KR102547605B1 - Method for calculating dynamic threshold value - Google Patents

Abstract

Disclosed is a dynamic threshold calculation method for each data section in which the n^th dynamic threshold is calculated using the n^th data, and the current threshold is set by comparing the past average threshold with the n^th dynamic threshold. It is possible to minimize the probability of non-detection of abnormal conditions of the driving target.

Description

Dynamic threshold calculation method for each data section {METHOD FOR CALCULATING DYNAMIC THRESHOLD VALUE}

The present invention relates to a method for calculating a dynamic threshold for each data section, and more particularly, to a method for receiving data in real time and calculating a dynamic threshold that changes for each data section.

Conventionally, various facilities exist in industrial facilities such as plants, operation data is generated according to the operation of the facilities, and operation data is analyzed to determine whether there is an abnormality in the industrial facilities, and an early warning is generated if there is an abnormality.

For example, as in Patent Document 1 or Patent Document 2, it is possible to generate an alarm whether there is an abnormality in an industrial facility by using the actual measured value and expected value (or predicted value) of operation data.

Patent Literature 1 is a method of determining a tag index using an actual measured value and a predicted value, and specifying an alarm by indexing the tag index. Patent Literature 2 is a method of comparing an actual value or residual with a set value (or threshold) and setting an alarm rule corresponding to the number of times out of the range of the set value.

However, conventionally, when the method of Patent Document 1 or Patent Document 2 is used, there is a problem in that invalid early warning occurs too much.

Korean Patent Publication No. 10-2013-0042523 Korean Patent Publication No. 10-2017-0125237

In order to solve the above problem, the present invention calculates the n-th dynamic threshold using the n-th data, compares the past average threshold and the n-th dynamic threshold to set the current threshold, and calculates the dynamic threshold for each data section. provides a way

A method for calculating a dynamic threshold value for each data section according to an embodiment of the present invention for the above object to be solved includes calculating an n-th dynamic threshold value using n-th data; generating a past average threshold by calculating an average of the first through n-1th dynamic thresholds; comparing the past average threshold with an n-th dynamic threshold to determine whether a threshold needs to be corrected; If it is determined that the threshold correction is unnecessary, the n-th dynamic threshold is set as the current threshold, and if it is determined that the threshold correction is necessary, the correction threshold to which the past average threshold and the n-th dynamic threshold are applied is set as the current threshold. and calculating an n+1th dynamic threshold using the n+1th data.

The calculating of the n-th dynamic threshold may include: calculating a residual between an actual value and an expected value using the n-th data; calculating an average and a deviation of the residuals; setting the first initial value and the j-th maximum value of the coefficient; setting an initial threshold calculated as an initial value of the mean, deviation, and coefficient of the residual; calculating a score for an initial value of a coefficient using an average and a deviation of residuals for values smaller or larger than the initial threshold value; Calculating scores up to the maximum value of the coefficients, selecting a coefficient corresponding to the score having the maximum value among a plurality of scores as an optimal coefficient, and setting an n-th dynamic threshold using the optimal coefficient. It can be characterized by including.

The setting of the current threshold may include determining that the n-th dynamic threshold exceeds a correction condition value in comparison with the past average threshold value as correction of the threshold value, and determining the correction of the threshold value as the past average threshold value. calculating a first value obtained by applying a correction condition value to a value, calculating a second value obtained by applying a correction contrast value to an n-th dynamic threshold value, and setting the sum of the first value and the second value to a current threshold value; It can be characterized by including.

The present invention can minimize the non-detection rate for an abnormal state of a driving target and reduce the number of invalid early warnings by providing a dynamic threshold value that varies for each data section.

