JP2019020982A - Abnormality detecting device, abnormality detecting method and program - Google Patents

Abstract

To detect an abnormality on the basis of an index that stores a deviation rate.SOLUTION: An abnormality detecting device according to an embodiment includes a data obtaining unit, a performance index calculating unit, a performance index estimating unit, an abnormality level rate index creating unit and an abnormality detecting unit. The data obtaining unit obtains measured data. The performance index calculating unit calculates an actual value of a performance index from the measured data. The performance index estimating unit obtains an estimated value of the performance index from the measured data on the basis of a normal model that has been learnt in advance. The abnormality level rate index creating unit creates an abnormality level rate index that is an index indicating a deviation between the actual value and the estimated value on the basis of a plurality of predetermined thresholds, and a presence rate of the deviation that has a value equal to or greater than each of the plurality of predetermined thresholds. The abnormality detecting unit detects an abnormality on the basis of the abnormality level rate index.SELECTED DRAWING: Figure 1

Description

  Embodiments described herein relate generally to an abnormality detection device, an abnormality detection method, and a program.

  In facilities or moving bodies such as plants and railway vehicles, model the input / output relationship in the normal state, perform estimation based on the observation data and the model, and detect anomalies using the difference between the actual value and the estimated value Is widely done. At this time, it is common to set a specific threshold value for the divergence and issue a report when the threshold value is deviated. In general, the threshold value is determined based on physical knowledge, or obtained by a probability distribution assumption or a cross-validation method.

  For example, the fluctuation value is obtained from the waveform of the electrical parameter corresponding to the load of the motor mounted on the machining device, the machining speed is reduced based on the fluctuation value, and machining interruption and tool breakage are minimized. Technology that enables this is being developed. In addition, a technology has been devised for an auxiliary device attached to a semiconductor manufacturing apparatus that calculates a deviation from a coordinate point obtained from a plurality of types of parameters and a reference space, and accumulates the deviation to detect an abnormality. In these techniques, it is necessary to appropriately set a threshold value of 2 or more, or it is necessary to consider a small deviation cumulatively. However, in general, it is difficult to set the two thresholds appropriately, and the accumulation of small divergences increases the possibility of causing false alarms.

JP, 2006-87781, A

  An anomaly detection device based on an index that stores a deviation rate is provided.

  An abnormality detection device according to an embodiment includes a data acquisition unit, a performance index calculation unit, a performance index estimation unit, an abnormality degree ratio index generation unit, and an abnormality detection unit. The data acquisition unit acquires measurement data. The performance index calculation unit calculates a performance value of the performance index from the measurement data. The performance index estimation unit acquires an estimated value of the performance index from the measurement data based on a normal model learned in advance. The abnormality degree ratio index generation unit includes an abnormality degree ratio index that is an index indicating a deviation between the actual value and the estimated value, a plurality of predetermined threshold values, and a value equal to or greater than each of the predetermined threshold values. Generated based on the existence ratio of divergence. The abnormality detection unit detects an abnormality based on the abnormality degree ratio index.

The block diagram of the abnormality detection apparatus which concerns on one Embodiment. The flowchart which shows the production | generation process of the abnormality degree ratio parameter | index which concerns on one Embodiment. The figure which shows the example of a measured value, an estimated value, and deviation. The figure which shows the example of an abnormality degree ratio parameter | index. The figure which shows the example of an abnormality degree ratio distribution parameter | index. The figure which shows the comparative example of an abnormality degree ratio parameter | index and an abnormality degree ratio distribution parameter | index. The figure which shows another comparative example of an abnormality degree ratio parameter | index and an abnormality degree ratio distribution parameter | index. The flowchart which shows the abnormality detection process which concerns on one Embodiment. The block diagram of the factor analysis assistance apparatus which concerns on one Embodiment. The figure which shows the example of an abnormality degree detection result. The figure which shows the example of factor analysis. The figure which shows another example of factor analysis. The flowchart which shows the factor analysis process which concerns on one Embodiment. The figure which shows the example of the threshold value automatic adjustment apparatus which concerns on one Embodiment. The block diagram of the abnormality detection system which concerns on one Embodiment. The block diagram which shows an example of the hardware constitutions in one Embodiment.

  Hereinafter, embodiments will be described in detail with reference to the drawings. In the following description, an abnormality detection of a railway vehicle will be described as an example. However, the present invention is not limited to the railway vehicle, and can be applied to various facilities and moving bodies. In each embodiment, the user is basically a person who needs to detect an abnormality, such as an observer, administrator, or maintainer, but is not limited thereto.

(First embodiment)
The abnormality detection device according to the present embodiment generates an abnormality degree ratio index that is an index indicating a deviation (deviation) between the actual value of a predetermined state quantity and the estimated value, and detects an abnormality based on the abnormality degree ratio index. To do. FIG. 1 is a block diagram illustrating functions of the abnormality detection device 1 according to the present embodiment.

  The abnormality detection device 1 includes a data acquisition unit 10, a model acquisition unit 12, a performance index calculation unit 14, a performance index estimation unit 16, an abnormality degree ratio index generation unit 18, an abnormality degree ratio index storage unit 20, An abnormality degree ratio distribution index generation unit 22, an abnormality detection unit 24, a mode switching unit 26, and an output unit 28 are provided. This anomaly detection device 1 may be installed outside the vehicle as a ground device in a railway operation management company facility or an operation command center, or may be installed in the vehicle as an on-vehicle device. The installation form of the abnormality detection device 1 is not particularly limited.

