WO2019012726A1

WO2019012726A1 - Abnormality detection device, abnormality detection method, and non-transitory computer readable medium

Info

Publication number: WO2019012726A1
Application number: PCT/JP2018/005935
Authority: WO
Inventors: Genta KIKUCHI; Kohei Maruchi; Yohei Hattori
Original assignee: Kabushiki Kaisha Toshiba
Priority date: 2017-07-14
Filing date: 2018-02-20
Publication date: 2019-01-17
Also published as: JP6824121B2; CN109641602A; TW201908900A; JP2019020982A; CN109641602B; TWI678602B

Abstract

Embodiments of the present invention archieve highly accurate abnormality detection.　According to one embodiment, an abnormality detection device includes a data acuqisitor, a performance index calculator, a performance index estimator, an abnormality degree ratio index generator, and an abnormality detector.　The data acquisitor acquires measurement data.　The performance index calculator calculates an actual value of a performance index from the measurement data.　The performance index estimator　acquires an estimated value of the performance index from the measurement data on the basis of a normal model learned in advance.　The abnormality degree ratio index generator generates an abnormality degree ratio index that is an index indicating a residual between the actual value and the estimated value on the basis of a plurality of predetermined thresholds and an existence ratio of the residual having a value equal to or greater than each of the predetermined thresholds.　The abnormality detector detects abnormality on the basis of the abnormality degree ratio index.

Description

ABNORMALITY DETECTION DEVICE, ABNORMALITY DETECTION METHOD, AND NON-TRANSITORY COMPUTER READABLE MEDIUM

　　　Embodiments described herein relate to an abnormality detection device, an abnormality detection method, and a non-transitory computer readable medium.

Background

　　　In a facility such as a plant or a railroad vehicle, or a mobile body, abnormality detection is widely practiced that models an input/output relationship at normal time, performs estimation on the basis of observation data and the model, and uses a residual between an actual value and an estimated value.　At this time, it is common to set a specific threshold for the residual, and raise an alarm in a case where the residual deviates from the threshold.　In general, the threshold is determined on the basis of physical knowledge, or is obtained by assumption of probability distribution or a cross validation method.

　　　For example, a technique has been developed in which a fluctuation value is obtained from a waveform of an electric parameter corresponding to a load of a motor mounted on a machining device, and machining speed is decreased on the basis of the fluctuation value, to minimize interruption of machining and breakage of a tool.　In addition, a technique has been devised in which, in an auxiliary machine attached to a semiconductor manufacturing device, a coordinate point obtained from a plurality of types of parameters and a residual from a reference space are calculated, and the residual is accumulated to perform abnormality detection.　In these techniques, it is necessary to appropriately set two or more thresholds, or it is necessary to cumulatively consider a small residual.　In general, however, it is difficult to appropriately set two thresholds, and accumulation of small residuals increases a possibility of causing a false alarm.

Summary

　　　According to one embodiment, an abnormality detection device includes a data acuqisitor, a performance index calculator, a performance index estimator, an abnormality degree ratio index generator, and an abnormality detector.　The data acquisitor acquires measurement data.　The performance index calculator calculates an actual value of a performance index from the measurement data.　The performance index estimator　acquires an estimated value of the performance index from the measurement data on the basis of a normal model learned in advance.　The abnormality degree ratio index generator generates an abnormality degree ratio index that is an index indicating a residual between the actual value and the estimated value on the basis of a plurality of predetermined thresholds and an existence ratio of the residual having a value equal to or greater than each of the predetermined thresholds.　The abnormality detector detects abnormality on the basis of the abnormality degree ratio index.

FIG. 1 is a block diagram of an abnormality detection device according to an embodiment; FIG. 2 is a flowchart illustrating generation processing of an abnormality degree ratio index according to an embodiment; FIG. 3 is a graph illustrating an example of a measured value, an estimated value, and a residual; FIGS. 4A and 4B are diagrams illustrating examples of the abnormality degree ratio index; FIG. 5 is a diagram illustrating an example of an abnormality degree ratio distribution index; FIGS. 6A and 6B are diagrams illustrating a comparative example of the abnormality degree ratio index and the abnormality degree ratio distribution index; FIG. 7 is a diagram illustrating another comparative example of the abnormality degree ratio index and the abnormality degree ratio distribution index; FIG. 8 is a flowchart illustrating abnormality detection processing according to an embodiment; FIG. 9 is a block diagram of a factor analysis support device according to an embodiment; FIGS. 10A and 10B are diagrams illustrating examples of abnormality degree detection results; FIG. 11 is a diagram illustrating an example of factor analysis; FIG. 12 is a diagram illustrating another example of factor analysis; FIG. 13 is a flowchart illustrating factor analysis processing according to an embodiment; FIG. 14 is a diagram illustrating an example of an automatic threshold adjustment device according to an embodiment; FIG. 15 is a block diagram of an abnormality detection system according to an embodiment; and FIG. 16 is a block diagram illustrating an example of a hardware configuration according to an embodiment.

DETAILED DESCRIPTION

　　　Hereinafter, embodiments will be described in detail with reference to the drawings.　In the following description, as an example, abnormality detection of a railroad vehicle will be described; however, the present invention can be applied not only to the railroad vehicle but also to various facilities and moving bodies.　In each embodiment, in principle, it is assumed that a user is a person who needs to perform abnormality detection, such as an observer, an administrator, or a maintainer; however, the user is not limited thereto.

　　　(First Embodiment)
　　　An abnormality detection device according to a present embodiment generates an abnormality degree ratio index that is an index indicating a residual (discrepancy) between an estimated value and an actual value of a predetermined quantity of state, and detects abnormality on the basis of the abnormality degree ratio index.　FIG. 1 is a block diagram illustrating functions of an abnormality detection device 1 according to the present embodiment.

　　　The abnormality detection device 1 includes a data acquisitor 10, a model acquisitor 12, a performance index calculator 14, a performance index estimator 16, an abnormality degree ratio index generator 18, an abnormality degree ratio index storage 20, an abnormality degree ratio distribution index generator 22, an abnormality detector 24, a mode switcher 26, and an outputter 28.　The abnormality detection device 1 may be installed outside a vehicle, such as in a facility of a railroad operation management company or a driving command office, as a ground device, or may be installed in the vehicle as an on-board device.　An installation form of the abnormality detection device 1 is not particularly limited.

