JP2018188094A - Abnormality detection system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a system which early and precisely detects an area abnormality by the railway wayside using existing on-site equipment and equipment abnormality detection systems in a railway system.SOLUTION: An equipment abnormality detection system 301, when it detects that an abnormality occurs in on-site equipment 101, sends abnormality occurrence information which is information about abnormality of on-site equipment to an area abnormality detection system 401. The area abnormality detection system records the received abnormality occurrence information in an abnormality occurrence history of a database 501. Also, the area abnormality detection system, when it receives abnormality occurrence information of first on-site equipment among a plurality of on-site equipment from the equipment abnormality detection system, determines whether abnormality of equipment related to the first on-site equipment has occurred during a prescribed time range in the past by retrieving an abnormality occurrence history, and if it finds abnormality of related equipment has occurred in the past then it notifies users that an area abnormality has occurred through an alarm device 601.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an abnormality detection system.

  The railway system is composed of a large number of field devices installed along the line, such as traffic lights, track circuits, and switchboards. In order to operate the railway safely and smoothly, each field device has high reliability and safety. In order to detect malfunctions and abnormalities by always checking the operating state of each equipment, a malfunctioning system of equipment is provided because malfunctions of field equipment interfere with railway operation. The device abnormality detection system and the field device are connected via a network, and when the device abnormality detection system detects an abnormal operation of the field device, the device is repaired or replaced by maintenance work or the like.

  When each field device operates abnormally, it can be detected by the device abnormality detection system. On the other hand, if an abnormal event (such as a fire along the line, an earthquake, a power failure, or a ground fault) that affects the behavior of multiple field devices installed within a certain range occurs, the response is further delayed. There is a possibility that it will lead to damage expansion, and there is a case where it is necessary to take an urgent action faster than when an abnormality occurs in a single device. For example, when a ground fault occurs, it is necessary to stop power supply from nearby substations immediately and stop trains traveling in the vicinity. For this reason, it is necessary to specify the presence / absence of an area abnormality along the railway line, the occurrence location, factors, and solution means. However, since the railway line extends over a very wide area, when a new detection sensor is introduced for an area abnormality, the cost for installing and operating the sensor becomes enormous. In the following description, an abnormal event that affects the behavior of a plurality of field devices installed within a certain range is referred to as “area abnormality”, and the influence range is referred to as “area”.

  For example, Patent Literature 1 devises a common failure factor detection system that identifies an area where an abnormal event has occurred. The system disclosed in Patent Document 1 is intended to detect the occurrence of a fire or an overflow accident in each area in a nuclear power plant. A plurality of devices are installed in each area, and each device is connected to a common failure factor detection system by a cable. When the common failure factor detection system receives device failure signals simultaneously from a plurality of devices installed in the same area, it determines that an area abnormality has occurred in the area.

Japanese Patent Laying-Open No. 2015-228051

  In the technique disclosed in Patent Document 1, a single method (whether device failure signals are simultaneously received from a plurality of devices) is used to determine the occurrence of an area abnormality. However, when there are a plurality of abnormal events assumed as area abnormalities, the judgment criteria may differ depending on the types of area abnormalities assumed. Therefore, it is necessary to enable determination according to the type of area abnormality assumed.

  In order to solve the above problems, an abnormality detection system according to an embodiment of the present invention includes an apparatus abnormality detection system connected to a plurality of field devices via a network, and an abnormality that affects the behavior of the plurality of field devices. An area abnormality detection system that detects an area abnormality that is an event, a database, and an alarm device are included. When the equipment abnormality detection system detects that an abnormality has occurred in the field equipment, it sends the abnormality occurrence information, which is information about the abnormality in the field equipment, to the area abnormality detection system, and the area abnormality detection system receives the received abnormality occurrence information. It is configured to record in the abnormality occurrence history of the database. In addition, when the area abnormality detection system receives the abnormality occurrence information of the first field device among the plurality of field devices from the device abnormality detection system, the area abnormality detection system searches the abnormality occurrence history to obtain the first abnormality in the past predetermined time zone. It is determined whether or not an abnormality has occurred in the related equipment of the field device, and if an abnormality has occurred in the related equipment, the user is notified through the alarm device that an area abnormality has occurred.

  According to the present invention, an area abnormality can be detected early and with high accuracy.

It is a block diagram of the abnormality detection system which concerns on one Embodiment of this invention. It is an example of abnormality occurrence history. It is an example of a related equipment list. It is an example of a confirmation time list. It is a flowchart of an abnormality detection process. It is an example of an alarm screen.

  Embodiments of the present invention will be described below with reference to the drawings. As described above, in the following description, “area abnormality” means an abnormal event that affects the behavior of multiple field devices (that is, multiple field devices cause an abnormality), and the device itself. Rather than failure, it means a disaster, such as a fire, earthquake, or ground fault. A plurality of devices that are affected when an area abnormality occurs are not necessarily limited to devices installed at the same point (base), but are devices that are discretely installed within a predetermined range (area). There is also.

  FIG. 1 is a block diagram showing a configuration of an abnormality detection system according to an embodiment of the present invention. Note that the abnormality detection system described in the present embodiment detects a device abnormality or an area abnormality in a railway system.