  When the anomaly detection device 1 is installed outside the vehicle as a ground device, the measurement information of the system in the vehicle is received as an example via the vehicle upper element, the transponder ground element, and the ground information network. That is, the system in the vehicle transmits data to the ground information network via the ground unit or the like, and the abnormality detection device 1 receives the data via the ground information network. A metallic cable, coaxial cable, optical cable, telephone line, wireless, Ethernet (registered trademark), etc. can be used for the information network on the ground, but the system is not particularly limited. The abnormality detection device 1 may acquire data from various DBs via a ground information network.

  When the abnormality detection device 1 is an on-vehicle device, the abnormality detection device 1 acquires data from a system in the vehicle via an information network in the vehicle. There are Ethernet, wireless LAN (Local Area Network), etc. in the information network in the vehicle, but other information systems may be used. The anomaly detection device 1 may acquire data from various DBs connected to the ground information network using a vehicle upper element or a transponder ground element.

  The data acquisition unit 10 acquires sensor data from a sensor data DB (Database) 42 in which environmental data such as data measured by a railway vehicle or temperature is stored. This data may be stored in either the vehicle or the ground device, or may be provided in the abnormality detection device 1. There is no particular limitation on the sensing cycle for acquiring sensor data and the storage medium for storing the data.

  For example, when paying attention to deceleration, sensor data acquired at a short sampling period in milliseconds is stored in the sensor data DB 42. Data items include information such as time, position information, kilometer, speed, brake notch, power running notch, BC (Brake Cylinder) pressure, AS (Air Spring) pressure, and other realistic measurements. Any type can be used as long as it can be calculated from the measured values. Examples of data stored in cases other than railways include temperature, humidity, flow rate, current, voltage, pressure, position, and the like.

  The model acquisition unit 12 acquires a normal model created in advance from the normal model DB 44. The normal model DB 44 is a database that constructs a regression model and calculates a statistic for a predetermined index such as deceleration and stores it as a normal state. The index of interest may be an index stored in the sensor data DB 42 or any index that can be calculated from the index. The timing or amount of data acquisition is stored in the parameter DB 46, and the data acquisition unit 10 and the model acquisition unit 12 acquire data from various databases based on this information.

  The normal model DB 44 and the parameter DB 46 may be provided in the same manner as the sensor data DB 42. If it is external, it may be connected to the abnormality detection device 1 via a network. These DBs can be implemented by a relational database management system or various NoSQL systems, but other methods can also be used. The database storage format may be XML, JSON, CSV, or other formats such as binary format. It is not necessary for all databases used in the abnormality detection apparatus 1 to be realized by the same database system and storage format, and a plurality of methods may be mixed.

  The performance index calculation unit 14 calculates a performance value of a desired performance index based on the acquired data. The calculation result is given as a scalar quantity or as vector data. For example, when calculating the speed of a railway as a performance index, the actual speed value is calculated from the acquired data such as acceleration and moving distance. However, when speed data is acquired by a tachometer or the like, the speed data may be used as the actual performance index value. The performance value to be calculated is not limited to speed, and may be an index that can indicate other performance such as acceleration, deceleration, moving distance, and the like.

  The performance index estimation unit 16 acquires an estimated value of the performance index based on the acquired data and the acquired normal model. The acquisition result is given as a scalar quantity or vector data having the same dimension as the actual value, similarly to the actual value of the performance index. For example, when estimating the speed of a railway as a performance index, an estimated value of the performance index based on a normal model is acquired from information such as a power running notch and a brake notch.

  The generation method of the normal model is not limited, for example, a regression model, a support vector machine, or autoregression. As long as the performance index can be appropriately obtained from the acquired sensor data or the like, the optimization may be performed by any method. For example, when deceleration is used as a performance index, the normal model is a model generated from sensor data or the like acquired in a brake system in a normal state. At this time, by generating a model so that the data acquired by the data acquisition unit 10 becomes an explanatory variable, it is possible to acquire a predicted value using this model.

  In addition, a normal model may be generated in consideration of the weather and the like. In this case, it is possible to obtain an estimated value in a state closer to the state in which the actual value is calculated by changing the normal model in accordance with a parameter such as weather obtained in the actual value. Information such as the weather is stored together with the sensor data, for example.

  The abnormality degree ratio index generation unit 18 generates an abnormality degree ratio index based on the above-described actual value and the estimated value. This abnormality degree ratio index is generated based on the deviation of the estimated value from the actual value. More specifically, it is generated based on the ratio (existence ratio) of the number of deviation data whose absolute value is equal to or greater than a predetermined threshold with respect to the total number of deviation data calculated from the actual value and the estimated value. FIG. 2 is a flowchart showing a process of generating an abnormality degree ratio index.

  First, the abnormality degree ratio index generation unit 18 calculates deviation data from the acquired estimated value and the calculated actual value (S100). The divergence indicates, for example, a value obtained by subtracting the corresponding element of the actual value from the element having the estimated value. As another example, it may be a difference (the above absolute value) between an element having an estimated value and a corresponding element of the actual value. That is, the deviation data is vector data having the same dimension as the scalar quantity or the actual value and the estimated value.

  FIG. 3 is a graph showing performance values (upper solid line), estimated values (broken line), and deviation data (lower solid line) for these values. These data indicate, for example, the transition of deceleration before the railway stops. As shown in FIG. 3, a railway operating at a certain speed starts to decelerate by a brake operation before the stop station, and when the speed slows down to some extent, the deceleration decreases, and the speed becomes zero. At the same timing, the deceleration becomes zero and stops.