　　　In a case where the abnormality detection device 1 is installed outside the vehicle as the ground device, for example, measurement information and the like of a system inside the vehicle is received via an on-board unit, a transponder ground unit, and an information network on the ground.　That is, the system inside the vehicle transmits data to the information network on the ground via the ground unit or the like, and the abnormality detection device 1 receives the data via the information network on the ground.　For the information network on the ground, a metallic cable, a coaxial cable, an optical cable, a telephone line, wireless, Ethernet (registered trademark), and the like can be used; however, a system of the network does not matter particularly.　The abnormality detection device 1 may acquire the data from various databases (DBs) via the information network on the ground.

　　　In a case where the abnormality detection device 1 is the on-board device, the abnormality detection device 1 acquires the data from the system inside the vehicle via an information network inside the vehicle.　The information network inside the vehicle includes Ethernet and a wireless local area network (LAN); however, networks using other systems may be used.　The abnormality detection device 1 may use the on-board unit or the transponder ground unit to acquire data from the various DBs connected to the information network on the ground.

　　　The data acquisitor 10 acquires sensor data from a sensor data database (DB) 42 that stores data measured by the railroad vehicle or environmental data such as air temperature.　The data may be stored in either the vehicle or the ground device, or may be provided in the abnormality detection device 1.　A sensing period for acquiring the sensor data and a storage medium for storing the data are also not particularly limited.

　　　For example, in a case where attention is paid to deceleration, the sensor data acquired at a short sampling period in millisecond order is stored in the sensor data DB 42.　Examples of data items include information such as time, position information, mileage, speed, a brake notch, a powering notch, brake cylinder (BC) pressure, and air spring (AS) pressure, and a type of the item does not matter as far as a target can be measured practically and calculated from a measured value.　Examples of data stored in a case other than the railroad vehicle include temperature, humidity, flow rate, current, voltage, pressure, position, and the like.

　　　The model acquisitor 12 acquires a normal model created in advance from a normal model DB 44.　The normal model DB 44 is a database that stores regression model constructed and statistics calculated with respect to a predetermined index such as the deceleration, as a normal state.　The index of interest only needs to be an index stored in the sensor data DB 42 or the one that can be calculated from the index described above.　A quantity or timing for acquiring the data is stored in a parameter DB 46, and on the basis of this information, both the data acquisitor 10 and the model acquisitor 12 acquire the data from various databases.

　　　Locations where the normal model DB 44 and the parameter DB 46 are provided do not matter, similarly to the sensor data DB 42.　In a case where the DBs are in the outside, the DBs may be connected to the abnormality detection device 1 via a network.　These DBs can be implemented with a relational database management system or various NoSQL systems; however, other systems can also be used.　As a format for saving the database, XML, JSON, and CSV may be used, and other formats such as a binary format may be used.　It is not necessary that all the databases used for the abnormality detection device 1 are implemented with the same database system and storage format, and those based on a plurality of systems may be mixed.

　　　The performance index calculator 14 calculates an actual value of a performance index desired on the basis of the data acquired.　A calculation result is given as a scalar quantity or as vector data.　For example, in a case where speed of the railroad vehicle is calculated as the performance index, an actual value of the speed is calculated from the data acquired such as acceleration and a moving distance.　However, in a case where data of the speed is acquired by a tachometer or the like, the data of the speed may be used as the actual value of the performance index as it is.　The actual value to be calculated is not limited to the speed, and may be an index that can indicate other performance such as the acceleration, deceleration, moving distance, or the like.

　　　The performance index estimator 16 acquires an estimated value of the performance index on the basis of the data acquired and the normal model acquired.　Similarly to the actual value of the performance index, an acquired result is given as a scalar quantity or as vector data having the same dimension as the actual value.　For example, in a case where the speed of the railroad vehicle is estimated as the performance index, the estimated value of the performance index based on the normal model is acquired from the information such as the powering notch, and the brake notch.

　　　For the normal model, its generation method is not limited, for example, a regression model, a support vector machine, and autoregression.　Optimization may be performed in any method as far as the performance index can be appropriately obtained from the sensor data acquired or the like.　For example, in a case where the deceleration is used as the performance index, the normal model is a model generated from the sensor data or the like acquired in a brake system in a normal state.　At this time, a model is generated such that the data acquired by the data acquisitor 10 is an explanatory variable, whereby it is possible to use the model to acquire a predicted value.

　　　In addition, a normal model may be generated in consideration of weather and the like.　In this case, the normal model is changed in accordance with a parameter such as the weather acquired in the actual value, whereby it is possible to acquire the estimated value in a state closer to a state in which the actual value is calculated.　Information such as the weather is stored together with the sensor data, for example.

　　　The abnormality degree ratio index generator 18 generates the abnormality degree ratio index on the basis of the actual value and the estimated value described above.　The abnormality degree ratio index is generated on the basis of the residual between the actual value and the estimated value.　More specifically, the abnormality degree ratio index is generated on the basis of a ratio (existence ratio) of the number of residual data whose absolute value is equal to or greater than a predetermined threshold with respect to the total number of the residual data calculated from the actual value and the estimated value.　FIG. 2 is a flowchart illustrating processing of generating the abnormality degree ratio index.

　　　First, the abnormality degree ratio index generator 18 calculates the residual data from the estimated value acquired and the actual value calculated (S100).　The residual indicates, for example, a value obtained by subtracting, from a certain element of the estimated value, a corresponding element of the actual value.　As another example, the residual may be a difference (absolute value of the value described above) between the certain element of the estimated value and the corresponding element of the actual value.　That is, the residual data is a scalar quantity, or vector data having the same dimension as the actual value and the estimated value.