  The abnormality detection system includes a plurality of field devices 101, a device abnormality detection system 301 that detects that an abnormality has occurred in the field device 101, an area abnormality detection system 401 that determines the occurrence of an area abnormality, a related device list, and an abnormality occurrence. It has a database 501 for recording information and an alarm device 601. In FIG. 1, only two field devices 101 are shown, but three or more field devices 101 may exist in the abnormality detection system.

  Each field device 101 is connected to the device abnormality detection system 301 via the network 201, and the device abnormality detection system 301, the database 501, and the alarm device 601 are connected to the area abnormality detection system 401. The device abnormality detection system 301, the database 501 and the alarm device 601 may be configured to be connected to the area abnormality detection system 401 via the network 201, or as shown in FIG. May be connected to the area abnormality detection system 401 by different transmission lines.

  The field device 101 is a device used in a railway facility (railway system) such as a traffic light, a track circuit, and a switch. The plurality of field devices 101 may be different types of devices, or may be the same type of devices. Moreover, each field device 101 may be installed in a geographically different position (Of course, it does not prevent that some field devices 101 are installed in the same position).

  In this embodiment, each field device 101 is configured to be able to communicate with the device abnormality detection system 301 via the network 201. The device abnormality detection system 301 determines whether there is an abnormality in the field device 101 based on information transmitted from the field device 101 via the network 201. When it is detected that an abnormality has occurred in the field device 101, the device abnormality detection system 301 transmits that fact to the area abnormality detection system 401.

  The area abnormality detection system 401 determines the type of abnormality that has occurred in the railway system based on the information received from the device abnormality detection system 301 and the information recorded in the database 501, and transmits the determination result to the alarm device 601. To do. In addition, the area abnormality detection system 401 is a user of the abnormality detection system (this is, for example, an administrator or a worker of the railway system. In the following, it may be simply abbreviated as “user”). Input device such as a keyboard for recording a device list).

  The alarm device 601 is a device for notifying the operator of the railway system of an alarm indicating that an abnormality in the field device 101 or an area error has occurred, and notifies the operator of an alarm such as a display screen or a speaker. For having an output device.

  Each of the area abnormality detection system 401, the device abnormality detection system 301, and the alarm device 601 is a computer having at least a CPU (Central Processing Unit) and a memory. For example, a general-purpose computer such as a known personal computer (PC) or server computer is used. It may be a simple computer. In this embodiment, the functions of the area abnormality detection system 401, the device abnormality detection system 301, and the alarm device 601 described below are implemented by software (computer program). For example, when the CPU of the area abnormality detection system 401 executes a program, the area abnormality detection system 401 operates as an apparatus that performs various processes described below. Similarly, in the device abnormality detection system 301 and the alarm device 601, the functions described below are realized by the CPU executing the program.

  However, the area abnormality detection system 401, the device abnormality detection system 301, and the alarm device 601 are not necessarily general-purpose computers such as a PC. As another embodiment, at least one of these (for example, the alarm device 601) may be a terminal device such as a mobile phone. Alternatively, at least one of these may be configured by dedicated hardware. The functions of the area abnormality detection system 401, the device abnormality detection system 301, and the alarm device 601 are not necessarily implemented by software. Some or all of these functions may be implemented by an FPGA (Field Programmable Gate Array) or the like. It may be implemented by hardware such as ASIC (Application Specific Integrated Circuit).

  The database 501 is a storage device (storage means) having a non-volatile storage medium such as a magnetic disk, and records information (such as a related device list and abnormality occurrence information described later) used in the abnormality detection system. Details of the information recorded in the database 501 will be described later. The database 501 may be a single magnetic disk, for example. Alternatively, an apparatus such as a file server, or a computer on which data management software such as a database management system (DBMS) is installed may be used as the database 501.

  In order to ensure the reliability and availability of the abnormality detection system, the abnormality detection system may include a plurality of device abnormality detection systems 301 and area abnormality detection systems 401. Conversely, in order to simplify the system configuration, for example, two or more functions among the functions of the area abnormality detection system 401, the device abnormality detection system 301, the alarm device 601, and the database 501 described below are physically one. It may be realized by a device (PC, server, etc.). For example, all of the functions of the area abnormality detection system 401, the device abnormality detection system 301, the alarm device 601, and the database 501 may be implemented in one PC.

  Hereinafter, an abnormality detection method in this abnormality detection system, mainly an area abnormality detection method will be described. First, an outline of the abnormality detection method and information used for abnormality detection will be described.

  The equipment abnormality detection system 301 acquires information about the state of the on-site equipment 101 from each on-site equipment 101 via the network 201, and determines whether there is an abnormality in the on-site equipment 101 using the information. When an abnormality occurs in the field device 101, the field device 101 transmits information indicating that an abnormality has occurred to the device abnormality detection system 301. In this embodiment, this information transmitted from the field device 101 to the device abnormality detection system 301 is referred to as “abnormality occurrence information”. The abnormality occurrence information is sent from the device abnormality detection system 301 to the area abnormality detection system 401 and accumulated in the database 501.