  The actual value changes smoothly when the driver actually performs an operation closer to the ideal by the notch operation. On the other hand, the estimated value changes based on the model when the brake notch is operated. For example, an overshoot that does not occur in reality occurs, or the estimated value is stable as a result of the model reflecting a fine notch operation that is actually performed to keep the deceleration constant. No state. Even if the model is elaborately generated, these can occur due to weather and track conditions of the day. In addition, when there is some abnormality in the brake system, this deviation tends to increase.

  In FIG. 3, the divergence data indicates a transition of a value obtained by subtracting the actual value from the estimated value as described above, and the performance index and the actual value that are actually predicted for the operation depending on the situation of the divergence data. To determine the difference. If some element of the deviation data is large, it can be determined that some abnormality has occurred, but as described above, the actual value when actually operated does not always appear as the model. In many cases, some deviation may be allowed. An index indicating these divergences is an abnormality degree ratio index.

  Returning to FIG. 2, next, the abnormality degree ratio index is initialized (S102). This initialization refers to an operation of replacing each component of the matrix with a value such as 0, NaN, or NULL when the abnormality degree ratio index is a matrix. Note that the order of these steps S100 and S102 may be changed, and the initialization of the abnormality degree ratio index may be performed at another appropriate timing even if this process is not being performed.

  Next, a loop related to the threshold value is entered (S104). The abnormality degree ratio index is generated based on a plurality of predetermined threshold values. In the following, a case where eight predetermined threshold values A, B,..., H (A <B <... <H) are used will be described as an example.

  Then, a loop related to the ratio to the threshold value is entered (S106). As described above, the abnormality degree ratio index is generated based on a plurality of predetermined thresholds, but is also based on a plurality of predetermined ratios. Hereinafter, as an example, a case where eight predetermined ratios of ratios a, b,..., H (a <b <... <H) are used will be described.

  In each loop, the abnormality degree ratio index is updated based on the calculated deviation data value, a predetermined threshold value, and a predetermined ratio (S108).

  FIG. 4A is a diagram illustrating an example of an abnormality degree ratio matrix in which an abnormality degree ratio index is represented by a matrix. S104 and S106, which are the loop processes described above, represent the loop process for each component of the matrix.

  Each component is 1 (first predetermined value) when (the number of elements of the calculated deviation data that is equal to or greater than a predetermined threshold value) / (total number of elements of the calculated deviation data) is equal to or greater than a predetermined ratio. Value), and if not, it is updated to be 0 (second predetermined value). When the initialization is performed with 0 (second predetermined value), the update may not be performed if it is less than the smallest predetermined ratio. Further, the initialization in S102 may be omitted on condition that the component update performed in S108 is performed for all components.

  A more specific example will be described. It is assumed that the deviation data is vector data having 100 elements, and the ratio a is 0.05 (5%). In such a case, if there are five or more data of the deviation A or more in the deviation data, 1 is assigned to the lower left component of FIG. 4A, that is, the component of the threshold A and the ratio a. The

  Next, the components are updated for the threshold A and the ratio b (S106 to S108). For example, assume that the ratio b is 0.10. In such a case, when there are 10 or more pieces of data that are greater than or equal to the threshold A in the deviation data, the components in the second row from the bottom of the leftmost column in FIG. 1 is assigned to the component of the ratio b.

  S106 to S108 are repeated up to the rate h. For example, when the ratio h is 0.40 and there are only 37 pieces of data that are equal to or greater than the threshold A in the deviation data, 0 is substituted for the components of the threshold A and the ratio h.

  Next, returning to the processing of S104, the loop of the above ratio is repeated from the threshold B. When the processing up to the threshold value H and the ratio h is completed, the components of the abnormality degree ratio matrix as shown in FIG. 4A are substituted, the abnormality degree ratio index is stored (S110), and the abnormality degree ratio index is calculated. The processing to end is completed.

  The processing of this loop can be speeded up by generating a histogram having thresholds A, B,. For example, the histogram may be generated in the step of calculating the divergence value in S100. In addition, the ratios a, b, h, and the like in the above-described examples are shown as examples, and are not limited thereto. You may change suitably according to a use or the factor of abnormality. For example, if h = 1.0, the row of h is zero for all elements when there is at least one element that matches the actual value and the estimated value.

  FIG. 4B shows the degree of abnormality ratio index as a vector instead of a matrix. Thus, each component may be stored as a vector. As another example, it is possible to indicate to what extent 1 is assigned to a vector for the number of elements of thresholds A, B,..., H, in this case, an 8-component vector. For example, in the case of a matrix as shown in FIG. 4A, short vector data [7, 7, 6, 5, 3, 2, 1, 0] may be used as the abnormality degree ratio index. By doing so, it is possible to reduce the data storage area. When detecting abnormality, an abnormality degree ratio matrix may be used, and when it is stored, it may be converted into a vector having the above-mentioned threshold number of components and stored.

  Returning to the description of the configuration of FIG. The abnormality degree ratio index storage unit 20 stores the abnormality degree ratio index generated by the abnormality degree ratio index generation unit 18. A unique ID (Identifier) may be stored together with each generated abnormality degree ratio index. Furthermore, you may make it preserve | save together with the preserve | saved date.