　　　FIG. 3 is a graph illustrating the actual value of the performance index (solid line in the upper figure), the estimated value (dashed line in the upper figure), and the residual data (solid line in the lower figure) with respect to the actual and estimated values.　These data indicate, for example, a transition of the deceleration before the railroad vehicle stops.　A railroad vehicle operating at a certain speed starts to decelerate before a stop station by brake operation, and deceleration also drops when the speed slows down to a certain extent, and at timing when the speed becomes 0, the deceleration also becomes 0 and the railroad vehicle stops.

　　　A driver actually performs operation closer to ideal operation by notch operation, whereby the actual value changes smoothly.　Meanwhile, the estimated value changes based on a model when the brake notch is operated.　For example, as a result that an overshoot occurs that does not actually occur, or actually fine notch operation performed to keep the deceleration at a constant value is reflected by the model, the estimated value is in an unstable state.　Even if the model is elaborately generated, these can occur due to a weather condition and a state of a railroad track of each day.　In addition, in a case where there is some abnormality in the brake system, the residual tends to be large.

　　　In FIG. 3, the residual data indicates the transition of the value obtained by subtracting the actual value from the estimated value as described above, and depending on a situation of the residual data, a difference is determined between the actual value and the performance index actually predicted for the operation.　In a case where a certain element of the residual data is large, it can be determined that some abnormality has occurred; however, as described above, the actual value in a case of actual operation does not necessarily appear in accordance with the model, and a slight residual may be permitted in many cases.　The index indicating these residuals becomes abnormality degree ratio index.

　　　Referring back to FIG. 2, next, the abnormality degree ratio index is initialized (S102).　For example, in a case where the abnormality degree ratio index is a matrix, this initialization is operation of replacing components of the matrix with values of 0, NaN, NULL and the like.　Order of these steps S100 and S102 may be switched, and the initialization of the abnormality degree ratio index does not have to be performed during this processing, and may be performed at other appropriate timing.

　　　Next, the processing enters a loop related to the threshold (S104).　The abnormality degree ratio index is generated on the basis of a plurality of the predetermined thresholds.　In the following, as an example, a case will be described where eight predetermined thresholds are used, which are thresholds A, B, ..., H (A < B < ...　< H).

　　　Then, the processing enters a loop related to the ratio to the threshold (S106).　The abnormality degree ratio index is generated on the basis of the plurality of predetermined thresholds as described above, and further is based on a plurality of the predetermined ratios.　In the following, as an example, a case will be described where eight predetermined ratios are used, which are ratios a, b, ..., h (a < b < ...　< h).

　　　In each loop, the abnormality degree ratio index is updated on the basis of values of the residual data calculated, the predetermined thresholds and the predetermined ratios (S108).

　　　FIG. 4A is a diagram illustrating an example of an abnormality degree ratio matrix that represents the abnormality degree ratio index by the matrix.　S104 and S106, which are loop processing steps described above, represent loop processing steps for the components of the matrix.

　　　The components are set to 1 (a first predetermined value) in a case where (the number of elements equal to or greater than the predetermined threshold out of the residual data calculated)/(the total number of elements of the residual data calculated) is equal to or greater than a corresponding one of the predetermined ratios, and otherwise, are updated to be 0 (a second predetermined value).　In a case where the initialization is performed with 0 (second predetermined value), updating does not have to be performed in a case where the element is less than the smallest one of the predetermined ratios.　The initialization in S102 may be omitted on condition that updating of the components performed in S108 is performed for all components.

　　　A more specific example will be described.　It is assumed that the residual data is vector data having 100 elements and the ratio a is 0.05 (5%).　In such a case, in a case where there are five or more pieces of data equal to or greater than the threshold A in the residual data, 1 is assigned to the bottom left component in FIG. 4A, that is, the component of the threshold A and the ratio a.

　　　Next, the component is updated with respect to the threshold A and the ratio b (S106 to S108).　For example, it is assumed that the ratio b is 0.10.　In such a case, in a case where there are ten or more pieces of data equal to or greater than the threshold A in the residual data, 1 is assigned to the component of the second row from the bottom in the leftmost column in FIG. 4A, that is, the component of the threshold A and the ratio b.

　　　The steps S106 to S108 are repeated until the ratio h.　For example, in a case where the ratio h is 0.40 and there are only 37 pieces of data equal to or greater than the threshold A in the residual data, 0 is assigned to the component of the threshold A and the ratio h.

　　　Next, the processing returns to S104, the loop of the ratio described above is repeated from the threshold B.　Then, when the processing up to the threshold H and the ratio h is ended, the components of the abnormality degree ratio matrix as illustrated in FIG. 4A are assigned, and the abnormality degree ratio index is stored (S110), and the processing of calculating the abnormality degree ratio index is ended.

　　　The loop processing can also be speeded up by generating a histogram with the values of the thresholds A, B, ..., H as bins.　For example, the histogram may be generated in the step of calculating the residual value of S100.　The ratios a, b, h, and the like of the example described above are each indicated as an example, and the ratios are not limited thereto.　The ratios may be appropriately changed depending on an application and a factor of abnormality.　For example, if h = 1.0, when there is even one element in which the actual value matches the estimated value, all elements are 0 in the row of h.

　　　FIG. 4B illustrates the abnormality degree ratio index as a vector instead of the matrix.　In this way, the components may be stored as the vector.　As another example, a vector for the number of elements of the thresholds A, B, ..., H, in this case, a vector of eight components, may indicate up to what ratio 1 is assigned.　For example, in a case of the matrix as illustrated in FIG. 4A, short vector data of [7, 7, 6, 5, 3, 2, 1, 0] may be used as the abnormality degree ratio index.　By doing this, it is possible to reduce the data storage area.　In a case of abnormality detection, when the abnormality degree ratio matrix is used and stored, the matrix may be converted into a vector having components for the number of thresholds described above and stored.

　　　Referring back to FIG. 1 and the configuration will be described.　The abnormality degree ratio index storage 20 stores the abnormality degree ratio index generated by the abnormality degree ratio index generator 18.　A unique ID (Identifier) may be stored in association with each abnormality degree ratio index generated.　Further, a stored date and time, and the like may be stored together.

