is for four time sections. In both sections, the abnormality detection signal and the normal signal are mixed, but in 502a, the abnormality detection signal maintains continuity so that no normal signal is sandwiched therebetween, whereas in 502b, the abnormality detection signal “1” is present. ”Indicates a normal signal“ 0 ”. The correction result of 502a is 504, and the correction result of 502b is 503.

  These correction processes correspond to processing step S504 and processing step S503. As a result, the normal signal is not corrected in processing step S504, and the normal signal is corrected to an abnormality detection signal in processing step S503. By such detection result correction processing in step S5, a detection omission such as a time section “2016/01/23 17:00: 12.100” of the abnormality detection result of PMU_A (Frequency) can be corrected. effective.

  Next, an example in which correction processing is required in processing step S5 will be described with reference to FIG. As a phenomenon specific to the power system, there is a swing phenomenon. The time series information E2 is a measurement value of PMU_A (Voltage) during the swing phenomenon. When the process of step S4 is performed on the swing phenomenon, that is, the fluctuation of the measured value due to the increase or decrease of the output of the generator, the normal threshold and the abnormality detection signal are detected as the abnormality detection result H1 because the statistical threshold value is alternately crossed. Will be issued alternately. That is, when the correction process in step S5 is not performed, the time series information E2 when the swing phenomenon occurs is detected as a plurality of abnormalities instead of a single abnormality. By using the processing step S5, it is possible to correct the detection omission part as the correction part H2 and detect it as one abnormality, and it is effective for the operator to more easily understand the abnormality detection.

  Next, returning to FIG. 3, in step S6, similarity determination is performed. Details of the processing step S6 will be described using the processing flow of FIG.

  In processing step S601, time series information D1, detection results, past cases stored in the past case database DB12, and the like are read into the memory 93. In processing step S602, the time-series information D1 of the detected part is converted into a coordinate value. Here, conversion to coordinate values will be described with reference to FIG. In FIG. 16a, the portion of the PMU_A (Frequency) where an abnormality is detected is 602a. As in the part 602a, the time series information D1 in which the abnormality is detected is converted as a coordinate value as in 602b. When converting the time series information D1, the information is coordinated. That is, the time series information D1 is converted into a coordinate value and expressed as a coordinate in the N-dimensional space. The conversion processing to the coordinates is performed by coordinating both the importance and the pattern, such as a Pony analysis that can obtain the attenuation rate and frequency of the time series information D1 indicating the importance, a multiple regression analysis that represents the pattern, and the like. May be used.

  Returning to FIG. 15, a past case similar to the converted information is extracted from the past case database DB 12 in processing step S603, and the degree of similarity of the extracted past case is determined in processing step S604. FIG. 16b is a diagram for explaining an example of the effect of similarity determination. An example of processing in processing step S603 and processing step S604 will be described with reference to FIG. The past case database DB12 stores time-series information D1 that has been coordinated in the same manner as the processing in step S602, and control measures for that period. In processing step S603, similar past cases are extracted by identifying the coordinates closest to the data coordinated in processing step S602 from the past case database DB12. In step S604, the similarity is determined based on the distance between the coordinates.

  Returning to FIG. 15, in step S605, the detected part is stored in the past case database DB12. In step S606, the similar past case and the similarity determination result are output. FIG. 17 is a diagram for explaining an example of the similarity determination operation. Here, an example of a specific implementation method of the processing step S605 and the processing step S606 will be described with reference to FIG.

  In FIG. 17, 602c and 602d are analysis time frames in different time sections for the same abnormality. In 602c, there is a multiple regression analysis result 602e expressed as a coordinate value, and in 602d there is a multiple regression analysis result 602f as well. From the multiple regression analysis result 602e and the multiple regression analysis result 602f, even if the abnormality is the same, the coordinate values are different if the time section is different. Therefore, it is necessary to always convert the coordinate value to the detected abnormality. Accordingly, it is necessary for the similarity determination unit to repeat the operation of extracting the coordinated time series information from the past case according to the frequency with which the time series information is read. Therefore, the past case database DB12 should be a high-speed database. If similarity determination cannot be performed according to the reading frequency, the frequency of similarity determination may be lowered.

  Next, returning to FIG. 3, in step S7, an operation support measure is calculated. Here, an example of the processing in step S7 will be described with reference to FIG. In processing step S701, the similar past case, the similarity determination result, and the past time series information stored in the past time series information database DB11 are read into the memory 93. In processing step S702, information immediately after the similar past case is extracted from the past time series information database DB11. In processing step S703, the stability is evaluated from the extracted information. In the power system operation of the present embodiment, an example is given in which the stability is evaluated using a period of staying in a stable area with a voltage or frequency. In processing step S704, similar information, a similarity determination result, a control measure, and a post-control measure stability are output based on the magnitude of the stability. The processing in step S7 may be performed according to the reading frequency of the time-series information D1 as in the similarity determination unit, or may be performed after a certain time has elapsed after the abnormality is detected.