  The abnormality degree ratio distribution index generation unit 22 uses the abnormality degree ratio index stored in the abnormality degree ratio index storage unit 20 to generate an abnormality degree ratio distribution index. The abnormality degree ratio distribution index is an index indicating the distribution of past abnormality degree ratio indices based on the past abnormality degree ratio indices. The degree of abnormality ratio distribution index indicates that the closer the value of the component is to 1, the higher the probability that the same situation has occurred in the past for the combination of the threshold and the ratio, and the closer the value is to 0, the less likely the situation has occurred in the past.

  FIG. 5 shows an abnormality ratio distribution matrix generated as an abnormality ratio distribution index based on the abnormality ratio matrix shown in FIG. For example, when the abnormality degree ratio matrix is stored in the abnormality degree ratio index storage unit 20 as an abnormality degree ratio index, the sum of each element of a plurality of past abnormality degree ratio matrices is calculated, and the abnormality degree ratio obtained by taking the sum Divide by the total number of matrices. In the case of the vector format shown in FIG. 4B, it can be generated in the same manner. As described above, when the abnormality degree ratio index is stored as a short vector, the distribution may be obtained by developing each component when calculating it.

  The generation of the abnormal degree ratio distribution index may be calculated from all the stored abnormal degree ratio indices for the past, or from the abnormal degree ratio index that matches the current situation such as weather and temperature. It may be. Furthermore, instead of simply taking an average, a weighted average in which the weight is weighted more recently may be calculated as the abnormality ratio distribution index.

  The abnormality detection unit 24 performs abnormality detection based on the abnormality degree ratio index and the abnormality degree ratio distribution index. FIG. 6A is a diagram illustrating an example of the abnormality degree ratio matrix, and FIG. 6B is a diagram illustrating an example of the abnormality degree ratio distribution matrix. As shown in FIG. 6A, the abnormality degree ratio matrix is represented by a binary value of 1 (first predetermined value) or 0 (second predetermined value). The boundary between 0 and 1 is indicated by a thick line in the figure.

  In FIG. 6B, the same thick line as that shown in FIG. 6A is drawn. In FIG. 6B, there is a portion where a thick line exists on the upper side or the right side of the component whose element is 0. Specifically, the thick line exists on the upper side or the right side of 0 in the components of the threshold E ratio d and the threshold F ratio c, d. In the anomaly degree distribution matrix, the component with a value of 0 is a combination of a threshold and a ratio that has not occurred in the past. Therefore, the combination of the threshold and the ratio is different from the distribution of past deviation data. It is. Thus, when there is a situation different from the past data, the abnormality detection unit 24 detects that there is an abnormality.

  In the vector format data, the abnormal degree ratio index is 1, but the component that is 0 in the abnormal degree ratio distribution index indicates a situation different from such past data. In the short vector data format, for example, it is possible to compare to what threshold the degree of abnormality rate distribution index is distributed at each threshold and the degree of abnormality rate distribution index. In the example of FIGS. 6A and 6B, the abnormality degree ratio index is [7, 6, 5, 4, 4, 4, 1, 0], and the abnormality degree ratio distribution index is [7. , 7, 6, 5, 3, 2, 1, 0], it is possible to detect an abnormality in the threshold value E and the threshold value F. If the ratio is also the threshold value E, it is possible to read that the fourth, that is, the ratio d, and the threshold value F, the difference between the third and fourth, that is, the ratios c and d.

  In the above, when the abnormality degree ratio index is 1 and the abnormality degree ratio index distribution is 0, that is, the threshold (hereinafter referred to as a detection threshold) is 0, the abnormality degree ratio index is 1, When the degree ratio index distribution is equal to or less than the detection threshold, it is determined that the combination of the threshold and the ratio is abnormal, but the present invention is not limited to this. For example, when the abnormality degree ratio index is 1 and the abnormality degree ratio index distribution is a predetermined distribution probability, for example, 0.1 or less, that is, when the detection threshold is 0.1, the combination is abnormal. May be detected. Furthermore, when the number of components that are different combinations between the abnormality degree ratio index and the abnormality degree ratio distribution index is a predetermined number or more, for example, three or more, it may be determined that there is an abnormality.

  The mode switching unit 26 switches between a mode in which an operation for generating and storing an abnormality degree ratio index is performed, or a mode in which an abnormality is detected using the abnormality degree distribution index. This switching method may be manual, may be switched at a time specified in advance, or may be switched by other methods.

  The output unit 28 receives an abnormality detection result from the abnormality detection unit 24 and outputs the detection result via an external input / output I / F (Interface) 40. The output of the abnormality may be notified by sound, may be notified so as to be visually understood, may be printed and output, or may be output as data stored in a file server or database You may do it. FIG. 7 is a diagram illustrating an example of outputting data as visual information. As shown in FIG. 7, it may be output so as to be easily understood by the user by coloring or shading the abnormality degree distribution matrix. Note that the fact that an abnormality has been detected may be output only when an abnormality is detected, or the fact that no abnormality has been detected may be output even when no abnormality has been detected.

  FIG. 8 is a flowchart showing processing of the abnormality detection device 1 according to the present embodiment. Hereinafter, the flow of processing of the abnormality detection apparatus 1 will be described using the flowchart shown in FIG.

  First, the data acquisition unit 10 acquires observation data (S200). In parallel with this, the model acquisition unit 12 acquires a learned normal model (S202).

  After acquiring the observation data, the performance index calculation unit 14 calculates a performance value of the performance index based on the acquired observation data (S204). Further, after acquiring the normal model, the performance index estimation unit 16 acquires an estimated value of the performance index based on the acquired observation data and the normal model (S206).