  The abnormality occurrence information is stored in a kind of table called abnormality occurrence history provided in the database 501. FIG. 2 shows a configuration example of the abnormality occurrence history 3000 and an example of abnormality occurrence information accumulated in the abnormality occurrence history 3000. Information recorded in each line of the abnormality occurrence history 3000 is abnormality occurrence information. As shown in FIG. 2, the abnormality occurrence information is information including a date and time 3001, a device ID 3002, and contents 3003. The device ID 3002 represents identification information of the field device 101 in which an abnormality has occurred (hereinafter, the identification information of the field device 101 is simply referred to as “device ID”). The date and time 3001 represents the date and time when the abnormality occurred in the field device 101 specified by the device ID 3002, and the content 3003 is information regarding the content of the abnormality that occurred in the field device 101, for example, an error code transmitted from the field device 101. Etc.

  The area abnormality detection system 401 sorts a plurality of abnormality occurrence information transmitted from the device abnormality detection system 301 based on the date and time 3001 and stores them in the abnormality occurrence history 3000 (for example, the abnormality occurrence information is in chronological order from the oldest date and time). Should be sorted and stored). In addition, the area abnormality detection system 401 refers to the received abnormality occurrence information and the abnormality occurrence history 3000 every time the abnormality occurrence information is received from the equipment abnormality detection system 301, so that the abnormality occurrence sent from the field device 101 is generated. It is determined (estimated) whether the information is caused by an area abnormality. In this determination, the area abnormality detection system 401 uses a related device list and a confirmation time list, which will be described later.

  Next, the related device list and the confirmation time list will be described. The related equipment list and confirmation time list must be prepared before the operation of the anomaly detection system starts. In the following description, the field device 101 that is determined to have an abnormality by the device abnormality detection system 301 is referred to as an “abnormal device”. A field device that is assumed to have the same influence as an abnormal device when an area abnormality occurs is referred to as a “related device”.

  At the preparation stage required before operation, the user of the abnormality detection system creates a related device list and a confirmation time list required during operation and records them in the database 501. The contents will be described below.

  The related device list is a list of combinations of a plurality of on-site devices that are assumed to be affected when an area abnormality occurs. FIG. 3 is an example of the related device list 2010 in the present embodiment. When the user creates the related device list 2010, an abnormal event to be assumed is selected, and a combination of field devices that are considered to affect the device behavior when the event occurs is specified for each event. Whether or not an abnormal event occurs on site equipment depends on the installation position or installation method of each site equipment. For example, when a fire is assumed as an abnormal event, there is a high possibility that a plurality of field devices installed in the same instrument box will cause the same abnormality. On the other hand, if a ground fault or power supply abnormality is assumed as an abnormal event, even if the physical distances between multiple field devices are separated, the same abnormality may occur if the field devices are in an electrical interference relationship with each other. It is thought that there is a high possibility of causing. Therefore, the related device list 2010 is configured to be able to store a combination of on-site devices that are affected for each assumed abnormal event.

  The related device list 2010 includes a device ID column 2011, an installation position column 2012, and a related device information column 2013 as shown in FIG. In each row of the related device list 2010, information on the field device in the abnormality detection system and information on the related device of the field device are recorded. The device ID column 2011 stores the identifier of the field device, and the installation position column 2012 stores information on the position where the field device is installed. The related device information column 2013 includes a plurality of assumed area abnormality columns (2013-1, 2013-2,...). The assumed area abnormality column (2013-1, 2013-2,...) Is a column provided for each assumed area abnormality. In the example of FIG. 3, two assumed area abnormal columns (2013-1, 2013-2) are shown, but the column 2013-1 is a column corresponding to the abnormal event “ground fault”, and the column 2013-2 is This column corresponds to the abnormal event “fire”. Note that the number of assumed area abnormality columns provided in the related device list 2010 is not limited to two. The related device list 2010 may be provided with the same number of assumed abnormal events as the number of assumed abnormal events.

  In each of the assumed area abnormality columns (2013-1, 2013-2,...), Columns in which device IDs of a plurality of field devices are described (columns 2013-11, 2013-12, 2013-13 in FIG. 3). ,..., 2013-21, 2013-22, 2013-23,..., And the field device corresponding to the column in which “O” is described is a related device. Represent. In the example of FIG. 3, in the row where the device ID 2011 is “device 001”, the column 2013 among the columns (2013-11, 2013-12, 2013-13,...) Included in the assumed area abnormality column 2013-1. “◯” is recorded in −12. This indicates that when the abnormal event is a ground fault, the related device (device ID) of the device 001 is “device 002”. In the row where the device ID 2011 is “device 002”, “◯” is recorded in the column 2013-23 among the columns included in the assumed area abnormality column 2013-2. This indicates that the related device (device ID) of 002 is “device 003”. Although FIG. 3 shows an example in which the number of related devices for one field device (for example, “device 001”) is only one, there may be a plurality of related devices for one field device.

