System and method for detecting anomalies across heterogeneous rail subsystems of a rail control system

Abstract

The invention relates to a system (101) and a method for detecting anomalies in a set of heterogeneous modules Mi (M1, M2, M3) of a rail control system (10), the method (200) comprising: - for each module Mi (M1, M2, M3) of said set, acquiring, in function of the time, values of at least one variable VMi (VM1, ... , VM5) that characterizes a current working of said module Mi (M1, M2, M3); - temporally slicing the temporal evolution of all variables VMi (VM1, ... , VM5) for creating a succession of temporal observation windows (W1,W2,W3); - using each temporal observation window (W1,W2,W3) as an input to a k-Nearest Neighbors time series regression algorithm, hereafter "kNN" algorithm, wherein said kNN algorithm is configured for determining similarities between the received temporal observation window (W1,W2,W3) and a predefined set of reference temporal observation windows; - automatically outputting, via an output interface, a message or signal identifying each module (M1, M2, M3) for which an anomaly has been detected.

Description

Technical Field

[0001] The present invention proposes a system and a method for detecting anomalies across heterogeneous rail subsystems of a rail control system. More precisely, the present invention concerns anomalies, e.g. failures or faults, that may occur during operation of said heterogeneous rail subsystems.Background Art

[0002] Nowadays, rail control systems became more and more complex, comprising various hardware devices typically installed on the trackside and / or on-board, interconnected via communication networks, running different software, and exchanging large amount of data. Typically, a rail control system comprises heterogeneous rail subsystems, such as a traffic management system, a train control system, an interlocking system, a communication system, that cooperate with each other for enabling a safe operation of trains on a railway network, the whole being under control of said rail control system. Monitoring and detecting anomalies or failures within such a complex rail control system are then of crucial importance for ensuring the safety of the railway infrastructure, as well as a safe motion of the trains moving on the railway network. However, the complexity of rail control systems makes the monitoring and detection of such anomalies / failures very challenging. For instance, when a new version of a hardware device or a new software is installed in a first rail subsystem, e.g. an interlocking system, then involuntary changes in the behavior pattern of certain variables outputted by said hardware device or software, or involuntary changes in relationships between outputted variables, may lead to subsequent errors in a second rail subsystem, e.g. a train control system. Usually, such errors are then only detected when testing different scenarios with the new version of the hardware or software, but unfortunately, said scenarios are not exhaustive, and errors may still happen.Summary of Invention

[0003] An objective of the present invention is to propose a method and a system for detecting anomalies across heterogeneous rail subsystems of a rail control system, which are able to efficiently trace a cause or source of a detected anomaly.

[0004] This objective is achieved by the measures taken in accordance with the independent claims. Further advantageous embodiments are proposed by the dependent claims.

[0005] More precisely, the present invention concerns a method, preferentially a computer-implemented method, for detecting anomalies in a set of N heterogeneous modules M i which are rail subsystems of a rail control system, with i=1,...,N, N being the number of modules of the set (i.e. N is an integer greater than 1, typically greater than 10), each module M i of said set comprising typically hardware and / or software components. Each module represents thus a different rail subsystem, like an interlocking system, a train door control system, a signaling system, a switch system, a rail crossing system, etc., whose correct working is important for enabling a smooth, efficient, and safe working of the global railway network controlled by the rail control system. Typically, each module M i is able to communicate via a communication network for sending and / or receiving data, which enable notably to monitor the current working of each module.