　　　The abnormality degree ratio distribution index generator 22 uses the abnormality degree ratio index stored in the abnormality degree ratio index storage 20, to generate an abnormality degree ratio distribution index.　The abnormality degree ratio distribution index is an index indicating a distribution of the past abnormality degree ratio index based on the past abnormality degree ratio index.　The abnormality degree ratio distribution index indicates that a probability is higher that the same situation has occurred in combination of the threshold and the ratio in the past as a value of the component is closer to 1, and that the situation has not occurred in the past as the value is closer to 0.

　　　FIG. 5 illustrates an abnormality degree ratio distribution matrix generated as the abnormality degree ratio distribution index on the basis of the abnormality degree ratio matrix illustrated in FIG. 4A.　For example, in a case where the abnormality degree ratio matrix is stored as the abnormality degree ratio index in the abnormality degree ratio index storage 20, a sum is calculated for each element of a plurality of the past abnormality degree ratio matrices, and is divided by the total number of matrices from which the sum is calculated.　It is possible to generate the index similarly also in a case of the vector format of FIG. 4B.　In a case where the abnormality degree ratio index is stored as a short vector as described above, the distribution may be obtained by performing expansion when the components are calculated.

　　　Generation of the abnormality degree ratio distribution index may be performed by calculation from all the past abnormality degree ratio indices stored, or may be performed by calculation from the abnormality degree ratio index according to the situation such as the weather or temperature currently desired to be determined.　Further, rather than simply taking an average, a weighted average in which more recent one is weighted greater may be calculated as the abnormality degree ratio distribution index.

　　　The abnormality detector 24 performs abnormality detection on the basis of the abnormality degree ratio index and the abnormality degree ratio distribution index.　FIG. 6A is a diagram illustrating an example of the abnormality degree ratio matrix, and FIG. 6B is a diagram illustrating an example of the abnormality degree ratio distribution matrix.　As illustrated in FIG. 6A, the abnormality degree ratio matrix is represented by binary values of 1 (first predetermined value) or 0 (second predetermined value).　A boundary between 0 and 1 is indicated by a thick line in the figure.

　　　In FIG. 6B, the same bold line as the thick line illustrated in FIG. 6A is drawn.　In FIG. 6B, there is a portion where the thick line exists on the upper side or the right side of the component whose element is 0.　Specifically, in the components of the threshold E and the ratio d, and the threshold F and the ratios c and d, the thick line exists on the upper side or the right side of 0.　In the abnormality degree ratio distribution matrix, the component whose value is 0 is a combination of a threshold and a ratio that has not occurred in the past, so that the combination of these threshold and ratio is different from a distribution of the past residual data.　In a case where there is a situation different from the past data in this way, the abnormality detector 24 detects that there is an abnormality.

　　　In the data of the vector format, the component that is 1 in the abnormality degree ratio index but is 0 in the abnormality degree ratio distribution index, indicates such a situation different from the past data.　In the short vector data format, for example, at each threshold, data indicating up to what ratio the abnormality degree ratio distribution index is distributed, and the abnormality degree ratio distribution index may be compared with each other.　In the example of FIGS. 6A and 6B, the abnormality degree ratio index is [7, 6, 5, 4, 4, 4, 1, 0], and the abnormality degree ratio distribution index is [7, 7, 6, 5, 3, 2, 1, 0], so that it is possible to detect an abnormality at the threshold E and the threshold F.　Also for the ratio, it is possible to read that there is a difference in the fourth, that is, at the ratio d, in the threshold E, and in the third and fourth, that is, in the ratios c and d, in the threshold F.

　　　In the above description, in a case where the abnormality degree ratio index is 1 and the abnormality degree ratio distribution index is 0, that is, in a case where the threshold (hereinafter referred to as the detection threshold) is set to 0, the abnormality degree ratio index is 1, and the abnormality degree ratio distribution index is equal to or less than the detection threshold, it is determined that the combination of the threshold and the ratio is abnormal; however, it is not limited thereto.　For example, in a case where the abnormality degree ratio index is 1 and the abnormality degree ratio distribution index is a predetermined distribution probability, for example, 0.1 or less, that is, in a case where the detection threshold is 0.1, it may be determined that the combination is abnormal.　Further, in a case where the number of components in which the combination between the abnormality degree ratio index and the abnormality degree ratio distribution index are different from each other is a predetermined number or more, for example, three or more, it may be determined that there is an abnormality.

　　　The mode switcher 26 performs switching between a mode in which operation of generating and storing the abnormality degree ratio index is performed and a mode in which the abnormality degree ratio distribution index is used and abnormality detection is also performed.　This switching may be performed manually, may be performed at time specified in advance, or may be performed in different ways.

　　　The outputter 28 receives an abnormality detection result from the abnormality detector 24, and outputs the detection result via an external input/output interface (I/F) 40.　Notification of abnormality output may be performed by sound, may be performed to be visually recognized, may be printed and output, or may be stored as data in a file server or database and output.　FIG. 7 is a diagram illustrating an example of outputting data as visual information.　As illustrated in FIG. 7, by coloring or shading on the abnormality degree ratio distribution matrix, the abnormality may be output to be easy for the user to understand.　Detection of abnormality may be output only in a case where the abnormality is detected, or even in a case where abnormality is not detected, a message may be output indicating that no abnormality has been detected.

　　　FIG. 8 is a flowchart illustrating processing of the abnormality detection device 1 according to the present embodiment.　The processing flow of the abnormality detection device 1 will be described below with reference to the flowchart.

　　　First, the data acquisitor 10 acquires observation data (S200).　In parallel with this, the model acquisitor 12 acquires the learned normal model (S202).

　　　After acquiring the observation data, the performance index calculator 14 calculates the actual value of the performance index on the basis of the observation data acquired (S204).　Further, after acquiring the normal model, the performance index estimator 16 acquires the estimated value of the performance index on the basis of the observation data acquired and the normal model (S206).

　　　The acquisition of the learned normal model only needs to be performed before acquiring the estimated value of the performance index, and order of S200 and S204 is not limited to the above, and may be switched.　In addition, if the data necessary for calculation and estimation is acquired, the order of S204 and S206 does not matter, or the processing steps may be performed in parallel.