1 is a block diagram illustrating an alerting device using a dynamic threshold according to an embodiment of the present invention.
2 is a flowchart illustrating a dynamic threshold calculation method for each data section according to an embodiment of the present invention.
FIG. 3 is a flowchart illustrating in detail a method for calculating the n-th dynamic threshold of FIG. 2 .
FIG. 4 is a flowchart illustrating in detail the threshold correction method of FIG. 2 .
5 is an example illustrating a method for calculating an optimal dynamic threshold.
6 is an example illustrating threshold correction conditions.
7 is an example of a threshold that varies according to a residual.
8 is an example of setting an optimal threshold for each data section.
9 is an example of a result of performing correction on a threshold value calculated by a dynamic threshold calculation method.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and the contents described in the accompanying drawings, but the present invention is not limited or limited by the embodiments.

Based on the real-time expected value calculation for operation data, the threshold-based alarm function, which is mainly used when detecting anomalies, determines whether an alarm is generated according to the threshold set for each tag. That is, if the threshold value, which is a criterion for generating an alarm, is set below an appropriate level, a false alarm may occur, or if it is set above an appropriate level, an abnormal state may not be detected.

In addition, detection of the existing abnormal section is based on a threshold value, and if the error does not reach the set threshold value, an undetected problem may occur and the problem situation may not be recognized.

Therefore, conventionally, it is very important to set an appropriate threshold value, but after setting the threshold value, the calculated expected value may be different depending on other signals or external environments, and if the set threshold value is not reached, an undetected problem may occur. Accordingly, an object of the present invention is to provide a method for calculating a dynamically changing threshold value for each data interval.

1 is a block diagram illustrating an alerting device using a dynamic threshold according to an embodiment of the present invention, and the alerting device 10 may generate an alert using a dynamic threshold. The alarm device 10 is composed of a collection unit 110, a determination unit 120 and an alarm unit 130.

The collection unit 110 collects driving data of a driving subject. An operation target may be various facilities provided in a plant or industrial facility, and may be a sensor that monitors the facility. The operation data may be data related to driving of facilities or sensors, or data related to results of driving of facilities or sensors.

The determining unit 120 analyzes the driving data to determine whether the driving target is in a normal or abnormal state, and the warning unit 130 generates an early warning if the driving target is in an abnormal state. As a method of outputting an alarm, various conventional methods such as sound, light, or data transmission may be employed.

2 is a flowchart illustrating a dynamic threshold calculation method for each data section according to an embodiment of the present invention, in which the determination unit 120 calculates an n-th dynamic threshold using n-th data, The current threshold is set by comparing the nth dynamic threshold.

FIG. 3 is a flowchart illustrating in detail a method of calculating the n-th dynamic threshold of FIG. 2 . The determination unit 120 calculates a residual between an actual value and an expected value using the n-th data. The determination unit 120 may calculate the residual in the same manner as in Patent Document 1 or Patent Document 2.

The determination unit 120 calculates the mean and deviation of the residuals, and sets the first initial value and the j-th maximum value of the coefficients. The coefficient is a factor that is multiplied by a variable called residual variance, and the mean and variance of residuals are values required for calculating the threshold value.

The determination unit 120 sets an initial threshold value calculated as the mean and deviation of the residuals and the initial values of the coefficients, and uses the mean and deviation of the residuals for values smaller or greater than the initial threshold value to determine the initial values of the coefficients. Calculate the score. The determination unit 120 calculates the score up to the maximum value of the coefficient, selects the coefficient corresponding to the score having the maximum value among the plurality of scores as the optimal coefficient, and sets the n-th dynamic threshold using the optimal coefficient. do. The score is a value for finding the optimal coefficient.

Referring to FIG. 1 again, the determination unit 120 generates a past average threshold by calculating the average of the first to n-1th dynamic thresholds, and compares the past average threshold with the n-th dynamic threshold to determine the threshold value. determine if correction is necessary.

The determining unit 120 sets the n-th dynamic threshold as the current threshold when it is determined that threshold correction is unnecessary, and when it is determined that threshold correction is necessary, the past average threshold and the n-th dynamic threshold are applied together. Set the value to the current threshold.

The determination unit 120 may determine whether the driving target is in a normal or abnormal state using the current threshold value, and the alarm unit 130 may generate an alarm when it is determined to be in an abnormal state.

When the determination unit 120 receives the n+1th data from the collection unit 110, it calculates the n+1th dynamic threshold in the same manner as before.