[0006] According to the present invention, the method comprises: for each module M i of said set, acquiring, in function of the time, values of at least one variable V Mi that characterizes a current working of said module M i . In other words, for each variable V Mi , the acquired values form a time series representing a temporal evolution of the variable V Mi . Said variable is for instance a physical and quantitative parameter characterizing the module, like a temperature, voltage, current, pressure, etc. whose value can be measured, or said parameter might represent a working status that can be encoded using for instance binary values, or any other parameter that might characterize a current technical working of the module; temporally slicing the temporal evolution of all variables V Mi , i.e. their respective time series, into temporal slices for creating a succession of temporal observation windows, i.e. said slices, wherein each temporal observation window provides a view of the values of all variables during a given time interval that corresponds to the temporal width (or length) of the slice, wherein each temporal observation window comprises thus, for each variable V Mi , the temporal evolution - called hereafter temporal slice S VMi,k - of said variable V Mi during a time interval T k of duration D k that corresponds to said temporal width of the slice; using each temporal observation window as a separate (i.e. individual) input to a k-Nearest Neighbors time series regression algorithm, hereafter "kNN" algorithm, wherein said kNN algorithm is configured for receiving said temporal observation window as input and for determining similarities between the received temporal observation window and a predefined set of reference temporal observation windows, wherein each reference temporal observation window comprises, for each variable, a reference temporal slice free of anomalies that has been acquired during a previous time interval. Preferentially, for determining said similarities, said kNN algorithm is configured for performing a multivariate distance calculation that uses notably Dynamic Time Warping (DTW) and takes into account all variables together of the inputted temporal observation window to find the most similar reference temporal observation window from said predefined set, wherein if the absolute value of a multivariate distance d1 calculated for the inputted temporal observation window is smaller than a predefined distance threshold ε, then said inputted temporal observation window is considered as free of any anomaly, otherwise, if said absolute value of the multivariate distance d1 obtained for the inputted temporal observation window is greater or equal to said predefined distance threshold ε, then the kNN algorithm is configured for automatically performing an univariate distance calculation, using notably DTW, wherein each of the temporal slices of said inputted temporal observation window is used as new input (i.e. as an independent and individual new input) to the kNN algorithm, which is further configured for determining, for each of said new inputs, and thus for each variable within said inputted temporal observation window, the most similar reference temporal slice out of a predefined set of reference temporal slices comprised in the reference temporal windows, wherein if the absolute value of an univariate distance d1' obtained for a given new input (i.e. one of said variables of the inputted temporal observation window) is smaller than a predefined distance threshold ε', then said new input is considered as free of any anomaly, otherwise, if the absolute value of said univariate distance d1' is greater or equal to said predefined distance threshold ε' for said new input, then the kNN algorithm is configured for outputting a message or signal indicating an anomaly for the corresponding module, i.e. the module for which the temporal evolution of the variable resulted in said anomaly, i.e. for which the variable values corresponding to said new input have been acquired. This enables to very efficiently identify, within a temporal observation window, the one or more variables that introduce a deviation with respect to reference data stored in the reference temporal window, and thus the one or more modules which show an anomaly, i.e. an anormal behavior; automatically outputting, via an output interface, a message or signal identifying each module for which an anomaly has been detected.

[0007] The present invention concerns also a system for detecting anomalies in a set of N heterogeneous modules M i of a rail control system, the system comprising: a first interface for acquiring, in function of the time t and for each module M i , values of at least one variable V Mi that characterizes a current working of said module M i , wherein, for each variable V Mi , the acquired values form a time series representing a temporal evolution of the variable V Mi ; a processing unit, comprising typically a processor, connected to a communication network to which the modules M i belong to, the processing unit being configured for processing the acquired variable values; a memory for storing the acquired values of the variables; an output interface, which can be the same as the first interface, configured for outputting, a message or signal identifying each module for which an anomaly has been detected; the system being configured for implementing the steps of the previously described method.Description of Embodiments

[0008] The present invention enables to detect an anomaly in real time across heterogeneous modules of a rail control system in charge of managing traffic on a railway network through said heterogeneous modules. Advantageously, the present invention does not only enable to detect said anomaly, but also to trace back the potential cause or source of the detected anomaly. This enables an operator to correct the cause or source of an anomaly so that it does not appear again. Preferentially, the steps of the method are performed in real time, enabling thus a real time detection of anomalies.