　　　Next, the abnormality degree ratio index generator 18 generates the abnormality degree ratio index on the basis of the actual value calculated and the estimated value acquired (S208).

　　　Next, the mode switcher 26 determines whether or not the mode is a learning mode (S210).　In a case where it is determined that the mode is the learning mode (S210: YES), the abnormality degree ratio index generated is stored in the abnormality degree ratio index storage 20, and the abnormality detection processing is ended.　In addition to storing the data, the normal model may be updated by using the actual value calculated by the performance index calculator 14 and stored in the normal model DB 44.

　　　On the other hand, in a case where it is determined that the mode is not the learning mode, that is, the mode is an operation mode (S210: NO), the processing moves into the operation mode.　In the operation mode, first, the abnormality degree ratio distribution index generator 22 generates the abnormality degree ratio distribution index from the data of the past abnormality degree ratio index stored in the abnormality degree ratio index storage 20 (S214).

　　　Next, the abnormality degree ratio index generated is stored in the abnormality degree ratio index storage 20 (S216).　By performing the processing in such order, while preventing that the abnormality degree ratio index itself for which determination whether or not to detect abnormality is desired is reflected in the abnormality degree ratio distribution index, in the operation subsequently performed, the abnormality degree ratio index is reflected in the abnormality degree ratio distribution index.

　　　Next, the abnormality detector 24 detects whether or not there is an abnormality in the observation data acquired on the basis of the abnormality degree ratio index and the abnormality degree ratio distribution index (S218).　Then, in a case where an abnormality is detected, the outputter 28 outputs the detected abnormality, and the processing is ended (S220).

　　　As described above, according to the present embodiment, for the residual between the estimated value and the actual value calculated from the data such as the sensor data acquired, it is determined how much residual data exceeding the predetermined threshold exists, whereby it is possible to perform abnormality detection based on the past data.　By doing this, it is possible to implement a robust and accurate abnormality detection device capable of detecting an abnormal behavior different from a normal behavior in a case where the abnormal behavior occurs.

　　　For the above processing, for example, data is accumulated for each operation of the railroad vehicle (operation from a predetermined station to the next station or the like), and abnormality detection is performed by using the actual value and the estimated value.　By doing this, it is possible to perform abnormality detection in a state in which the situation is close, and it is also possible to detect a local abnormality such as an abnormality that tends to occur between a predetermined station and the next station but does not occur between another station to the next station.

　　　In addition, by detecting the abnormality by the residual between the actual value and the estimated value under the close situation, it is possible to detect an abnormality excluding factors that depend on other factors, for example, factors depending on a location, such as the edge of the railroad track and the connection condition.　As described above, according to the present embodiment, it is possible to implement robust and accurate abnormality detection.

　　　(Second Embodiment)
　　　In the embodiment described above, it is described that the abnormality is detected from the abnormality degree ratio index; however, in a present embodiment, factor analysis of an abnormality is also tried to be performed on the basis of the abnormality degree ratio index generated and the past abnormality degree ratio index.

　　　FIG. 9 is a block diagram illustrating functions of a factor analysis support device 2 according to the present embodiment.　A factor analysis support device 2 includes an abnormality detection result storage 30 and a factor analysis supporter 32, and is a device that supports to analyze a factor of the abnormality from the abnormality degree ratio index.

　　　The abnormality detection result storage 30 stores information as to whether or not it is an abnormality output from the abnormality detector 24, and the ID of the abnormality degree ratio index on which the information is based in association with each other.　Further, in a case where the abnormality detector 24 detects an abnormality, in a case where the user inputs a factor of the abnormality via the input/output I/F 40, the factor is also stored in association with the ID of the abnormality degree ratio index.　That is, the abnormality detection result storage 30 stores the ID of the abnormality degree ratio index, a detection result as to whether or not the abnormality degree ratio index having the ID is abnormal, and the factor of the abnormality of the abnormality degree ratio index having the ID in association with each other.

　　　FIG. 10A is a diagram illustrating an example of a table stored in the abnormality detection result storage 30.　As illustrated in this figure, presence/absence of the abnormality and the factor of the abnormality in a case where there is the abnormality are stored for each ID.　The factor is input by the user; however, the factor is input after, for example, the abnormality is detected by the abnormality detection device 1, maintenance and the like are performed, and the factor is analyzed.　For example, in the abnormality degree ratio index with ID 1, an abnormality is detected, and it is stored that the factor is α.

　　　Even in a case where there is no abnormality such as ID 3, it may be stored.　By storing the case where there is no abnormality as described above, establishing consistency with the data stored in the abnormality degree ratio index storage 20 is facilitated.　In this case, it is also possible to construct the abnormality detection result storage 30 and the abnormality degree ratio index storage 20 as the same database.　By establishing consistency, it is possible for the abnormality degree ratio distribution index generator 22 to create the abnormality degree ratio distribution index without using past abnormal cases.　More specifically, for example, when the abnormality degree ratio distribution index is generated, the data determined to be abnormal is not reflected, whereby it is possible to improve accuracy of abnormality detection using the abnormality degree ratio distribution index.　In a case where the factor is not input, data such as "factor: not input" may be stored, as in the data with ID 6.　In a case of unknown, data such as "factor: unknown" may be stored.

　　　On the other hand, in the case where there is no abnormality, the ID itself need not be stored.　FIG. 10B is a diagram illustrating another example of the table stored in the abnormality detection result storage 30.　In this case, the data with ID 3 is not stored.　By doing this, the abnormality detection result storage 30 may store the ID and the factor in a case where there is the abnormality.　If the data is not stored in the case where there is no abnormality, it is possible to reduce the area of the table.

　　　In a case where an abnormality is detected, the factor analysis supporter 32 supports factor analysis of the abnormality in the abnormality degree ratio index in which the abnormality is detected, on the basis of information on the past abnormality degree ratio index corresponding to the ID stored in the abnormality detection result storage 30.　Various methods are conceivable as support methods.　The support methods may be various clustering methods, or may be various machine learning methods, and not limited thereto, any other methods may be used as far as the methods can classify the factors.