  Here, an example of calculation of the operation support measure will be described with reference to FIG. A control measure 701b at the time of abnormality detection is recorded in the similar past case 701a, information immediately after the control measure 701b linked to the control measure 701b is extracted from the past time series information database DB11, and the stability evaluation 703 is executed. The stability evaluation 704 and the control measure 701b are output. Thereby, the operator can easily confirm the effectiveness of the control measure 701b by the stability evaluation 704. A combination of the stability evaluation 704 and the control measure 701b is used as an operation support measure. Further, the control measure 701b of the operation support measure is not based on past cases but may be calculated based on system data.

  Returning to FIG. 3, in the processing step S8, information on the apparatus is displayed. The display unit reads the time-series information D1, the corrected abnormality detection result, the similar past case, the similarity determination result, and the control measure stability into the memory 93. Here, an example of the display unit 8 will be described with reference to FIG. On the display screen 805, time series information and similar past cases 8051 are displayed in a graph, and a graph index 8052 is provided. The similar case list 8053 displays similar past cases, control measure cases, and post-control measure stability. In the analysis time frame 8054, the range of the corrected abnormality detection result is displayed. By displaying the similarity, control measures, and stability after control measures in the similar case list 8053, the operator can confirm the past case closest to the current abnormality and the control at that time and its effectiveness. There is. In addition, the operator can monitor the display unit to enable operation using the knowledge of past cases.

  Regarding the similar case list 8053, the similar case list displayed here may display the control measures at the same time. The similar case may be displayed in the same manner as the symbol of the data item described in FIG. For the control measure case, it is preferable to display a symbol of a case index for storing the control measure. The post-control countermeasure stability is assumed to display an expected value, and it is preferable to perform stability analysis in advance and store it in association with the control countermeasure.

  Here, an example of a use case of the voltage stability monitoring apparatus 1 will be described with reference to FIG. The system stability monitoring system includes, for example, a control device OS1, a wide area monitoring device OS2, and a voltage stability monitoring device 1 in a control room that operates the system. When an abnormality is found in the wide area monitoring device OS2, the system operator uses the control device OS1 to stabilize the system.

  However, it is difficult for the wide-area monitoring device OS2 to properly operate the control device OS1. As an example, when a fluctuation occurs in the power system, the convergence method of the fluctuation cannot be determined only by the wide area information. Therefore, the voltage stability monitoring device 1 in this embodiment is advantageous in that it displays specific operation support that is not displayed by the wide area monitoring device OS2 or the like by being installed in the vicinity of the control device OS1. In addition, the voltage stability monitoring device 1 can be added later to a control room in which the existing control device OS1 and the wide area monitoring device OS2 are installed. In this case, since the modification to the existing system can be minimized, it is possible to easily add the voltage stability monitoring device 1.

  The second embodiment is a configuration example when the parameters of the first embodiment are calculated by artificial intelligence. FIG. 22 shows a block diagram of the second embodiment. In the configuration example of FIG. 22, various databases are combined with the parameter calculation artificial intelligence AI1, for example, data is read from the past time series information DB11 and the past case DB12, and the normal determination reference value database DB2, the statistical reference value database DB3, It outputs to correction parameter database DB4, It is characterized by the above-mentioned. Other parts are not different from the system stability monitoring apparatus 1 of FIG.

  In the second embodiment, the past time series information D11 in the past time series information database DB11 and the past case DB 12 in the past case database DB12 are used for calculation of each parameter. Specific processing of the second embodiment will be described with reference to FIG.

  In FIG. 23, time series information D11 and a past case D12 are input at processing step AIS1. Processing step AIS2a and processing steps AIS2b and AIS2c are processed in parallel.

  In processing step AIS2a, an average abnormal duration in each data type of the past case D12 is calculated. In the processing step AIS2b, a probability density function is calculated from the change value of the past time series information D11. In the processing step AIS2b, the probability density function of the past time series information D11 is calculated.

  Using processing steps AIS2a to AIS2c, a normal determination reference value D2, a statistical reference value D3, and a correction parameter D4 are calculated in processing step AIS3. The maximum change value of the normal determination reference value D2 is calculated using the result of the processing step AIS2b, and the standard value and the adjustment value are calculated using the result of the processing step AIS2a. The statistical reference value D3 is calculated using the result of the processing step AIS2c. The correction parameter D4 is calculated using the result of AIS2a.

  In processing step AIS4, a normal determination reference value D2, a statistical reference value D3, and a correction parameter D4 are output.

  An advantage of the parameter calculation artificial intelligence AI1 is to facilitate the setting of the parameters and reference values used in the first embodiment. Originally, various parameters are difficult to set unless expert knowledge is used. By using parameter calculation artificial intelligence AI1, expert knowledge can be simulated based on mathematics and statistics from past time series information D11 and past case D12, and parameters and reference values can be easily used Can be calculated.