[0009] For this purpose, the present invention proposes to acquire, for each module M i , and notably in real time, the values of at least one variable in function of the time. The variable values that are collected or acquired or measured by the system according to the invention are preferentially data values of log files, and / or data values of JMS files (i.e. "Java Message Service" files), and / or data values of module configuration files, and / or quantitative values measured or outputted by the module M i or by a sensor configured for monitoring said variable for the module M i . Typically, the system according to the invention is able to extract data values from said log files, JMS files, and configuration files. For instance, data values of log files might be collected for each or some of said modules M i , wherein log files of the module M i are configured for recording events (e.g. activity and / or operation of the module M i ) taking place at said module M i in function of the time, the data values of the log files comprising thus information about the activity and / or operation of the module M i in connection with the time at which said activity and / or operation took place for the module M i . For instance, data values of JMS files might be collected for each or some of said modules M i . The JMS files are typically messages transmitted between the module M i at different times. Collecting the values of JMS files makes it possible for the system according to the invention to detect if a communication between two modules, wherein at least one of said two modules sends a JMS file to the other one of said two modules, failed or comprised an error at a given time. The data values of the JMS file comprise or encapsulate typically information about the sender and / or recipient of the JMS file, and a time at which the JMS file was sent, and optionally an XML-type payload notably used for inter-module communication. Preferentially, the content and nested structure of this payload are dynamic and vary depending on the modules involved. For instance, some modules may include hundreds of variables with corresponding values, such as guided vehicle ID, track ID, guided vehicle position, movement authority details, operational statuses of various internal systems, and more. These parameters might be used by the system for ensuring a seamless coordination and functionality across the whole system. Preferentially, data values of configuration files might be collected for each or some of said modules M i , wherein the configuration file of the module M i is configured for defining the technical operating parameters of the module M i at a given time. The data values of the configuration file comprise typically values of operating parameters of the module M i at the time said values are collected by the system according to the invention. Optionally, the data values of the configuration file may comprise values of a default configuration of the module M i , which can be used by the system according to the invention for comparison purposes with values of the operating parameters corresponding to a time for which a failure occurs. This might enable to detect if a configuration of the module was inappropriate at the time of said failure. The values of the operating parameters of the module M i may provide a view of the working configuration of the module M i at the time of collection or acquisition of said values.

[0010] According to the present invention, the values collected by the system according to the invention for each variable V Mi provide a view of the working state of the module M i in function of the time, i.e. a temporal evolution of said variable. The present invention proposes to slice the temporal evolution of all variables according to common temporal slices, i.e. each temporal slice is a temporal observation window that provides a view of the working state of all modules of the rail control system during a given period of time or time interval. The duration of the temporal observation windows might differ from one another, i.e. the time interval associated to a temporal observation window might differ or not from the time interval associated to another temporal observation window. Preferentially, said temporal observations windows are disjoint windows, i.e. the time interval during which the variables are observed in a first temporal observation window is disjoint from the time interval during which said variables are observed in a second temporal observation window. In order to implement said slicing, the system according to the invention is preferentially configured for automatically detecting a pattern in the values acquired for at least one of the variables. For detecting said pattern, the system according to the invention may determine for instance for one or several variables, values that exceed a predefined threshold, or it might compare a series of acquired values to a series of predefined values to determine if the acquired values deviate from the predefined values, or it can calculate a mean value or any other statistic value for the values acquired for a variable and automatically determine if there is a deviation from said mean value or statistic value. This might be performed for all or a set of the variables. For instance, the system might search for patterns only for the values of variables of a predefined group of modules. The system is further configured for automatically setting a time interval encompassing the values for which said pattern has been detected, and for creating, for said time interval, a temporal observation window comprising corresponding temporal slices for all variables. Typically, the system may automatically detect or identify a start time t start and an end time t end of a detected pattern, creates then a time interval [t start , t end ], and extracts for all variables the values acquired during said time interval in order to create said temporal slices for said identified time interval. Alternatively, or additionally, the system may randomly define temporal observation windows. In particular, temporal observation windows for which no anomaly was detected might be stored by the system and flagged as reference temporal observation windows, for instance after acknowledgment by an operator. This enables to automatically increase the amount of historical data for which no anomaly was detected.

[0011] Preferentially, the system is configured for dynamically populating a matrix A with each temporal observation window that is created, wherein said matrix A is prepopulated with said reference temporal observation windows and used as input to the kNN algorithm. Preferentially, the matrix A is a three dimensional (3D) matrix of dimensions V × D × S, wherein V represents the number of variables for which a temporal evolution is acquired, D represents the time (i.e. duration) of the longest temporal slice among all temporal slices populating the matrix A, and S represents the number of temporal slices populating the matrix A for each variable, i.e. a current highest value of k (i.e. at the time of performing the anomaly detection), wherein matrix elements of the matrix A are defined as A_v,d,kwith v=1,...,V, d=0,...,D, and k=1,...,S. According to this representation, each vertical layer of the matrix represents one of said temporal observation window or reference temporal observation window, and thus a view of the working of all modules during a given time interval corresponding to the temporal length of the considered temporal observation window or reference temporal observation window.

[0012] According to the present invention, the kNN algorithm is preferentially a "1-NN" (i.e. k=1) algorithm, focusing on finding the closest match in the reference temporal slices: this means that after the multivariate analysis, the kNN algorithm runs another distance calculation on each individual variable within the same temporal observation window and against reference temporal slices stored for the same variable in said reference temporal observation windows. However, the present invention may apply to other kNN algorithm with k>1.