　　　For example, it is possible to use the k-nearest neighbor algorithm by considering the abnormality degree ratio index as a vector of the number of rows times the number of columns.　FIG. 11 is a diagram illustrating an example of the result in a case where the k-nearest neighbor algorithm is used.　The ID of the abnormality degree ratio index, a Euclidean distance between the abnormality degree ratio index having the ID and an abnormality degree ratio index of interest, and the factor of the abnormality of the abnormality degree ratio index having the ID are displayed.　Besides, items such as time and weather that aid in factor analysis may also be displayed.　In addition, the distance may be measured in consideration of information such as the time and weather.　For example, in a case of FIG. 11, a factor β that appears more frequently in the closer distance can be determined as the factor of the abnormality of the abnormality degree ratio index of interest.

　　　This result is output to the user via the outputter 28.　The user can determine that the possibility that the factor of the abnormality is β is high, and perform maintenance and the like.　Further, after the factor can be clarified, the user can also perform feedback of the factor of the abnormality of the abnormality degree ratio index of interest to the abnormality detection result storage via the input/output I/F 40.　By updating the data in this way, it is also possible to improve accuracy of factor analysis.　In addition, in a case where an abnormality cannot be found, feedback indicating that there is no abnormality, or feedback indicating that the factor is unknown may be performed, and used for future abnormality detection or analysis support.

　　　The factor analysis supporter 32 can use various other indexes.　For example, the distance used for the analysis is not limited to the Euclidean distance, and a Hamming distance may be used, or considering it as a covariance matrix, a Mahalanobis distance may be used.

　　　Further, not limited to the k-nearest neighbor algorithm, visualization may be made by using other methods such as a multidimensional scaling, t-distributed stochastic neighbor embedding (t-SNE), and principle component analysis (PCA).　FIG. 12 is a diagram illustrating an example in a case where the multidimensional scaling is used.　The sample with a shorter distance is arranged closer, and the color and shape of the pointer can be changed for each factor, so that visual grasp is possible.　In a case where it is assumed that the cross mark is a newly detected abnormal case, the user can estimate that the factor of the abnormality is β by viewing this graph.

　　　Further, not limited to these methods, a method based on machine learning or the like may be used.　For example, a support vector machine may be used, or a random forest may be used.

　　　As described above, for the index used for factor analysis, the abnormality degree ratio index itself may be used.　Alternatively, the data may be used based on the difference between the abnormality degree ratio index and the abnormality degree ratio distribution index in the first embodiment described above, for example, the data in which only the components of the threshold E and ratio d, and the threshold F and ratios c and d are set to 1, and the remaining components are set to 0.　In this case, the model used for the analysis is generated on the basis of the past abnormality degree ratio index that is compared with the same abnormality degree ratio distribution index.

　　　FIG. 13 is a flowchart illustrating processing of the factor analysis support device 2.

　　　When the abnormality detector 24 detects an abnormality with respect to the data of interest, the factor analysis supporter 32 acquires the ID of the abnormality degree ratio index in which the abnormality stored in the abnormality detection result storage 30 has occurred, and extracts each abnormality degree ratio index from the abnormality degree ratio index storage 20 on the basis of the ID (S300).

　　　Next, the factor analysis supporter 32 uses the abnormality degree ratio index of the data of interest to analyze the factor on the basis of the abnormality degree ratio index extracted and the factor of the abnormality associated with each abnormality degree ratio index (S302).

　　　Next, the outputter 28 outputs a result analyzed by the factor analysis supporter 32 via the input/output I/F 40 (S304).

　　　In a case where the factor of the abnormality can be analyzed, by performing feedback of the analysis result of the factor, accuracy of the analysis from the next is further improved (S306).

　　　In a case where a learned model is used for factor analysis, the factor analysis support device 2 may store the model in a learned model storage (not illustrated) and use the model for analysis from the next data.

　　　As described above, according to the present embodiment, the abnormality detection device 1 is capable of not only detecting an abnormality but also supporting analysis of the factor.　By outputting a candidate for factor analysis in this way, the user can reduce temporal and monetary costs for analyzing the factor.

　　　For example, as a factor of the brake system of the railroad vehicle, in a case where there is an abnormality in the brake shoe, factors are exist such as a factor on the brake side such as a change in pressure due to air leakage, and a factors on the system side rather than the brake body such as a mistake in the setting value, and a mistake in signal transmission on the transmission path, or a factor that is not an abnormality of the brake originally such as an abnormality due to a condition of the railroad track.　In such a case, it is possible to obtain a factor from the abnormality degree ratio index.

　　　(Third Embodiment)
　　　In the embodiment described above, the abnormality is detected from the data acquired; however, the abnormality detection device 1 according to a present embodiment adjusts the detection threshold that is the predetermined value in the embodiment described above, on the basis of the detection result.

　　　FIG. 14 is a block diagram illustrating functions of an automatic threshold adjustment device 3 according to the present embodiment.　The automatic threshold adjustment device 3 includes an automatic threshold adjuster 34.

　　　The automatic threshold adjuster 34 sets an appropriate detection threshold on the basis of the data stored in the abnormality detection result storage 30.　In a case where a result that is output as abnormal by the abnormality detection device 1 and is determined as abnormal by the user has already been stored in the abnormality detection result storage 30, the detection threshold is adjusted such that the probability of detecting abnormality is increased for the abnormality degree ratio index used for abnormality detection.

　　　In this adjustment, for example, the detection threshold may be adjusted with respect to the entire abnormality degree ratio index, or in the abnormality degree ratio index determined to be abnormal, in a case where comparison is performed with the abnormality degree ratio distribution index, the detection threshold for a characteristic element may be adjusted.

　　　For example, it is assumed that the situation described above occurs in a case where the abnormality degree ratio index is the one illustrated in FIG. 6A.　Compared with the abnormality degree ratio distribution index illustrated in FIG. 6B, abnormality is detected in the elements of the threshold E and ratio d, and the threshold F and ratios c and d.　In such a case, from the next, by increasing the detection threshold of these three elements, for example, changing from 0 to 0.1, even in a case where these three elements in the abnormality degree ratio distribution index are no longer 0 in the future, it is possible to detect an abnormality when the abnormality degree ratio index illustrated in FIG. 6A is input.