  The anomaly detection system according to the present embodiment is based on the assumption that when an abnormality occurs in a certain field device 101 (referred to as “device A”) and a related device of device A, there is a high possibility that an area abnormality has occurred. Based on the above, it is determined whether or not an area abnormality has occurred. Therefore, when the abnormality detection system receives the abnormality occurrence information from the device A, the abnormality detection system 3000 searches the abnormality occurrence history 3000 to check whether the abnormality occurrence information transmitted from the related device of the device A is recorded (of course, the related device). (See also list). However, when the abnormality occurrence history 3000 is searched, only a certain range of abnormality occurrence information included therein is searched.

  Due to the occurrence of an area abnormality, a certain amount of time may be required from the occurrence of an abnormality in the device A until the area abnormality affects other field devices (related devices). Therefore, when searching for the abnormality occurrence history 3000, it is only necessary to search for abnormality occurrence information having a time difference with the abnormality occurrence date and time of the device A to some extent. In addition, it is considered that the time during which an area abnormality affects each field device is often finite (there is a certain upper limit). Therefore, in the abnormality occurrence information in the abnormality occurrence history 3000, abnormality occurrence information (abnormality occurrence information having a time difference of a predetermined value or more) whose time difference from the abnormality occurrence date / time of the device A is too large is related to the area abnormality. It is presumed to be information about abnormalities that do not have sex. Therefore, when searching the abnormality occurrence history 3000, the abnormality detection system refers to the date and time (date and time 3001) of the abnormality occurrence information, and the time difference between the date and time 3001 and the abnormality occurrence date and time of the device A is within a predetermined time range. What is necessary is just to search abnormality occurrence information. In this embodiment, this predetermined time range is referred to as “confirmation time”.

  Before the operation of the abnormality detection system starts, the user needs to set a confirmation time, but the time until the area abnormality affects each field device may vary depending on the type of area abnormality. Therefore, when the user sets the confirmation time, it is set for each assumed area abnormal event. For example, the confirmation time when the ground fault is assumed as the area abnormality is set to 30 seconds, and when the fire is assumed, the confirmation time is set to 1 hour.

  The confirmation time for each assumed area abnormal event is recorded in the database 501 as a confirmation time list 2500. FIG. 4 shows an example of the confirmation time list 2500. In the confirmation time list 2500, for each assumed abnormal event, a confirmation time set for the abnormal event is recorded. An assumed event 2501 represents an assumed abnormal event, and a confirmation time set for the assumed abnormal event is recorded in the confirmation time 2502.

  The assumed event 2501 includes an assumed area abnormality column 2013-1, 2013-2,. . . The same anomalous event that is recorded in is recorded. In the confirmation time 2502, an upper limit value and a lower limit value of the confirmation time allocated to the assumed abnormal event are recorded. For example, in the example of FIG. 3, “0 second or more and 30 seconds or less” is recorded in the confirmation time 2502 of the row where the assumed event 2501 is “ground fault”. However, at least one of the upper limit value and the lower limit value may be recorded in the confirmation time 2502. When only the upper limit value is recorded in the confirmation time 2502, it indicates that the confirmation time is not less than 0 seconds and not more than the upper limit value. When only the lower limit value is recorded, the confirmation time is not less than the lower limit value. It means that there is.

  The abnormality detection system determines whether an area abnormality has occurred by referring to the related device list 2010 and the confirmation time list 2500. For example, in the example of FIG. 3, by referring to the related device list 2010, it is specified that the related device of the device 001 is the device 002 (when the assumed abnormal event is “ground fault”). In the confirmation time list 2500 of FIG. 4, it is recorded that the confirmation time (0 seconds or more) is 30 seconds or less when the type (factor) of the abnormal event (area abnormality) is “ground fault”. . Therefore, for example, when an abnormality occurs in the device 001 at time 1:10:42, within the past 30 seconds from that point (1:10:42), that is, from 1:10:12 to 1:10:42 If an abnormality has occurred in the device 002 during the second, the abnormality detection system determines that a ground fault has occurred.

  In the example of FIG. 3, when the assumed abnormal event is “fire”, it is recorded in the related device list 2010 that the related device of the device 003 is the device 002. Further, in the confirmation time list 2500 of FIG. 4, when the type of abnormal event is “fire”, it is recorded that the confirmation time is one hour or more, so one hour from the time when the abnormality occurred in the device 003 If an abnormality has occurred in the device 002 before, the abnormality detection system can determine that a fire (an area abnormality) has occurred.

  The data storage format of the related device list and the confirmation time list described here is an example, and information may be stored in a format other than this. For example, in the example of FIG. 3, only information (that is, “◯”) indicating whether each field device is a related device is recorded in the related device list 2010, but each field device is a related device. In addition to the information indicating whether or not, the confirmation time may be recorded in the related device list 2010. Information other than that shown in FIG. 3 may be recorded in the related device list.

  Next, the flow of abnormality detection processing performed in the abnormality detection system will be described with reference to FIG. The abnormality detection process is roughly divided into an apparatus abnormality detection process (step 1010), an area abnormality determination process (steps 1020 to 1030), and an alarm output process (step 1040).

  In the device abnormality detection process, the device abnormality detection system 301 determines whether or not a device abnormality has occurred based on information transmitted from the field device 101. Specifically, the field device 101 in which the device abnormality has occurred transmits abnormality occurrence information to the device abnormality detection system 301 via the network 201, and the device abnormality detection system 301 receives this abnormality occurrence information, thereby It is detected that an abnormality has occurred in the device 101 (step 1010).