[0013] Further, the system according to the invention is preferentially configured for tracking and / or storing, for each temporal slice, meta-information, comprising the effective duration of the slice, the matrix vertical layer to which it belongs (i.e. its associated index k), and a flag configured for indicating whether it can be used by the kNN algorithm as a reference temporal slice. In particular, the kNN algorithm is configured for flagging each temporal slice for which no anomaly is detected, so that a database of historical data free of anomaly might be constructed and used for the analysis of new incoming temporal observation windows.

[0014] Preferentially, the predefined set of reference temporal windows comprises only reference temporal windows whose duration is equal to the duration of the temporal observation window received as input by the kNN plus a time amount ΔD1, which can be predefined in the memory of the system, e.g. 10 ms < ΔD1 < 1000 ms. Similarly, said predefined set of the reference temporal slices comprises for instance all reference temporal slices associated to the same variable as said new input (i.e. as the inputted temporal slice), or only reference temporal slices associated to the same variable as said new input and whose effective duration is equal to the effective duration of the new input plus a time amount ΔD2, which can be predefined in the memory of the system, e.g. 10 ms < ΔD2 < 1000 ms. In particular ΔD1= ΔD2.

[0015] Preferentially, the system according to the invention is configured for creating and / or storing a hierarchical representation of the set of modules M i , said modules being preferentially automatically classified or grouped by the system according to the invention in different clusters in function of their interdependence by considering notably which module controls which other module(s), which module directly communicate with which other module(s). The system is then configured for automatically identifying in said hierarchical representation, each module for which an anomaly is detected, and for displaying the smallest part of said hierarchical representation comprising all clusters that comprise a module for which an anomaly has been detected, providing therefore a comprehensive view of an impact of an anomaly on the rail control system.Brief Description of the Drawing

[0016] Further aspects of the present invention will be better understood through the following drawings, wherein like numbers designate like objects: Fig. 1schematic illustration of a preferred embodiment of a system according to the invention. Fig. 2flowchart of a preferred embodiment of a method according to the invention. Fig. 3schematic illustration of variable values according to the invention. Fig. 4schematic illustration of temporal observation windows according to the invention. Fig. 5schematic illustration of a matrix A according to the invention. Description of Examples

[0017] A preferred embodiment of a system 100 according to the invention is illustrated in Figure 1. Said system 100 may comprise a processing unit 101 comprising a processor, and a memory 102. Said system 100 might be part of a rail control system 10 in charge of controlling traffic of railway vehicles, like a train 110, on a railway network 111. In order to control said traffic, the rail control system 10 communicates with different modules M i , e.g. M 1 , M 2 , M 3 , that might be installed on-board trains, like the module M 2 , or along tracks of the railway network 111, like modules M 1 and M 3 , or at some central locations. Said modules can be interlocking systems, level crossing systems, train control systems, etc., which are all known in the art. Each of the modules typically comprises thus software and / or hardware components and is able to communicate via a communication network with another module and / or with the rail control system 10. The operating state or working activity of one module may impact one or several other modules. The rail control system 10 is a very complex system, notably due to the large number of modules, their interdependence, and the large number of data exchanged within the rail control system 10. This makes detecting an anomaly and the source of an anomaly a very challenging task that the present invention proposes to make more efficient and easier.

[0018] According to the present invention, the system 100 is configured for continuously or repeatedly acquiring information about each of said modules whose activity may impact the traffic management controlled by the rail control system 10. For this purpose, the system 100 comprises an interface for acquiring, in function of the time t and for each module M i , values of at least one variable V Mi that characterizes the working or operating state of said module M i . For instance, the system 100 may acquire voltage values of the module M 1 and M 2 , temperature values for the module M 2 , and a status parameter value, like open versus close, for the module M 3 . The working of each module might be thus characterized by one or several variables, whose values are acquired by the system, providing thus a view of the global operation state of the rail control system 10. For each variable V Mi , the acquired values form thus a time series representing the temporal evolution of the variable V Mi . Said values might be physical values measured by a sensor, or values outputted by the module or acquired (directly or indirectly) by the system 100 for the concerned module. In particular, the variable values acquired or collected for a module M i might be data values of log files, and / or data values of JMS files, and / or data values of configuration files characterizing the operation or working state of the module M i at different times, and / or data values measured for a quantitative parameter, and / or data values representing an operating state of the module M i . The present invention proposes a system 100 performing a specific handling of the collected values that enables to trace back a failure to its source, notably in real time. This specific handling of the collected values will be better understood through the method described in connection with Figure 2, together with the graphs illustrated in Figures 3 and 4.