  The learned normal model may be acquired before the estimated value of the performance index is acquired, and the order of the above S200 and S204 is not limited to the above, and may be before and after. Moreover, as long as data necessary for calculation and estimation is acquired, the order of S204 and S206 is not questioned or may be processed in parallel.

  Next, the abnormality degree ratio index generation unit 18 generates an abnormality degree ratio index based on the calculated actual value and the acquired estimated value (S208).

  Next, the mode switching unit 26 determines whether or not the learning mode is set (S210). When it is determined that the learning mode is set (S210: YES), the abnormality degree ratio index generated in the abnormality degree ratio index storage unit 20 is stored, and the abnormality detection process is terminated. In addition to saving, the normal model may be updated using the actual value calculated by the performance index calculation unit 14 and stored in the normal model DB 44.

  On the other hand, when it is determined that the mode is not the learning mode, that is, the operation mode (S210: NO), the operation mode is shifted to. In the operation mode, first, the abnormality degree ratio distribution index generation unit 22 generates an abnormality degree ratio distribution index from the past abnormality degree ratio index data stored in the abnormality degree ratio index storage unit 20 (S214).

  Next, the generated abnormality degree ratio index storage unit 20 stores the generated abnormality degree ratio index (S216). By performing the processing in this order, it is possible to prevent the abnormality degree ratio index itself to be judged whether or not an abnormality is detected from being reflected in the abnormality degree distribution index, while the operation performed thereafter Is reflected in the abnormal degree ratio distribution index.

  Next, the abnormality detection unit 24 detects whether or not there is an abnormality in the observation data acquired based on the abnormality degree ratio index and the abnormality degree ratio distribution index (S218). When an abnormality is detected, the output unit 28 outputs the detected abnormality and ends the process (S220).

  As described above, according to the present embodiment, to what extent there is divergence data exceeding a predetermined threshold with respect to the divergence between the actual value calculated from the acquired sensor data or the like and the estimated value. It is possible to detect abnormality based on past data. By doing so, it is possible to realize a more accurate and robust abnormality detection device that detects that the behavior is abnormal when the behavior is abnormal different from the normal time.

  In the above processing, for example, data is accumulated for each operation of a railway (operation from a predetermined station to the next station, etc.), and an abnormality is detected using the actual value and the estimated value. By doing this, it becomes possible to detect anomalies in a situation that is close to the situation, and it tends to occur from a given station to the next station, but not from another station to the next station. It is also possible to detect local abnormalities such as

  In addition, by detecting anomalies due to the difference between the actual value and the estimated value under near conditions, it is possible to detect anomalies excluding other factors, for example, factors depending on the location such as track status and connection conditions. It becomes possible. As described above, according to this embodiment, it is possible to realize a highly accurate and robust abnormality detection.

(Second Embodiment)
In the above-described embodiment, it has been described that abnormality is detected from the abnormality degree ratio index. However, in this embodiment, an abnormality is detected based on the generated abnormality degree ratio index and the past abnormality degree ratio index. We are also going to conduct a factor analysis.

  FIG. 9 is a block diagram illustrating functions of the factor analysis support device 2 according to the present embodiment. The factor analysis support device 2 includes an abnormality detection result storage unit 30 and a factor analysis support unit 32, and is a device that supports the analysis of the cause of the abnormality from the abnormality degree ratio index.

  The abnormality detection result storage unit 30 stores information indicating whether the abnormality is output from the abnormality detection unit 24 and the ID of the abnormality degree ratio index that is the basis of the information. Further, when the abnormality detection unit 24 detects an abnormality and the user inputs the cause of the abnormality via the input / output I / F 40, the factor is also stored in association with the abnormality degree ratio index ID. Is done. That is, the abnormality detection result storage unit 30 includes the ID of the abnormality degree ratio index, the detection result of whether the abnormality degree ratio index having the ID is abnormal, and the abnormality of the abnormality degree ratio index having the ID. Factors are linked and saved.

  FIG. 10A is a diagram illustrating an example of a table stored in the abnormality detection result storage unit 30. As shown in this figure, the presence / absence of abnormality and the factor in the case of abnormality are stored for each ID. The factor is input by the user. For example, this factor is input after maintenance is performed after the abnormality is detected by the abnormality detection device 1 and the factor can be analyzed. For example, in the abnormality degree ratio index with ID 1, abnormality is detected and the fact that the factor is A is stored.

  Note that the case where there is no abnormality such as ID 3 may be stored. If the data is stored even when there is no abnormality in this way, it is easy to achieve consistency with the data stored in the abnormality degree ratio index storage unit 20. In this case, it is also possible to construct the abnormality detection result storage unit 30 and the abnormality degree ratio index storage unit 20 as the same database. By taking the consistency, it becomes possible for the abnormality degree ratio distribution index generation unit 22 to create the abnormality degree ratio distribution index without using the past abnormality cases. More specifically, for example, when generating an abnormality degree ratio distribution index, it is possible to improve the accuracy of abnormality detection using the abnormality degree ratio distribution index by not reflecting data determined to be abnormal. It becomes possible. When the factor is not input, the data of factor: not input may be stored like the data of ID 6. In addition, in the case of unknown, data indicating that the factor is unknown may be stored.

  On the other hand, if there is no abnormality, the ID itself may not be stored. FIG. 10B is a diagram illustrating another example of a table stored in the abnormality detection result storage unit 30. In this case, data with ID 3 is not stored. By doing so, the abnormality detection result storage unit 30 may store the ID and factor when there is an abnormality. If the storage is not performed when there is no abnormality, the table area can be reduced.