　　　As described above, according to the present embodiment, the abnormality detection device 1 can not only detect abnormality, but also detect various abnormalities more flexibly by adjusting the threshold by the automatic threshold adjuster 34.

　　　(Fourth Embodiment)
　　　It is also possible to form an abnormality degree detection system 4 including all of the abnormality detection device 1, the factor analysis support device 2, and the automatic threshold adjustment device 3 in the embodiments described above.　FIG. 15 is a block diagram illustrating functions of the abnormality degree detection system 4.

　　　By forming the system in this way, an abnormality degree ratio distribution index generator 22 can use the data stored in the abnormality detection result storage 30, to extract the abnormality degree ratio index at the normal time and generate an appropriate abnormality degree ratio distribution index.　With such a configuration, it is possible to perform robust abnormality detection using a distribution of the residual, and to support factor analysis of the abnormality that has occurred.

　　　FIG. 16 is a block diagram illustrating an example of a hardware configuration according to an embodiment.　A data processing device can be implemented as a computer device 6 including a processor 61, a main storage device 62, an auxiliary storage device 63, a network interface 64, and a device interface 65, which are connected together via a bus 66.　In addition, the data processing device may further include an input device 67 and an output device 68.

　　　The abnormality detection device 1 according to the present embodiment may be implemented by installing in advance a program executed in each device in the computer device 6, or by storing the program in a storage medium such as a CD-ROM, or distributing the program via a network, and installing the program in the computer device 6 as appropriate.

　　　The computer device 6 includes each one of the constituents; however, the computer 6 may have a plurality of the same constituents.　In addition, one computer device is illustrated; however, software may be installed in a plurality of the computer devices.　Each of the plurality of computer devices may execute processing of a different part of the software to generate a processing result.　That is, the data processing device may be configured as a system.

　　　The processor 61 is an electronic circuit including a control device and a computing device of a computer.　The processor 61 performs arithmetic processing on the basis of data and programs input from each device or the like of the internal configuration of the computer device 6, and outputs calculation results and control signals to each device or the like.　Specifically, the processor 61 executes an operating system (OS) of the computer device 6, an application, and the like, and controls devices configuring the computer device 6.

　　　The processor 61 is not particularly limited to this as far as the processing described above can be performed.　The processor 61 may be, for example, a general purpose processor, a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a controller, a microcontroller, a state machine, or the like.　In addition, the processor 61 may be incorporated in an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a programmable logic device (PLD).　In addition, the processor 61 may be configured from a plurality of processing devices.　For example, the processor 61 may be a combination of the DSP and the microprocessor, or may be one or more microprocessors working with a DSP core.

　　　The main storage device 62 is a storage device that stores instructions executed by the processor 61, various data, and the like, and information stored in the main storage device 62 is directly read by the processor 61.　The auxiliary storage device 63 is a storage device other than the main storage device 62.　The storage device is intended to mean any electronic component capable of storing electronic information.　Volatile memory used for temporary storage of information such as random access memory (RAM), dynamic RAM (DRAM), or static RAM (SRAM) is mainly used as the main storage device 62; however, in the embodiment of the present invention, the main storage device 62 is not limited to these volatile memories.　The storage device used as the main storage device 62 and the auxiliary storage device 63 each may be a volatile memory or a nonvolatile memory.　The nonvolatile memory is programmable read only memory (PROM), erasable PROM (EPROM), non-volatile RAM (NVRAM), magnetoresistive RAM (MRAM), flash memory, or the like.　As the auxiliary storage device 63, magnetic or optical data storage may be used.　As the data storage, a magnetic disk such as a hard disk, an optical disk such as a DVD, a flash memory such as a USB memory, a magnetic tape, or the like may be used.

　　　If the processor 61 reads or writes information directly or indirectly to the main storage device 62 or the auxiliary storage device 63, or both, it can be said that the storage device communicates electrically with the processor.　The main storage device 62 may be integrated in the processor.　Also in this case, it can be said that the main storage device 62 communicates electrically with the processor.

　　　The network interface 64 is an interface for connecting to a communication network by wireless or wire.　As for the network interface 64, one conforming to the existing communication standard can be used.　An output result or the like may be transmitted to an external device 8 communicably connected via a communication network 7 by the network interface 64.

　　　The device interface 65 is an interface such as USB connected to the external device 8 that records the output result and the like.　The external device 8 may be an external storage medium or a storage such as a database.　The external storage medium may be any arbitrary storage medium such as a HDD, CD-R, CD-RW, DVD-RAM, DVD-R, storage area network (SAN) and the like.　Alternatively, the external device 8 may be an output device.　The output device is, for example, a liquid crystal display (LCD), a cathode ray tube (CRT), a plasma display panel (PDP), a speaker, or the like, but it is not limited thereto.

　　　Part or all of the computer device 6, that is, part or all of the data processing device may be configured by a dedicated electronic circuit (hardware) such as a semiconductor integrated circuit on which the processor 61 and the like are mounted.　The dedicated hardware may be configured in combination with the storage device such as the RAM, ROM, and the like.

　　　In FIG. 16, one computer device is illustrated; however, software may be installed in a plurality of the computer devices.　Each of the plurality of computer devices may execute processing of a different part of the software to generate a processing result.

　　　While certain embodiments have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions.　Indeed, the novel embodiments described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the embodiments described herein may be made without departing from the spirit of the inventions.　The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.