[0019] At step 201, and as explained earlier, the system 100, for instance its processing unit 101, collects, via its first interface, for each module M i and in function of the time, values of at least one variable V Mi whose values enable to characterize a current working or state of the module M i . Such a collection of values is shown in the graph of Figure 3, which represents, for a set of different variables V M1 -V M5 , their respective collected values in function of the time t. For instance, the temporal evolution of the variable V M1 in function of the time t expressed in [ms] is illustrated by the curve C1. The same applies to each of the other variables V Mi , whose respective temporal evolutions are illustrated by the respective curves Ci.

[0020] At step 202, the system 100, for instance its processing unit 101, is configured for temporally slicing the temporal evolution of all variables V Mi into temporal slices that are temporally the same for all variables, resulting thus in a temporal succession of temporal observation windows W1, W2, W3 as illustrated in Figure 4. Each temporal observation window W k , with k=1,...,3 in the example of Figure 4, starts at a start time t k,start and end at an end time t k , end , defining thus a time interval T k = [t k,start , t k,end ] of duration D k = t k , end - t k,start , and comprises the "sub temporal evolution" of all variables V Mi , i.e. the so-called temporal slices S V M i , k , as illustrated by S V M 2 , 2 and S V M 5 , 3 in Fig. 4. Each temporal observation window W k is thus assigned to a different time interval T k , wherein the different time intervals of the different temporal observation windows are preferentially disjoint, and might be, as illustrated in Fig. 4 of different temporal length. In order to create these temporal observation windows, the processing unit 101 might be configured for detecting, for each or a predefined set of variables, a pattern P in the temporal evolution of the considered variable(s). Such patterns P are illustrated in Fig. 4 with a grey shading. For instance, the processing unit 101 may detect within a temporal evolution of a variable, a value that exceeds, or is smaller than, a predefined threshold. Other known in the art ways of detecting a pattern in a time series might be used. For each pattern detected, the processing unit automatically defines said start time and end time which correspond to the temporal length of the temporal observation window and define the time interval within which said pattern has been detected. If patterns detected for two or more variables correspond to time intervals that overlap, as illustrated notably for W2, wherein the time interval corresponding to the grey shading of V M3 overlaps the time interval corresponding to the grey shading of V M5 , then said time intervals might be merged in a single time interval that encompasses both time intervals. Alternatively, or additionally, said slicing might be randomly performed for some of the variables, and / or periodically performed by the system 101.

[0021] The method according to the invention comprises thus a creation, for each variable V Mi , of a corresponding set of successive temporal slices S Mi,k , i.e. sub time series, wherein each temporal slice S Mi,k is configured for representing the working of the module M i during a time interval T k characterized by an effective duration D k . According to the present invention, the number of time intervals T k is equal to the number of temporal slices S Mi,k created for a same variable. Said temporal slicing is the same for all variables V Mi , which means that for a given time interval T k , a temporal slice is created for each variable. Thanks to this slicing, the working of all modules M i might be observed during a same time period of duration D k during which values of their respective variables have been acquired and extracted for creating their respective temporal slices S Mi,k . This enables to analyze the working of the modules of the rail control system 100 on a same temporal scale and to have consistency between the observed data for all modules M i . According to the present invention, the index "k" is a positive integer, used for identifying the temporal observation window or temporal slices created for a same time interval T k for the different variables, wherein the greater the value of k, the later the first value of the slice was acquired (i.e. the later the temporal observation window takes place with respect to the working of the module.

[0022] At step 203, the system 101 feeds a kNN" algorithm with each of said temporal observation window, notably from the earliest created to the latest created, wherein said kNN algorithm is configured determining similarities between the received temporal observation window and a predefined set of reference temporal observation windows. Typically, during the operation of the rail control system 10, the system 100 collects, e.g. continuously or periodically, in real time the temporal evolution of the values of each variable V Mi , dynamically creates (e.g. on the fly) said temporal observation windows, wherein each created temporal observation window is fed as input to the kNN algorithm, preferably according to their order of creation - the temporal observation window created first being inputted first.