  When an abnormality is detected, the factor analysis support unit 32 detects the abnormality rate based on the information of the past abnormality degree ratio index corresponding to the ID stored in the abnormality detection result storage unit 30. Support the analysis of the causes of abnormalities in indicators. There are various support methods. This method may be various clustering methods, may be based on various machine learning, and is not limited thereto, and any method can be used as long as the factors can be classified.

  For example, it is possible to use the k-nearest neighbor method by considering the degree of abnormality ratio index as a vector of row number × column number. FIG. 11 is a diagram illustrating an example of a result when the k-nearest neighbor method is used. The abnormality degree ratio index ID, the Euclidean distance between the abnormality degree ratio index having the ID and the attention degree abnormality ratio index of interest, and the cause of the abnormality of the abnormality degree ratio index having the ID are displayed. In addition, items such as time and weather that help analysis of factors may be displayed. Further, the distance may be measured in consideration of information such as time and weather. For example, in the case of FIG. 11, it can be determined as an abnormality factor of the abnormality degree ratio index that appears more frequently in the closer distance and the factor β is focused on.

  This result is output to the user via the output unit 28. The user can perform maintenance or the like, assuming that the cause of the abnormality is β. Furthermore, after the factors have been clarified, the user can also feed back the abnormality factors of the abnormal degree ratio index of interest to the abnormality detection result storage unit via the input / output I / F 40. By updating the data in this way, it is possible to increase the accuracy of factor analysis. Further, when no abnormality is found, feedback that there is no abnormality or feedback that the cause is unknown may be used for future abnormality detection or analysis support.

  The factor analysis support unit 32 can use various other indicators. For example, the distance used for the analysis is not limited to the Euclidean distance, and a Hamming distance may be used, or a Hamaranobis distance may be used as a covariance matrix.

  Furthermore, the present invention is not limited to the k-nearest neighbor method, and visualization may be performed using other methods such as a multidimensional scaling correction method, t-SNE (t-Distributed Stochastic Neighbor Embedding), and PCA (Principle Component Analysis). FIG. 12 is a diagram illustrating an example when the multidimensional scale correction method is used. In FIG. 12, the closer the sample is, the more the sample is perceived, and the color and shape of the pointer are changed for each factor so that it can be visually grasped. If the x mark is a newly detected abnormality case, the user can guess that the cause of the abnormality is β by looking at this graph.

  Furthermore, the method is not limited to these methods, and a method based on machine learning or the like may be used. For example, a support vector machine or a random forest may be used.

  As described above, the abnormality ratio index itself may be used as the index used for the factor analysis. Or, based on the difference between the abnormality rate ratio index and the abnormality ratio distribution index in the first embodiment described above, for example, only the components of the threshold E ratio d and the threshold F ratio c, d are set to 1, and the remaining components Data with 0 set to 0 may be used. In this case, the model used for the analysis is generated based on the past abnormality degree ratio index compared with the same abnormality degree ratio distribution index.

  FIG. 13 is a flowchart showing the processing of the factor analysis support apparatus 2.

  When the abnormality detection unit 24 detects an abnormality with respect to the data of interest, the factor analysis support unit 32 acquires the ID of the abnormality degree ratio index in which the abnormality is stored, which is stored in the abnormality detection result storage unit 30, and the ID Based on the above, each abnormality degree ratio index is extracted from the abnormality degree ratio index storage unit 20 (S300).

  Next, the factor analysis support unit 32 analyzes the factor using the abnormality degree ratio index of the data of interest based on the extracted abnormality degree ratio index and the abnormality factor associated with each abnormality degree ratio index. (S302).

  Next, the output unit 28 outputs the result analyzed by the factor analysis support unit 32 via the input / output I / F 40 (S304).

  When the cause of the abnormality can be analyzed, the analysis result of the factor is fed back to further improve the accuracy of the next analysis (S306).

  When a learned model is used for factor analysis, the factor analysis device 2 may store the model in a learned model storage unit (not shown) and use it for analysis from the next data.

  As described above, according to the present embodiment, the abnormality detection apparatus 1 can not only detect an abnormality but also support analysis of the cause. By outputting the factor analysis candidates in this way, the user can reduce the time and money costs for factor analysis.

  For example, as a factor of the brake system of the railway, if there is an abnormality in the brake shoe, it is not the brake body such as a brake side factor such as a pressure change due to air leakage, a setting value error, a signal transmission error There is a factor on the system side or a factor that is not a brake abnormality in the first place, such as an abnormality caused by the condition of the track. In such a case, it is possible to obtain a factor from the abnormality degree ratio index.

(Third embodiment)
In the above-described embodiment, an abnormality is detected from the acquired data. However, the abnormality detection device 1 according to the present embodiment uses a detection threshold that is a predetermined value in the above-described embodiment based on the detection result. To adjust.

  FIG. 14 is a block diagram illustrating functions of the threshold automatic adjustment device 3 according to the present embodiment. The threshold automatic adjustment device 3 includes a threshold automatic adjustment unit 34.

  The threshold automatic adjustment unit 34 sets an appropriate detection threshold based on the data stored in the abnormality detection result storage unit 30. When the abnormality detection device 1 outputs that the abnormality is detected and the result that the user has determined to be abnormal is already stored in the abnormality detection result storage unit 30, the abnormality degree ratio index used for detecting the abnormality is Adjust the detection threshold to increase the probability of detection.

  This adjustment may be, for example, to adjust the detection threshold for the entire abnormality degree ratio index, or in the abnormality degree ratio index determined to be abnormal, when compared with the abnormality degree distribution index, You may adjust the detection threshold with respect to the element with a characteristic.