  Each field device 101 may transmit abnormality occurrence information to the device abnormality detection system 301 when a desired function is not performed due to a failure of a hardware component in the field device 101 or the like. However, when an operation slightly different from the normal operation is performed, that is, when an indication of a failure appears, the abnormality occurrence information may be transmitted to the device abnormality detection system 301. If the field device 101 is configured to transmit abnormality occurrence information to the device abnormality detection system 301 at the time when a failure sign appears, the abnormality detection system is in an area even if the field device 101 is not broken. It is effective because it can detect abnormalities.

  In addition, when no device abnormality has occurred, each field device periodically transmits normal operation information, and the device abnormality detection system 301 detects an abnormality in the field device 101 when transmission of normal operation information from the field device is interrupted. It may be determined that occurrence has occurred. In this way, even when the field device 101 is in a state where it cannot transmit the abnormality occurrence information (for example, the communication function abnormality of the field device 101, the network disconnection, etc.), the device abnormality detection system 301 is connected to the field device 101. It is possible to detect that an abnormality has occurred.

  When the device abnormality detection system 301 detects that an abnormality has occurred in the field device 101, it transmits a message to that effect to the area abnormality detection system 401. When the area abnormality detection system 401 receives information indicating that an abnormality has occurred in the field device 101 from the device abnormality detection system 301, it records the abnormality occurrence information in the field device 101 in the database 501. Instead of the field device 101 transmitting the abnormality occurrence date and time, the device abnormality detection system 301 may use the time when the abnormality occurrence information is received as the abnormality occurrence date and time. In this way, even when the field device does not have a clock device for recognizing the abnormality occurrence date and time, the time when the abnormality has occurred in the field device can be recorded in the database 501.

  In the area abnormality determination process, the area abnormality detection system 401 is based on information recorded in the database 501 (related device list, past abnormality occurrence information), and area abnormality determination results (the presence / absence of area abnormality, occurrence location, generation factor, etc.) Is transmitted to the alarm device 601. First, the area abnormality detection system 401 searches the abnormality occurrence history 3000, and abnormality information of other field devices 101 (field devices other than the abnormality devices) within a period specified by the confirmation time recorded in the confirmation time list 2500. Is recorded (step 1020). In the confirmation time list 2500, a different time range (confirmation time) may be recorded for each possible area abnormality. For this reason, when a plurality of different confirmation times are recorded in the confirmation time list 2500, the area abnormality detection system 401 records abnormality information of field devices other than abnormal devices for a plurality of time ranges (confirmation times). Check.

  When abnormality information of other field devices is recorded (step 1020: Yes), the area abnormality detection system 401 detects abnormality information based on the contents of the related device list 2010 and the confirmation time list 2500 recorded in the database 501. It is confirmed whether or not the recorded field device 101 is related to an abnormal device (step 1021).

  An example of processing performed in steps 1020 and 1021 will be described with reference to FIGS. Here, the device ID of the abnormal device, that is, the field device 101 determined to have an abnormality in step 1010 is “device 002”, and is included in the abnormality occurrence date and time of the device 002 (that is, the abnormality occurrence information transmitted from the device 002). The case where the abnormality occurrence date and time) is “January 1, 2017 4:30” is assumed. The abnormality occurrence history 3000 records that an abnormality has occurred in the device 003 at 3:25 on January 1, 2017 (that is, at least one hour before the occurrence of the abnormality in the device 002, An abnormality has occurred). Therefore, when the contents of the related device list 2010, the confirmation time list 2500, and the abnormality occurrence history 3000 are those shown in FIGS. 3 and 2, respectively, in step 1020, the confirmation time (January 1, 2017) is displayed. It was detected that an abnormality occurred in the field device 101 (device 003) other than the abnormal device (device 002) within 1 hour or more from 4:30, or within 30 seconds from 4:30 on January 1, 2017) In step 1021, the device 003 is determined to be a device related to the abnormal device (device 002).

  As another embodiment, for example, when an abnormal device is detected, the area abnormality detection system 401 searches the abnormality occurrence history 3000, and an abnormality of the related device occurs within a predetermined past period (within a confirmation time). However, if it is confirmed that there is no area abnormality with respect to the related device of the field device 101 (that is, the abnormal device) where the abnormality has occurred due to maintenance work, on-site confirmation, etc., the device of the related device Abnormal information may be excluded from the search target. For example, when an operator of the railway system confirms that there is no area abnormality with respect to the related equipment of the abnormal equipment by on-site confirmation or the like, that fact is registered in the database 501. In step 1020 or step 1021, even if there is a record in the abnormality occurrence history 3000 that a device abnormality has occurred with respect to the device related to the abnormal device, the area abnormality detection system 401 does not determine that an area abnormality has occurred. It is good to do so.

  When the device information detected in step 1020 is related to the abnormal device (step 1021: Yes), the area abnormality detection system 401 determines that an area abnormality has occurred, and an alarm device 601 indicates that the area abnormality has occurred. (Step 1022). Here, the area abnormality detection system 401 records the abnormality occurrence information received from the device abnormality detection system 301 in the abnormality occurrence history 3000 of the database 501. The area abnormality detection system 401 may also record the area abnormality determination result in the database 501.