FIG. 4 is a flowchart showing the method of correcting the threshold value of FIG. 2 in detail. The determination unit 120 determines that the threshold value is corrected when the n-th dynamic threshold value exceeds the correction condition value in comparison with the past average threshold value. do.

If it is determined that the threshold value is corrected, the determination unit 120 calculates a first value obtained by applying the correction condition value to the past average threshold value, and calculates a second value obtained by applying the corrected contrast value to the n-th dynamic threshold value. value and the second value are summed and set as the current threshold. Hereinafter, a process of calculating a dynamic threshold and an example of application thereof will be described in detail with reference to FIGS. 5 to 9 .

로 나타낼 수 있다. 시계열 데이터는 갑작스러운 요인 변화로 샤프 스파이크(sharp spike) 현상이 발생할 수 있으므로, 스무딩 과정은 필요하다.FIG. 5 is an example of a method for calculating an optimal dynamic threshold. After calculating the residual, the determination unit 120 may perform a smoothing process to remove noise of the residual. Residuals after data smoothing, such as smoothing, are applied.

can be expressed as Time-series data requires a smoothing process because sharp spikes can occur due to sudden factor changes.

로 나타낼 수 있다. 여기서

는 잔차의 평균이고, z는 계수이며,

는 잔차의 편차이다.threshold is

can be expressed as here

is the mean of the residuals, z is the coefficient,

is the variance of the residuals.

The determination unit 120 sets the first initial value and the j-th maximum value of the coefficient. 5, the initial value of the coefficient is 2, and the maximum value is 12.5. In order to find the optimal z, we change z in the loop and find the point where the score is maximum. When z becomes infinitely large, the loop execution time increases and the threshold value is also calculated very large, so z is arbitrarily limited to 2 to 12.5 and increased by 0.5.

의 평균, 편차 대비 임계치를 초과하는 잔차를 제외한 값들의 평균과 편차가 가장 크게 줄어들 때를 최고 스코어로 한다. 그리고 최고 스코어가 계산된 순간의 z를 최적 값으로 한다. 잔차에 데이터 평활(smoothing)을 적용한 값

를 계산에 활용한다.

와

,

와

의 감소율이 커지고, 임계값보다 큰 오차

,

의 배열이 짧은 지점을 찾기 위한 과정을 수행하며, 이를 수식으로 나타내면 아래와 같다.The present invention is the input residual

The highest score is when the mean and deviation of values excluding residuals exceeding the threshold are reduced the most compared to the mean and deviation of . Then, z at the moment when the highest score is calculated is set as an optimal value. Data smoothing applied to residuals

is used in the calculation.

and

,

and

The decrease rate of is larger, and the error is greater than the critical value.

,

The process of finding a point where the array of is short is performed, and this is expressed as a formula as follows.

는 임계값이고,

는

의 평균이며,

는

중 임계값보다 작은 값들의 평균이고,

는

의 편차이며,

는

중 임계값보다 작은 값들의 편차이고,

는

중 임계값보다 큰 값들이며,

는

의 index 위치 앞과 뒤 n개를 포함하는 시퀀스(sequence) 배열이다.here

is the threshold value,

Is

is the average of

Is

is the average of the values less than the critical value,

Is

is the deviation of

Is

is the deviation of values smaller than the critical value,

Is

are values greater than the critical value,

Is

It is a sequence array containing n before and after the index position of .

The determination unit 120 calculates the score up to the maximum value of the coefficient, selects the coefficient corresponding to the score having the maximum value among the plurality of scores as the optimal coefficient, and sets the n-th dynamic threshold using the optimal coefficient. do.

FIG. 6 is an example of a threshold correction condition, and the determining unit 120 determines that the threshold value is corrected when the n-th dynamic threshold value exceeds the correction condition value in comparison with the past average threshold value.

If it is determined that the threshold value is corrected, the determination unit 120 calculates a first value obtained by applying the correction condition value to the past average threshold value, and calculates a second value obtained by applying the corrected contrast value to the n-th dynamic threshold value. value and the second value are summed and set as the current threshold.