  For example, it is assumed that the above situation occurs when the abnormality degree ratio index is as shown in FIG. Compared with the abnormality degree ratio distribution index shown in FIG. 6B, an abnormality is detected in the elements of the threshold E ratio d and the threshold F ratios c and d. In such a case, from the next time, by increasing the detection threshold value of these three elements, for example, by changing from 0 to 0.1, these three elements in the abnormality ratio distribution index will be zero in the future. Even when it disappears, it is possible to detect an abnormality when the abnormality rate ratio index shown in FIG. 6A is input.

  Like an abnormality, according to the present embodiment, the abnormality detection device 1 not only detects an abnormality, but also adjusts the threshold by the threshold automatic adjustment unit 34 according to the present embodiment, so that various more flexibly. It is possible to detect abnormal abnormalities.

(Fourth embodiment)
It is also possible to form an abnormality level detection system 4 including all of the abnormality detection device 1, the factor analysis support device 2, and the threshold automatic adjustment device 3 in each of the embodiments described above. FIG. 15 is a block diagram illustrating functions of the abnormality level detection system 4.

  When formed in this manner, the abnormality degree ratio distribution index creating unit 22 uses the data stored in the abnormality detection result storage unit 30 to extract the abnormality degree ratio index at the normal time, and the appropriate abnormality degree ratio. It is also possible to generate a distribution index. According to such a configuration, it is possible to perform robust abnormality detection using the distribution of divergence and to support factor analysis of the abnormality that has occurred.

  FIG. 16 is a block diagram illustrating an example of a hardware configuration according to an embodiment. The data processing device includes a processor 61, a main storage device 62, an auxiliary storage device 63, a device interface 64, and a network interface 65, and these can be realized as a computer device 6 connected via a bus 66. . Further, the data processing device may further include an input device 67 and an output device 68.

  The abnormality detection device 1 according to the present embodiment may be realized by installing a program to be executed in each device in the computer device 6 in advance, or storing the program in a storage medium such as a CD-ROM or a network It may be realized by being distributed via the above and installed in the computer device 6 as appropriate.

  In FIG. 16, the computer device 6 includes one component, but may include a plurality of the same components. In FIG. 16, one computer apparatus is shown, but software may be installed in a plurality of computer apparatuses. A processing result may be generated by each of the plurality of computer devices executing a part of processing different in software. That is, the data processing apparatus may be configured as a system.

  The processor 61 is an electronic circuit including a computer control device and an arithmetic device. The processor 61 performs arithmetic processing based on data or a program input from each device or the like having an internal configuration of the computer device 6, and outputs a calculation result and a control signal to each device. Specifically, the processor 61 executes an OS (Operating System), an application, and the like of the computer device 6 and controls each device configuring the computer device 6.

  The processor 61 is not particularly limited as long as the above processing can be performed. The processor 61 may be, for example, a general purpose processor, a CPU (Central Processing Unit), a microprocessor, a DSP (Digital Signal Processor), a controller, a microcontroller, a state machine, or the like. The processor 61 may be incorporated in an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a programmable logic device (PLD). Further, the processor 61 may be composed of a plurality of processing devices. For example, it may be a combination of a DSP and a microprocessor, or one or more microprocessors that cooperate with the DSP core.

  The main storage device 62 is a storage device that stores instructions executed by the processor 61 and various data. Information stored in the main storage device 62 is directly read out by the processor 61. The auxiliary storage device 63 is a storage device other than the main storage device 62. Note that the storage device means any electronic component capable of storing electronic information. As the main storage device 62, a volatile memory used to store temporary information such as a RAM (Random Access Memory), a DRAM (Dynamic RAM), and an SRAM (Static RAM) is mainly used. The main storage device 62 is not limited to these volatile memories. A storage device used as the main storage device 62 and the auxiliary storage device 63 may be a volatile memory or a non-volatile memory. Non-volatile memory is PROM (Programmable Read Only Memory), EPROM (Erasable PROM), NVRAM (Non-volatile RAM), MRAM (Magnetoresistive RAM), flash memory, and the like. Further, magnetic or optical data storage may be used as the auxiliary storage device 63. As data storage, a magnetic disk such as a hard disk, an optical disk such as a DVD, a flash memory such as a USB, a magnetic tape, or the like may be used.

  Note that if the processor 61 reads or writes information to or from the main storage device 62 or the auxiliary storage device 63 directly or indirectly, the storage device is in electrical communication with the processor. be able to. The main storage device 62 may be integrated with the processor. Again, it can be said that the main storage device 62 is in electrical communication with the processor.

  The network interface 64 is an interface for connecting to a communication network by wireless or wired. The network interface 64 may be one that conforms to existing communication standards. An output result or the like may be transmitted by the network interface 64 to the external device 8 that is communicably connected via the communication network 7.

  The device interface 65 is an interface such as a USB connected to the external device 8 that records output results and the like. The external device 8 may be an external storage medium or a storage such as a database. The external storage medium may be any storage medium such as HDD, CD-R, CD-RW, DVD-RAM, DVD-R, SAN (Storage Area Network). Alternatively, the external device 8 may be an output device. Examples include, but are not limited to, a liquid crystal display (LCD), a cathode ray tube (CRT), a plasma display panel (PDP), and a speaker.