  When notifying the alarm device 601 that an area abnormality has occurred, the area abnormality detection system 401 estimates the type (occurrence factor) of the area abnormality and the location where the abnormality has occurred, and notifies the alarm device 601 of the information as well. . The area abnormality detection system 401 may record information notified to the alarm device 601 in the database 501. The contents notified to the alarm device 601 will be described later.

  On the other hand, when there is no abnormality record of the related device within the confirmation time (step 1020: No, or step 1021: No), it is determined that the device has failed, and the alarm device 601 is notified that the device has failed (step). 1030). Similar to step 1022, in step 1030, the area abnormality detection system 401 records the received abnormality occurrence information in the abnormality occurrence history 3000.

  In the alarm output process, the alarm device 601 presents an alarm regarding abnormality occurrence information and area abnormality determination results to the user (step 1040). FIG. 6 is an example of an alarm screen 6010 that the alarm device 601 presents to the user. As described above, the area abnormality detection system 401 estimates whether an abnormality is a single device failure (single device abnormality) or an area abnormality, and in the case of an area abnormality, the type of area abnormality (cause of occurrence) and the location where the abnormality occurred. And the alarm device 601 is notified of the information. The alarm device 601 creates an alarm screen as shown in FIG. 6 based on the information received from the area abnormality detection system 401 and presents it to the user. In the example of FIG. 6, “Area abnormality” is displayed in bold with an underline as an abnormality type, “Ground fault” is displayed in bold with an underline as an occurrence factor (estimation factor), and “ "Route X Kilometers around X" is displayed in bold underlined. This indicates that the abnormality that has occurred is an area abnormality, the cause (estimated factor) of the abnormality is a ground fault, and the place where the abnormality occurs is “near route X kilometer X”. Further, as shown in FIG. 6, other information may be displayed on the alarm screen. In the following, an example of an area abnormality occurrence factor and an estimation method of an abnormality occurrence location will be outlined.

  Various methods may be used for estimating the type of area abnormality (occurrence factor) and the occurrence location of the abnormality, and some examples are outlined here. In the following description, the field device 101 (abnormal device) determined to have an abnormality in step 1010 is “device 001”, and is determined to be a related device of the abnormal device (device 001) in step 1021. A case where the field device 101 is “device 002” will be described as an example.

  For example, the area abnormality detection system 401 estimates that the position recorded in the installation position column 2012 of the abnormal device (device 001) and the related device (device 002) described in the related device list 2010 is an abnormality occurrence location. This may be notified to the alarm device 601. In addition to this, the area abnormality detection system 401 is also associated with the devices 001 and 002 recorded in the related device list 2010 (this related device may be a field device that has not yet output abnormality occurrence information). The position recorded in the installation position column 2012 may be extracted, and this may be notified to the alarm device 601 as a range that may be affected by an area abnormality.

  Further, the area abnormality detection system 401 is assumed to be an abnormal event (an abnormal event described in an assumed area abnormal column (2013-1, 2013-2,...) In the related device list 2010. In the example of FIG. The alarm device 601 may be notified of the occurrence of an area abnormality as “ground fault” or “fire”. Alternatively, the area abnormality detection system 401 may estimate the cause of the area abnormality based on the abnormality content (content of abnormality occurrence information) received from the field device 101. When the occurrence factor cannot be uniquely identified, the area abnormality detection system 401 may notify the alarm device 601 of a plurality of events (factors) as possible events. When multiple events may exist as possible events, the area abnormality detection system 401 may notify the estimated occurrence probability of each event as shown in FIG.

  Further, when the alarm screen 6010 is presented to the user, the alarm device 601 may present work contents for dealing with the detected abnormal event to the user. Further, when the area abnormality detection system 401 notifies the alarm device 601 of the estimated occurrence probability of each event, the alarm device 601 may perform processing such as not outputting an event with an estimated occurrence probability equal to or less than a predetermined probability. good. The abnormality detection system according to the present embodiment can notify the user that an abnormality of the field device 101 or an area abnormality has occurred by repeatedly performing the process of FIG.

  In the example described above, the confirmation time is determined for each assumed area abnormality. Therefore, when the abnormality detection system identifies the cause of the abnormality by executing the processing of FIG. 5, the determination processing (steps 1020, 1021, etc.) of FIG. 5 is performed using the same confirmation time regardless of the type of the abnormal device. . However, as another embodiment, in addition to the assumed area abnormality, a different confirmation time may be set for each field device (related device). For example, a field device with a higher failure rate has a higher probability of accidental breakage at the same timing as another field device, and therefore, an operation in which the confirmation time is set short can be considered.