In FIG. 6 , the correction condition value is 0.7 and the correction contrast value is 0.3. The sum of the correction condition value and the correction contrast value can be 1. The correction condition value and the correction contrast value may be variously set by a person skilled in the art according to the situation of the system.

FIG. 7 is an example of a threshold value that varies according to the residual, and the threshold value may continue to increase or decrease according to the change in the residual. However, if the threshold value continues to increase, the anomaly section cannot be detected correctly.

According to the present invention, since the value within the interval to be monitored affects the threshold value due to the nature of the dynamic threshold value, the threshold value correction process is performed if necessary.

8 is a graph showing an example of setting an optimal threshold for each data section. The present invention provides a dynamic threshold that changes for each data section, thereby minimizing the non-detection rate for an abnormal state of a driving target, and effective It can reduce the number of early warnings that do not go unnoticed.

9 is an example of the result of correcting the threshold value calculated by the dynamic threshold value calculation method. Calculate. If the calculated threshold value increases by more than 0.7 compared to the average of past threshold values, it is treated as a correction operation. The threshold continuously changes dynamically, and an abnormal section can be detected through this.

Conventionally, there is a possibility of an undetected occurrence for a value smaller than a set fixed threshold, but the present invention can solve the conventional problem by calculating the threshold for each count.

According to the present invention, a situation in which an alarm is released in the middle may occur according to the step size (length of period to be skipped without calculation), and in particular, the larger the step size, the higher the frequency of alarm release. can keep

In the case of Patent Literature 1 and Patent Literature 2, after the initial setting of the expected value (or predicted value) calculation model, an alarm generation standard is determined based on the tag index, and an alarm is generated when a specific residual is exceeded after the alarm generation standard is set.

However, since the present invention determines an alarm by dynamically updating the threshold based on the residual value of the latest state, it is possible to prevent an unnecessary alarm from occurring when the residual slightly exceeds the alarm threshold after setting the initial model.

10: alarm device 110: collection unit
120: determination unit 130: warning unit

Claims (3)

In the dynamic threshold calculation method for each data section using an alarm device,
calculating an n-th dynamic threshold using the n-th data;
generating a past average threshold by calculating an average of the first through n-1th dynamic thresholds;
comparing the past average threshold with an n-th dynamic threshold to determine whether a threshold needs to be corrected;
If it is determined that the threshold correction is unnecessary, the n-th dynamic threshold is set as the current threshold, and if it is determined that the threshold correction is necessary, the correction threshold to which the past average threshold and the n-th dynamic threshold are applied is set as the current threshold. Steps to set and
Comprising the step of calculating the n + 1 th dynamic threshold using the n + 1 th data,
Calculating the n-th dynamic threshold,
calculating a residual between an actual value and an expected value using the n-th data;
calculating an average and a deviation of the residuals;
setting the first initial value and the j-th maximum value of the coefficient;
setting an initial threshold calculated as an initial value of the mean, deviation, and coefficient of the residual;
calculating a score for an initial value of a coefficient using an average and a deviation of residuals for values smaller or larger than the initial threshold value;
calculating scores from the initial value to the maximum value of the coefficient by increasing the initial value of the coefficient, and selecting a coefficient corresponding to the score having the maximum value among a plurality of scores as an optimal coefficient;
Setting an n-th dynamic threshold using the optimal coefficient,
Setting the current threshold,
Comparing with the past average threshold value and determining that the threshold value is corrected when the n-th dynamic threshold value exceeds a correction condition value; and
If it is determined that the threshold value is corrected, a first value obtained by applying the correction condition value to the past average threshold value is calculated, a second value obtained by applying the correction contrast value to the n-th dynamic threshold value is calculated, and the first value and the second value are calculated. Including the step of summing and setting it as the current threshold value,
The correction contrast value is a value obtained by subtracting the correction condition value from 1,
The method of calculating a dynamic threshold value for each data interval, characterized in that the alarm device removes noise of the residual through a smoothing process after calculating the residual. delete delete

Images