[0023] A preferred embodiment of step 203 is based on a creation of an analysis matrix A 501 as explained hereafter. Indeed, and preferentially, the system 101 is configured for populating an analysis matrix A 501 with the created slices S Mi,k . In the following, the created slices S Mi,k will be called "the newly created slices". According to the present invention, the analysis matrix A 501 is a three dimensional (3D) matrix of dimensions V × D × S, wherein V represents the number of variables for which a temporal evolution is acquired, D represents the time (i.e. duration) of the longest temporal slice among all temporal slices populating the matrix A, and S represents the number of temporal slices populating the matrix A for each variable, i.e. the highest value of k. Said highest value is notably considered at the time of performing the anomaly detection, given that the matrix A might be dynamically populated on the fly with the created slices during the working of the modules, which means that the value of k may change with time. Such a matrix A is illustrated in Figure 5. For convenience, the matrix elements of the matrix A are defined as A v,w,k with v=1,...,V, w=0,...,D, and k=1,...,S.

[0024] Preferentially, within a same vertical layer of the matrix A 501, i.e. for a fixed k, each row along the dimension V, i.e. for v=1,...,V, of the matrix A is fed with a temporal slice for a different one of said variables (i.e. each vertical layer of the matrix assigns one temporal slice per row, wherein each row is assigned to a single variable), stacking, for a same row, the temporal slices obtained for the same variable one after another according to increasing k along the depth, i.e. the dimension S, of the matrix, (i.e. each vertical layer along the depth of the matrix A, i.e. along dimension S, are fed by temporally ordering, for each variable, the temporal slices according to increasing values of k). In other words, each vertical layer of the matrix corresponds to a temporal observation window, as it can be seen by comparing Fig. 4 and Fig. 5.

[0025] Preferentially, the system 101 is configured for automatically padding the matrix A 501 with padding values in order to increase the temporal length (i.e. duration) of temporal slices whose duration is smaller than D. Indeed, since the temporal observation windows, and thus their respective temporal slices, can vary in temporal length, there might be, along the D dimension of the matrix A, empty regions accounting for the shorter slices (in duration). According to the present invention, said empty regions are preferentially filled with padding. More precisely, each temporal slice S Mi,k comprises values of a variable representing the working of the module M i during the time interval T k , which, when populating the matrix A, extends temporally from 0 to D k , i.e. the original time interval T k = [t k,start , t k , end ]) is temporally shifted so that its duration remains the same, but it starts at time t = 0 and stops at time t = D k . In other words, in the matrix A, T k = [0,D k ]. When creating new slices and populating the matrix A with a new vertical layer associated to a new time interval T k , the duration D k of said new time interval T k might be smaller or greater than D. If it is smaller than D, then padding values will be associated to, or created for, the concerned variable for filling the matrix A for values of d corresponding to the padding time interval ]D k ,..., D]. However, the effective duration D k of a temporal slice (i.e. the period of time t for which values of the variable have been acquired) remains the same and remains stored within the system according to the invention, and corresponds to the time period during which values have been effectively acquired for a module. If D k is greater than the current value of dimension D of matrix A, then a padding will take place for all temporal slices of the matrix A to increase their respective duration so that it matches the value of D k

[0026] Preferentially, said analysis matrix A is pre-populated, for each variable V Mi , with reference temporal slices S M i , k ref that have been created from a temporal evolution of said variable V Mi acquired when the rail control system was working free of any anomaly. For this purpose, and in particular, the matrix A comprises, along its depth (i.e. dimension S), a set of vertical layers - called hereafter "reference vertical layers" by opposition to vertical layers populated with the "newly" created slices S Mi,k which are called hereafter the "new vertical layers" - each reference vertical layer being associated to a time interval for which no anomaly was detected for all modules M i , wherein the rows of said reference vertical layer are populated, with respect to each variable V Mi , with the so-called reference temporal slice S M i , k ref representing the working of the module M i during said time interval during which no anomaly was detected, and representing thus reference data (historical time series) acquired for the variables V Mi . In other words, each reference vertical layer represents a reference temporal observation window.

[0027] The system 101 is then configured for using the matrix A as input to said kNN algorithm. The latter will thus determine similarities between a new vertical layer and a predefined set of reference vertical layers of the matrix A (i.e. vertical layers comprising reference temporal slices), wherein each new vertical layer of the matrix A is successively used as input to the kNN algorithm for searching similarities between it and all reference vertical layers. Said predefined set of reference vertical layers comprises for instance all reference vertical layers of the matrix A, or might be limited to some of them, for instance to vertical layers having an effective duration that is equal to the effective duration of the slices of the new vertical layer plus a certain amount of time ΔD1 that might be predefined, for instance by a user, in the memory 102. This enables to look at reference vertical layers having a similar duration.