EXPLANATION FOR SIGN

1　　 ABNORMALITY DETECTION SYSTEM
2　　 FACTOR ANALYSIS SUPPORT DEVICE
3　　 AUTMATIC THRESHOLD ADJUST DEVICE
10　　DATA ACQUISITOR
12　　MODEL ACQUISITOR
14　　PERFORMANCE INDEX CALCULATOR
16　　PERFORMANCE INDEX ESTIMATOR
18　　ABNORMALITY DEGREE RATIO INDEX GENERATOR
20　　ABNORMALITY DEGREE RATIO INDEX STORAGE
22　　ABNORMALITY DEGREE RATIO DISTRIBUTION INDEX GENERATOR
24　　ABNORMALITY DETECTOR
26　　MODE SWITCHER
28　　OUTPUTTER
30　　ABNORMALITY DETECTION RESULT STORAGE
32　　FACTOR ANALYSIS SUPPORTER
34　　AUTOMATIC THRESHOLD ADJUSTER
40　　INPUT/OUTPUT I/F
42　　SENSOR DATA DB
44　　NORMAL MODEL DB
46　　PARAMETER DB
6　　 COMPUTER DEVICE
61　　PROCESSOR
62　　MAIN STORAGE DEVICE
63　　AUXILIARY STORAGE DEVICE
64　　NETWORK INTERFACE
65　　DEVICE INTERFACE
66　　BUS
7　　 COMMUNICATION NETWORK
8　　 EXTERNAL DEVICE

Claims

　　　An abnormality detection device comprising:
　　　a data acquisitor that acquires measurement data;
　　　a performance index calculator that calculates an actual value of a performance index from the measurement data;
　　　a performance index estimator that acquires an estimated value of the performance index from the measurement data on the basis of a normal model learned in advance;
　　　an abnormality degree ratio index generator that generates an abnormality degree ratio index that is an index indicating a residual between the actual value and the estimated value on the basis of a plurality of predetermined thresholds and an existence ratio of the residual having a value equal to or greater than each of the predetermined thresholds; and
　　　an abnormality detector that detects abnormality on the basis of the abnormality degree ratio index.
　　　The abnormality detection device according to claim 1, further comprising:
　　　an abnormality degree ratio index storage that stores the past abnormality degree ratio index; and
　　　an abnormality degree ratio distribution index generator that generates an abnormality degree ratio distribution index indicating a distribution of the past abnormality degree ratio index on the basis of the abnormality degree ratio index stored, wherein
　　　the abnormality detector compares the abnormality degree ratio index with the abnormality degree ratio distribution index to detect abnormality.
　　　The abnormality detection device according to claim 2, wherein
　　　the actual value and the estimated value are data arrays each having identical number of elements,
　　　the elements of the abnormality degree ratio index is associated with the respective plurality of predetermined thresholds and a respective plurality of predetermined ratios,
　　　the abnormality degree ratio index generator calculates residual data indicating residuals of elements between the actual value and the estimated value, and as the elements of the abnormality degree ratio index, in a case where a number of pieces of data equal to or greater than the respective predetermined thresholds associated with the elements, out of absolute values of the elements of the residual data, is equal to or greater than a corresponding one of the predetermined ratios associated with the elements with respect to the number of elements of the data arrays, stores a first predetermined value, and otherwise, stores a second predetermined value, to generate the abnormality degree ratio index.
　　　The abnormality detection device according to claim 3, wherein
　　　the abnormality degree ratio index is an abnormality degree ratio matrix that is a matrix including two axes in which the plurality of predetermined thresholds and the plurality of predetermined ratios are arranged in a predetermined order, and
　　　the abnormality degree ratio index generator, in a case where the number of pieces of data equal to or greater than the respective predetermined thresholds is equal to or greater than the corresponding one of the predetermined ratios with respect to the number of elements of the data arrays, out of the absolute values of the elements of the residual data, in the abnormality degree ratio matrix, stores the first predetermined value, and otherwise, stores the second predetermined value.
　　　The abnormality detection device according to any one of claims 2 to 4, wherein
　　　values of elements of the abnormality degree ratio distribution index are calculated from values for elements of the past abnormality degree ratio index stored in the abnormality degree ratio index storage.
　　　The abnormality detection device according to claim 5, wherein
　　　the values of the elements of the abnormality degree ratio distribution index are each an average value of corresponding elements of the past abnormality degree ratio index.
　　　The abnormality detection device according to any one of claims 2 to 6, wherein
　　　abnormality is detected in a case where an element of the abnormality degree ratio distribution index corresponding to an element having a first predetermined value, out of elements of the abnormality degree ratio index, is equal to or less than a detection threshold that is a threshold for detecting abnormality.
　　　The abnormality detection device according to any one of claims 2 to 7, further comprising
　　　an abnormality detection result storage that stores an abnormality detection result detected by the abnormality detector and a determination result determined by a user on the basis of the abnormality detection result, wherein
　　　the abnormality detector stores the abnormality detection result and the determination result in the abnormality detection result storage.
　　　The abnormality detection device according to claim 8, further comprising
　　　a factor analysis supporter that supports factor analysis of abnormality from the abnormality degree ratio index on the basis of the past abnormality detection result and the past determination result stored in the abnormality detection result storage.
　　　The abnormality detection device according to claim 8 or 9, further comprising
　　　a threshold adjuster that adjusts the detection threshold on the basis of the past abnormality detection result and the past determination result stored in the abnormality detection result storage.
　　　The abnormality detection device according to any one of claims 3 to 8, further comprising
　　　a mode switcher that performs switching between a learning mode in which the normal model is learned and an operation mode in which the abnormality detection is performed.
　　　An abnormality detection method comprising:
　　　acquiring measurement data;
　　　calculating an actual value of a performance index from the measurement data;
　　　acquiring an estimated value of the performance index from the measurement data on the basis of a normal model learned in advance;
　　　generating an abnormality degree ratio index that is an index indicating a residual between the actual value and the estimated value; and
　　　detecting abnormality on the basis of the abnormality degree ratio index.
　　　A non-transitory computer readable medium storing a program for causing a computer to function as:
　　　a unit that acquires measurement data;
　　　a unit that calculates an actual value of a performance index from the measurement data;
　　　a unit that acquires an estimated value of the performance index from the measurement data on the basis of a normal model learned in advance;
　　　a unit that generates an abnormality degree ratio index that is an index indicating a residual between the actual value and the estimated value;
　　　a unit that detects abnormality on the basis of the abnormality degree ratio index; and
　　　a unit that outputs the abnormality detected.