  This will be described using a specific example. For example, when the abnormal device is the device 001 and the assumed area abnormality type is “ground fault”, the related devices of the device 001 are the devices 002 and 004, but the failure rate of the device 002 is the failure of the device 004. Assume that the rate is higher than the rate. In that case, for example, the abnormality detection system may be configured so that the confirmation time can be set such that the confirmation time of the device 002 with respect to the device 001 is 20 seconds or less and the confirmation time of the device 004 with respect to the device 001 is 30 seconds or less. When the confirmation time is set in this way, even if the device 002 has an abnormality 25 seconds before the device 001 has an abnormality, the abnormality detection system has detected that an area abnormality (ground fault) has occurred. Do not judge. However, if an abnormality of the device 004 occurs 25 seconds before the abnormality of the device 001 occurs, the abnormality detection system determines that an area abnormality (ground fault) has occurred. As described above, since the confirmation time may vary depending on the type of area abnormality, the confirmation time set for each field device can be set to a different value for each type of area abnormality.

When setting the confirmation time based on the failure rate, the nominal value by the manufacturer of each field device may be used as the failure rate of each field device (average failure rate per hour = 1 / MTBF), or actual operation You may use the failure rate calculated from the time observation data. Each failure rate may be updated at any time based on observation data during operation. Further, a failure rate that assumes a failure rate change (bathtub curve) with the passage of time, taking into account the device installation time and maintenance execution time, may be used. When there are a large number of related field devices, the probability that any one of them will fail within a unit time increases in proportion to the number. Therefore, when the user sets the confirmation time, the confirmation time may be determined in consideration of the number of related field devices. For example the failure rate of 10 and ^-5 field devices of ten is installed, when each is related equipment, the user 10-4 ⁽⁼ instrument single failure rate 10 ^-5 × associated number of devices the failure rate of the entire equipment (10 units) and the confirmation time of each device may be set.

  The anomaly detection system may issue different types of alarms based on the difference in date and time of occurrence of errors between a plurality of field devices (abnormal devices and related devices) (hereinafter referred to as “abnormality occurrence time difference”). As the abnormality occurrence time difference is shorter, it can be determined that each device abnormality is less likely to be an accidental event, so it is possible to issue an alarm accordingly. For example, when the abnormality detection system determines that an area abnormality has occurred, if the abnormality occurrence time difference between the abnormal device and the related device is 1/10 or less of the upper limit of the confirmation time, a special alarm is output and the abnormality occurrence time difference is An alarm may be output if it is less than or equal to 1/2 of the upper limit value of the confirmation time, and a warning may be output if the difference in abnormality occurrence time is more than that. Specifically, when the confirmation time assigned to a certain area abnormality is 360 seconds or less, the abnormality detection system outputs a special alarm if the abnormality occurrence time difference is within 36 seconds, and alarms within 180 seconds. May be output and a warning message may be issued within 360 seconds. This alarm output may be performed regardless of whether or not an area abnormality has occurred. That is, even if an abnormality has occurred in the two field devices, the area abnormality detection system 401 (or the alarm device 601) does not detect that an area abnormality has occurred. The alarm device 601 may output an alarm corresponding to the determined difference by determining the difference in occurrence date and time.

  The abnormality detection system may estimate the cause of the area abnormality based on the abnormality occurrence time difference. For example, when the difference in abnormality occurrence time between the abnormal device and the related device is very small (within several seconds or the like), there is a high possibility that an area abnormality such as a ground fault has occurred in a short time, which affects many field devices. On the other hand, when the abnormality occurrence time difference is large (several minutes to several tens of minutes), there is a high possibility that an area abnormality such as a fire or flooding takes some time to affect a plurality of devices. Thus, when there is a correlation between the abnormality occurrence time difference between the abnormal device and the related device and the area abnormality, it is effective to estimate the cause of the area abnormality based on the abnormality occurrence time difference.

  The abnormality detection system may estimate the cause of the area abnormality in consideration of the installation position of each field device 101. For example, on a certain railway line, a plurality of (for example, four) field devices (hereinafter referred to as device A, device B, device C, and device D) are connected to device A, device B, device C, and device D. Assume that they were installed in order. If an abnormality occurs in the order of device A, device B, device C, and device D, it is highly likely that a physical abnormal event such as a fire or overflow is a factor.

  In addition, when the abnormality detection system estimates the cause of the area abnormality, information other than the information received from the field device 101 may be used. For example, information related to natural phenomena (rainfall, lightning, intense heat, earthquake, etc.) around the field device 101, geographical information (such as a river nearby), and the like may be used. When the anomaly detection system uses information about natural phenomena to estimate the cause of area anomalies, the information actually measured and collected by the anomaly detection system may be used, or prior forecast information such as weather forecasts may be used .

  In the above, an example in which the alarm device 601 displays an alarm on the screen has been described, but the same content may be presented to the user by another means such as sound, lamp lighting, vibration (vibration function of the mobile terminal, etc.). .

  When the area abnormality detection system 401 determines that there is an area abnormality, the abnormality detection system may cause an external system to perform control in consideration of the type of area abnormality and the location where the area abnormality occurs. For example, the abnormality detection system has a configuration in which the area abnormality detection system 401 is connected to a railway operation management system, a railway security system, or a substation system that manages a substation via the network 201, and the operation management system or the railway security system. The train entry to the area may be restricted by notifying the system that an area abnormality has occurred and information on the area where the abnormality has occurred (considered). The area abnormality detection system 401 may notify the substation system that manages the substation of the occurrence of the area abnormality (and information on the area where the abnormality is considered to occur), and may limit power supply to the area.