[0028] For determining said similarities, said kNN algorithm is configured for performing a multivariate distance calculation that preferentially uses DTW as a base metric for temporal misalignment management of the matrix A elements, and that takes into account all variables together to find the most similar vertical layer out of said reference vertical layers. If the absolute value of a multivariate distance d obtained for a given new vertical layer is smaller than a predefined distance threshold ε, then said new vertical layer is considered as free of any anomaly, otherwise, if said absolute value of the multivariate distance d obtained for the given new vertical layer is greater or equal to said predefined distance threshold ε, then the kNN algorithm automatically performs an univariate distance calculation using preferentially DTW. Preferentially, the system 101 automatically adds to the matrix A additional reference vertical layers associated to time intervals for which no anomaly was detected.

[0029] For the univariate distance calculation, the kNN uses each of the temporal slices of said new vertical layer as an independent new input and determines, for each of said new inputs, and thus for each variable within said new vertical layer, the most similar temporal slices out of a predefined set of the reference temporal slices stored for said variable in the matrix A. In particular, said predefined set of the reference temporal slices may comprise all reference temporal slices associated to the same variable as said new input, or might be limited to some of the reference temporal slices comprised within the matrix, for instance it can comprise only the reference temporal slices characterized by an effective duration that is equal to the effective duration of the new input plus a certain amount of time ΔD2 that might be predefined by a user and / or stored in the memory 102. This enables to focus on patterns of similar duration.

[0030] If the absolute value of an univariate distance d' obtained for a given new input (i.e. one of said variables) is smaller than a predefined distance threshold ε', then said new input is considered as free of any anomaly, otherwise, if the absolute value of said univariate distance d' is greater or equal to said predefined distance threshold ε', then the kNN algorithm is configured for outputting a message or signal indicating an anomaly for the module for which said new input corresponds to a temporal evolution of its variable or of one of its variables.

[0031] At step 204, the system 101 automatically outputs, via its output interface, a message or signal identifying or indicating each module for which an anomaly has been detected. Said anomaly might be for instance a failure of a single module, or a failure of a group of modules, or a module output that creates a non-planned event within the railway network, or a faulty state of a module, e.g. an output that goes outside of a normal working range. The present invention enables to determine efficiently and rapidly, within a very complex system comprising numerous subsystems, i.e. numerous of said modules, the module(s) at the origin of an anomaly.

[0032] Preferentially, the processing unit 101 uses hierarchical representation of the modules for representing the rail control system 10, wherein said hierarchical representation defines a tree structure with parent nodes and child nodes representing the modules, wherein a parent-child relationship between two nodes represents an interdependence of two modules corresponding to said nodes. In particular, the system 101 according to the invention is configured for automatically indicating and / or highlighting, in said hierarchical representation, modules sharing a parent-child relation that have been identified as presenting each an anomaly. Preferentially, the processing unit 101 may further automatically adapt said hierarchical representation by creating a new relationship between modules that are involved in a same anomaly detection, enabling thus to correlate module anomalies within the whole rail control system.

[0033] To conclude, the present invention proposes a system and a method that are able to automatically detect or identify an anomaly and to determine the source, among a set of modules, of said anomaly, in real time.

Claims

1. Method for detecting anomalies in a set of N heterogeneous modules Mi (M1, M2, M3) of a rail control system (10), the method comprising: - for each module Mi (M1, M2, M3) of said set, acquiring, in function of the time, values of at least one variable VMi (VM1, ... , VM5) that characterizes a current working of said module Mi (M1, M2, M3); - temporally slicing the temporal evolution of all variables VMi (VM1, ... , VM5) for creating a succession of temporal observation windows (W1,W2,W3), wherein each temporal observation window comprises, for each variable VMi (VM1, ... , VM5), the temporal evolution - called hereafter temporal slice S V M i , k of said variable VMi during a time interval Tk of duration Dk; - using each temporal observation window (W1,W2,W3) as an input to a k-Nearest Neighbors time series regression algorithm, hereafter "kNN" algorithm, wherein said kNN algorithm is configured for determining similarities between the received temporal observation window (W1,W2,W3) and a predefined set of reference temporal observation windows comprising each, for each variable, a reference temporal slice free of anomalies; - automatically outputting, via an output interface, a message or signal identifying each module (M1, M2, M3) for which an anomaly has been detected.