1: System stability monitoring device 2: Change value calculation unit 3: Analysis time frame adjustment unit 4: Statistical abnormality detection unit 5: Abnormality detection result correction unit 6: Display unit 7: Similarity determination unit 8: Operation support calculation unit 9: System stability monitoring device 10: Measuring instrument 11: Communication network 12: Power system 91: CPU
92: Communication unit 93: Memory 94: Input unit D1: Time series information DB 2: Normal determination reference value database DB 3: Statistical reference value database DB 4: Correction parameter database DB 11: Past time series information DB 12: Past case DB 13: Abnormality detection program database

Claims (18)

An anomaly detection device that detects an anomaly value of time series information,
An input unit for inputting the time series information;
A change value calculation unit for calculating a change value of the time series information;
With the change value and normality determination reference value as inputs, an analysis time frame adjustment unit that determines an analysis time frame;
An abnormality detection apparatus comprising: a statistical abnormality detector that determines an abnormality of the latest time-series information and gives an abnormality detection result by statistical processing on the time-series information within the analysis time frame. The abnormality detection apparatus according to claim 1,
The abnormality detection device, wherein the change value calculation unit calculates a change value by using one or more of a difference between a differential value or an integral value, a difference from the latest data, and the like. The abnormality detection device according to claim 1 or 2,
The analysis time frame adjustment unit compares the change value with a maximum change value set as the normality determination reference value, and sets the analysis time frame short when the change value is larger than the maximum change value, and serves as an input. When the change value is smaller than the maximum change value, the analysis time frame is set to be long. The abnormality detection device according to any one of claims 1 to 3,
The statistical type abnormality detection unit determines an abnormality of the latest time-series information by statistical processing with a statistical reference value as an input. The abnormality detection device according to any one of claims 1 to 4,
Anomaly detection results in the statistical anomaly detection unit are sequentially obtained with respect to the latest time-series information, and the anomaly detection results are corrected in accordance with occurrence patterns of a plurality of anomaly detection results within a continuously obtained correction section An abnormality detection device comprising an abnormality detection result correction unit. The abnormality detection device according to any one of claims 1 to 5,
An abnormality detection apparatus comprising: a display unit that displays one or more of each abnormality detection result in the statistical abnormality detection unit. The abnormality detection device according to any one of claims 1 to 6,
The abnormality detection device, wherein the normal determination reference value is differentiated by a data type such as a period of the time series information and a type of measuring instrument. The abnormality detection device according to any one of claims 1 to 7,
The analysis time frame adjustment unit is an analysis time frame adjustment unit that calculates an analysis time frame for all time sections or periodically. The abnormality detection device according to any one of claims 1 to 7,
The abnormality detection device, wherein the analysis time frame adjustment unit is an analysis time frame adjustment unit that fixes the analysis time frame under a certain condition. The abnormality detection device according to any one of claims 1 to 9,
The anomaly detection apparatus, wherein the statistical anomaly detection unit outputs a detection result capable of distinguishing between an anomaly detection signal and a normal signal. A system stability monitoring device that uses an abnormality detection result obtained in the abnormality detection device according to any one of claims 1 to 10,
The past case database that holds past cases, the past time series information database that holds past time series information, and the past cases similar to the abnormality detection result using the abnormality detection result obtained in the abnormality detection device, A systematic stability monitoring apparatus, comprising: a similarity determination unit that extracts time-series information immediately after the past case. The system stability monitoring device according to claim 11,
A system stability monitoring apparatus comprising: an operation support calculation unit that receives an extraction result of the similarity determination unit and calculates an operation support measure. The system stability monitoring device according to claim 11 or 12,
The similarity determination unit coordinates the time series information using one or more of importance and patterns, and a system stability monitoring apparatus. The system stability monitoring apparatus according to any one of claims 11 to 13,
The system stability monitoring apparatus, wherein the similarity determination unit performs similarity determination at a frequency equal to or less than a frequency of reading time-series information. The system stability monitoring device according to claim 12 ,
The system support monitoring device, wherein the operation support calculation unit calculates operation support synchronously or asynchronously with reading of time series information. The system stability monitoring apparatus according to any one of claims 11 to 15,
The system stability monitoring apparatus includes a display unit, and the display information in the display unit is one or more of the time-series information, similar past case data, graph index, similar case list, control countermeasure example, and post-control countermeasure stability. System stability monitoring device characterized by displaying The system stability monitoring device according to any one of claims 11 to 16, wherein
A system stability monitoring apparatus, characterized in that, based on a past time series information database and a past case database, parameter determination artificial intelligence sets normal judgment reference values, statistical reference values, and correction parameters.   A system stability monitoring system comprising the system stability monitoring apparatus according to any one of claims 11 to 17 in a control room for system operation.

Images