  By implementing the processing as described above, an area abnormality along the railway can be detected with high accuracy and early.

101 field device 201 network 301 device abnormality detection system 401 area abnormality detection system 501 database 601 alarm device 2010 related device list 2500 confirmation time list 3000 abnormality occurrence history 6010 alarm screen

Claims (13)

A device abnormality detection system connected to a plurality of field devices via a network;
An area abnormality detection system that detects an area abnormality that is an abnormal event affecting the behavior of the plurality of field devices;
A database,
An alarm device;
In an anomaly detection system having
When the device abnormality detection system detects that an abnormality has occurred in the field device, the device abnormality detection system transmits abnormality occurrence information, which is information about the abnormality of the field device, to the area abnormality detection system, and the area abnormality detection system receives The abnormality occurrence information is configured to be recorded in the abnormality occurrence history of the database,
The area abnormality detection system also receives the abnormality occurrence information of the first field device among the plurality of field devices from the device abnormality detection system, searches the abnormality occurrence history, Determine whether an abnormality has occurred in the related equipment of the first field device in the time zone,
When an abnormality has occurred in the related device, it is determined that an area abnormality has occurred, and the user is notified that an area abnormality has occurred via the alarm device.
An anomaly detection system characterized by that. The abnormality occurrence information includes identification information of the field device where the abnormality has occurred, and date information when the abnormality has occurred,
The database includes a related device list that is information on a combination of field devices assumed to be affected when the area abnormality occurs, and a search range when the area abnormality detection system searches the abnormality occurrence history. And a confirmation time indicating
The area abnormality detection system identifies the related device of the first field device using the related device list.
The abnormality detection system according to claim 1, wherein: In the related equipment list, information on the combination of the field equipment is recorded for each area abnormality,
The confirmation time is defined for each area abnormality,
The abnormality detection system according to claim 2, wherein: 4. The abnormality detection system according to claim 2, wherein the confirmation time is defined for each field device and is calculated from a failure rate of the field device. The area abnormality detection system calculates a difference between the abnormality occurrence dates and times of the two field devices where an abnormality has occurred,
The alarm device determines a type of alarm to be notified to the user based on the difference in the date and time of occurrence of the abnormality.
The abnormality detection system according to any one of claims 2 to 4, wherein the abnormality detection system is characterized in that: The related device list includes information on an installation position of the field device,
The abnormality detection system according to any one of claims 2 to 5, wherein the area abnormality detection system estimates a type of an area abnormality that has occurred based on information on an installation position of the field device. . The area abnormality detection system calculates a difference between the abnormality occurrence dates and times of the two field devices where an abnormality has occurred,
The area abnormality detection system estimates the type of area abnormality that has occurred based on the difference in the date and time of occurrence of the abnormality;
The abnormality detection system according to any one of claims 1 to 5, wherein The abnormality detection system includes:
Presenting to the user alarm information including at least one of the abnormality occurrence information, the area abnormality occurrence determination result, the work content for responding to the abnormality that has occurred, and the estimated occurrence probability of the area abnormality. The abnormality detection system according to any one of claims 1 to 7, wherein The field device regularly transmits normal operation information to the device abnormality detection system during normal operation,
9. The apparatus abnormality detection system according to claim 1, wherein the apparatus abnormality detection system determines that an abnormality has occurred in the field device when the normal operation information from the field device has not been received for a predetermined time. The abnormality detection system according to one item. The abnormality detection system is connected to at least one of a railway operation management system, a railway security system, and a substation system via the network,
When the area abnormality detection system determines that an area abnormality has occurred,
For at least one of the railway operation management system, the railway security system, and the substation system, information on area abnormality is transmitted, and control according to the type of area abnormality is performed.
The abnormality detection system according to any one of claims 1 to 9, wherein An anomaly detection method for an anomaly detection system connected to a plurality of field devices via a network,
The abnormality detection system is
A first step of recording abnormality occurrence information, which is information about an abnormality of the field device, in a database as an abnormality occurrence history when an abnormality occurs in the field device;
When an abnormality occurs in the first field device among the plurality of field devices, an abnormality occurs in the related device of the first field device in the past predetermined time zone by searching the abnormality occurrence history. A second step of determining whether or not
When an abnormality has occurred in the related device, it is determined that an area abnormality that is an abnormal event affecting the behavior of the plurality of field devices has occurred, and a third step of notifying the user that an area abnormality has occurred When,
The abnormality detection method characterized by performing. The abnormality occurrence information includes identification information of the field device where the abnormality has occurred, and date information when the abnormality has occurred,
The database includes a related device list that is information on a combination of field devices that are assumed to be affected when the area abnormality occurs, and a search range when the abnormality detection system searches the abnormality occurrence history. The confirmation time shown, and
In the second step, the abnormality detection system identifies the related device of the first field device using the related device list,
The abnormality detection method according to claim 11, wherein: In the related equipment list, information on the combination of the field equipment is recorded for each area abnormality,
The confirmation time is defined for each area abnormality,
The abnormality detection method according to claim 12, wherein:

Images