2. Method according to claim 1, wherein, for determining said similarities, said kNN algorithm is configured for performing a multivariate distance calculation taking into account all variables together to find the most similar reference temporal observation window from said predefined set, wherein if the absolute value of a multivariate distance d1 calculated for the inputted temporal observation window is greater or equal to a predefined distance threshold ε, then the kNN algorithm is configured for automatically performing an univariate distance calculation, wherein each of the temporal slices of said inputted temporal observation window is used as independent and individual new input to the kNN algorithm, which is further configured for determining, for each of said new inputs, the most similar reference temporal slice out of a predefined set of reference temporal slices comprised in the reference temporal windows, wherein if the absolute value of an univariate distance d1' obtained for a given new input is greater or equal to said predefined distance threshold ε', then the kNN algorithm is configured for outputting a signal indicating an anomaly of the corresponding module (M1, M2, M3).

3. Method according to claim 1 or 2, comprising automatically detecting a pattern (P) in the values acquired for at least one of the variables (VM1, ... , VM5), automatically setting a time interval encompassing the values for which said pattern (P) has been detected, and creating, for said time interval, a temporal observation window (W1, W2, W3) comprising corresponding temporal slices for all variables.

4. Method according to one of the claims 1 to 3, comprising dynamically populating a matrix A (501) with each temporal observation window that is created, wherein said matrix A (501) is prepopulated with said reference temporal observation windows and used as input to the kNN algorithm.

5. Method according to one of the claims 1 to 4, wherein said variable values may comprise data values of log files, and / or data values of JMS files, and / or data values of module configuration files, and / or data values measured for a quantitative parameter, and / or data values representing an operating state.

6. Method according to one of the claims 1-5, comprising storing or tracking, for each temporal slice, meta-information, comprising the effective duration of the slice, its associated index k, and a flag configured for indicating whether it can be used by the kNN algorithm as a reference temporal slice.

7. Method according to one of the claims 1-6, wherein said predefined set of reference temporal windows comprises only reference temporal windows whose duration is equal to the duration of the temporal observation window received as input by the kNN algorithm plus a predefined amount of time ΔD1.

8. Method according to one of the claims 1-7, wherein said predefined set of the reference temporal slices comprises: - all reference temporal slices associated to the same variable as said new input; or - only reference temporal slices associated to the same variable as said new input and whose effective duration is equal to the effective duration of the new input plus a predefined amount of time ΔD2.

9. Method according to one of the claims 1 to 8, comprising creating and / or storing a hierarchical representation of the set of modules Mi (M1, M2, M3), wherein the latter are classified in different clusters in function of their interdependence, the method further comprising automatically identifying in said hierarchical representation, each module for which an anomaly is detected, and displaying the smallest part of said hierarchical representation comprising all clusters that comprise a module for which an anomaly has been detected.

10. System (100) for detecting anomalies in a set of N heterogeneous modules Mi (M1, M2, M3) of a rail control system (10), the system (100) comprising: - a first interface for acquiring, in function of the time t and for each module Mi (M1, M2, M3), values of at least one variable VMi (VM1, ... , VM5) that characterizes a current working of said module Mi (M1, M2, M3), wherein, for each variable VMi (VM1, ... , VM5), the acquired values form a time series representing a temporal evolution of the variable VMi (VM1, ... , VM5); - a processing unit (101), comprising typically a processor, connected to a communication network to which the modules Mi belong to; - a memory (102) for storing the acquired values of the variables; - an output interface for outputting, a message or signal identifying each module for which an anomaly has been detected; the system (100) being characterized in that it is configured for implementing the steps of the method according to one of the claims 1 to 8.

11. System (100) according to claim 10, wherein the variable values configured for characterizing the working of the module Mi (M1, M2, M3) are: a. data values of log files for said module Mi (M1, M2, M3); and / or b. data values of JMS files for said module Mi (M1, M2, M3); and / or c. data values of configuration files for the module Mi (M1, M2, M3); and / or d. quantitative values measured or outputted by the module Mi or by a sensor; and / or e. data values representing operating states of the module Mi (M1, M2, M3).

12. System (100) according to claim 9 or 11, wherein said memory (102) is configured for storing the hierarchical representation of the modules, said representation being in the form of a tree structure with parent nodes and child nodes representing said modules and their interdependence.

13. System (100) according to claim 12, configured for automatically indicating and / or highlighting in said hierarchical representation, modules sharing a parent-child relation that have been identified as presenting each an anomaly.

Images