  Further, a part or all of the computer device 6, that is, a part or all of the data processing device may be configured by a dedicated electronic circuit (hardware) such as a semiconductor integrated circuit in which the processor 61 is mounted. Good. The dedicated hardware may be configured in combination with a storage device such as a RAM or a ROM.

  In FIG. 16, one computer apparatus is shown, but software may be installed in a plurality of computer apparatuses. A processing result may be generated by each of the plurality of computer devices executing a part of processing different in software.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof. Of course, it is possible to appropriately combine these embodiments partially within the scope of the present invention.

1: anomaly detection device, 2: factor analysis support device, 3: threshold automatic adjustment device, 10: data acquisition unit, 12: model acquisition unit, 14: performance index calculation unit, 16: performance index estimation unit, 18, anomaly Frequency ratio index generation unit, 20: Abnormality ratio index storage unit, 22: Abnormality ratio distribution index generation unit, 24: Abnormality detection unit, 26: Mode switching unit, 28: Output unit, 30: Abnormality detection result storage unit, 32: Factor analysis support unit, 34: Automatic threshold adjustment unit

Claims (13)

A data acquisition unit for acquiring measurement data;
A performance index calculation unit for calculating a performance index performance value from the measurement data;
A performance index estimator that obtains an estimated value of the performance index from the measurement data based on a normal model learned in advance;
A degree-of-abnormality ratio index that is an index indicating a divergence between the actual value and the estimated value is generated based on a plurality of predetermined threshold values and the existence ratio of the divergence having a value equal to or greater than each of the predetermined threshold values. An abnormality rate ratio index generation unit,
An abnormality detection unit that detects an abnormality based on the abnormality degree ratio index;
An abnormality detection device comprising: An abnormal degree ratio index storage unit for storing the past abnormal degree ratio index;
An anomaly degree ratio distribution index generating unit that generates an anomaly degree ratio distribution index indicating a distribution of past anomaly degree ratio indices based on the stored anomaly degree ratio index;
Further comprising
The abnormality detection unit detects an abnormality by comparing the abnormality degree ratio index and the abnormality degree ratio distribution index.
The abnormality detection device according to claim 1. The actual value and the estimated value are data strings having the same number of elements,
Each element of the abnormality degree ratio index is associated with a plurality of the predetermined threshold and a plurality of predetermined ratios,
The abnormality degree ratio index generation unit calculates deviation data indicating a deviation of each element of the actual value and the estimated value, and among the absolute values of the elements of the deviation data as each element of the abnormality degree ratio index When the number of data that is associated with each element is equal to or greater than the predetermined threshold is greater than or equal to the predetermined ratio that is associated with each element with respect to the number of elements in the data string. The abnormality detection device according to claim 2, wherein 1 predetermined value is stored, and if not, a second predetermined value is stored to generate the abnormality degree ratio index. The abnormality degree ratio index is an abnormality degree ratio matrix that is a matrix having two axes in which a plurality of the predetermined threshold values and a plurality of predetermined ratios are arranged in a predetermined order;
The abnormality degree ratio index generation unit is configured such that, in the abnormality degree ratio matrix, among the absolute values of the elements of the divergence data, the number of pieces of data equal to or more than the predetermined threshold is the predetermined number with respect to the number of elements of the data string. The abnormality detection device according to claim 3, wherein the first predetermined value is stored when the ratio is equal to or greater than the ratio, and the second predetermined value is stored otherwise.   The value of each element of the abnormality degree ratio distribution index is calculated from the value of each element of the abnormality degree ratio index in the past stored in the abnormality degree ratio index storage unit. The abnormality detection device according to any one of the above.   The abnormality detection device according to claim 5, wherein the value of each element of the abnormality degree ratio distribution index is an average value of each element corresponding to the past abnormality degree ratio index.   Among the elements of the abnormality degree ratio index, when the element of the abnormality degree ratio distribution index corresponding to the element having the first predetermined value is equal to or less than a detection threshold that is a threshold for detecting abnormality, The abnormality detection device according to claim 2, which detects the abnormality. An abnormality detection result storage unit that stores the abnormality detection result detected by the abnormality detection unit and the determination result determined by the user based on the abnormality detection result;
The abnormality detection unit stores the abnormality detection result and the determination result in the abnormality detection result storage unit.
The abnormality detection device according to claim 2.   A factor analysis support unit that supports abnormality factor analysis from the abnormality degree ratio index based on the past abnormality detection result and the past determination result stored in the abnormality detection result storage unit. Item 9. The abnormality detection device according to Item 8.   10. The threshold adjustment unit according to claim 8, further comprising a threshold adjustment unit that adjusts the detection threshold based on the past abnormality detection result and the past determination result stored in the abnormality detection result storage unit. Anomaly detection device.   The abnormality detection apparatus according to claim 3, further comprising a mode switching unit that switches between a learning mode for learning the normal model and an operation mode for performing the abnormality detection. Obtaining measurement data;
Calculating a performance index performance value from the measurement data;
Obtaining a performance index estimate from the measurement data based on a pre-learned normal model;
Generating an abnormality degree ratio index that is an index indicating a deviation from the actual value and the estimated value;
Detecting an abnormality based on the abnormality degree ratio index;
An abnormality detection method comprising: A means of acquiring measurement data from a computer,
Means for calculating a performance index performance value from the measurement data;
Means for obtaining an estimated value of the performance index from the measurement data based on a normal model learned in advance;
Means for generating an abnormality rate ratio index that is an index indicating a deviation from the actual value and the estimated value;
Means for detecting an abnormality based on the abnormality degree ratio index;
Means for outputting the detected abnormality;
Program to function as.