Analytical device

Abstract

To easily assign an appropriate label.SOLUTION: An analyzer 500 is provided with: an abnormality classifying unit 521 for classifying the type of generated abnormality based on time series sensing data received from a plurality of sensors at the time of occurrence of the abnormality and a learning model learned in advance; and a specifying unit 522 for specifying a sensor that has detected information corresponding to the cause of the abnormality classified by the abnormality classifying unit based on information corresponding to the sensing data and information corresponding to past data that is previously stored past sensing data.SELECTED DRAWING: Figure 14

Description

Technical Field

[0001] The present invention relates to an analysis apparatus, an analysis method, and a program.

Background Art

[0002] Techniques are known that are used for detecting and classifying anomalies based on time-series data acquired from multiple sensors.

[0003] For example, Patent Document 1 discloses generating a generator that is trained to generate state information representing the state of time-series data according to labels assigned to the time-series data having a predetermined time width, generating state information representing the state of segmented time-series data obtained by segmenting the time-series data with a time width shorter than the predetermined time width using the generator, and classifying the segmented time-series data based on the state information of the plurality of segmented time-series data. A time-series data processing method is described.

[0004] Also, as a related technique, for example, there is Patent Document 2. Patent Document 2 describes, for example, a first generation step of generating a normal model based on a normal state component extracted from sensor data of a plurality of sensors provided in mechanical equipment, a second generation step of generating an anomaly classification model based on the normal model, and an evaluation step of evaluating the degree of deviation from the normal state of the mechanical equipment. For example, according to Patent Document 1, when it is determined that there is a sign of failure in mechanical equipment based on the degree of deviation, an anomaly pattern is determined based on the output value of the anomaly classification model obtained by inputting the evaluation component extracted from the sensor data into the anomaly classification model. Then, the determination result of the determination step including the anomaly pattern is notified.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Patent Document 2

[0006] For example, when performing machine learning with labels as described in Patent Document 1, the labeling of training examples is often done empirically by humans. As a result, data may include different sensor behaviors even with the same or different labels, potentially leading to inappropriate labeling. Thus, a problem arose where it was sometimes difficult to perform appropriate labeling.

[0007] Therefore, the object of the present invention is to provide an analytical apparatus, an analytical method, and a program that solve the above-mentioned problems. [Means for solving the problem]

[0008] To achieve this objective, an analytical apparatus, which is one form of this disclosure, An anomaly classification unit classifies the type of anomaly that occurred based on time-series sensing data received from multiple sensors at the time of an anomaly occurrence and a pre-trained model. Based on the information corresponding to the sensing data and the information corresponding to past sensing data which is stored in advance, the identification unit identifies the sensor that detected information corresponding to the cause of the anomaly classified by the anomaly classification unit. has This is the structure it takes.

[0009] Furthermore, other forms of this disclosure, such as analytical methods, are Information processing device, Based on time-series sensing data received from multiple sensors at the time of an anomaly occurrence and a pre-trained model, the type of anomaly that occurred is classified. Based on the information corresponding to the aforementioned sensing data and the information corresponding to past sensing data that has been stored in advance, the sensor that detected the information corresponding to the classified cause of the anomaly is identified. This is the structure it takes.

[0010] Also, a program according to another aspect of the present disclosure causes an information processing apparatus to classify the type of an abnormality that has occurred based on time-series sensing data at the time of occurrence of the abnormality received from a plurality of sensors and a pre-learned learned model, and identify a sensor that has detected information corresponding to the cause of the classified abnormality based on information corresponding to the sensing data and information corresponding to past data that is past sensing data stored in advance. This is a program for realizing the processing.

Advantages of the Invention

[0011] According to each of the configurations as described above, the above-described problems can be solved.

Brief Description of the Drawings

[0012] [Figure 1] This is a diagram showing a configuration example of an analysis system in a first embodiment of the present disclosure. [Figure 2] This is a block diagram showing a configuration example of an analysis apparatus. [Figure 3] This is a diagram showing an example of information included in learning information. [Figure 4] This is a diagram showing an example of time-series data. [Figure 5] This is a diagram showing an example of information included in an abnormality model database. [Figure 6] This is a diagram showing an example of information included in a normal model database. [Figure 7] This is a diagram for explaining an example of processing of a model generation unit. [Figure 8] This is a diagram for explaining an example of output by an output unit. [Figure 9] This is a flowchart showing an example of the operation of an analysis apparatus during learning. [Figure 10] This is a flowchart showing an example of the operation of an analysis apparatus during analysis. [Figure 11]It is a diagram showing another configuration example of the analysis device. [Figure 12] It is a diagram showing another configuration example of the analysis system. [Figure 13] It is a diagram showing a hardware configuration example of the analysis device in the second embodiment of the present disclosure. [Figure 14] It is a block diagram showing a configuration example of the analysis device.

Mode for Carrying Out the Invention

[0013] [First Embodiment] The first embodiment of the present disclosure will be described with reference to FIGS. 1 to 12. FIG. 1 is a diagram showing a configuration example of the analysis system 100. FIG. 2 is a block diagram showing a configuration example of the analysis device 200. FIG. 3 is a diagram showing an example of information included in the learning information 241. FIG. 4 is a diagram showing an example of time-series data. FIG. 5 is a diagram showing an example of information included in the abnormal model database 243. FIG. 6 is a diagram showing an example of the normal model database 244. FIG. 7 is a diagram for explaining a processing example of the model generation unit 253. FIG. 8 is a diagram for explaining an output example by the output unit 257. FIG. 9 is a flowchart showing an operation example of the analysis device 200 during learning. FIG. 10 is a flowchart showing an operation example of the analysis device 200 during analysis. FIG. 11 is a diagram showing another configuration example of the analysis device 200. FIG. 12 is a diagram showing another configuration example of the analysis system 100.

[0014] In the first embodiment of the present disclosure, an analysis system 100 that classifies the types of abnormalities such as bearing failures and engine noises based on suspected data, which is time-series sensing data acquired by the sensor 300 when any abnormality occurs, will be described. As will be described later, the analysis system 100 learns an abnormal model in advance based on sensing data to which an abnormal label indicating the type of abnormality is assigned. Then, when the analysis system 100 receives the suspected data, it classifies the type of abnormality based on the learned abnormal model.

[0015] Furthermore, the analysis system 100 can identify sensors 300 and sensing data that detected information presumed to be the cause of the classified anomaly, based on the suspected data and information corresponding to past sensing data. For example, the analysis system 100 can identify sensors 300 and other items that detected information corresponding to the cause of the anomaly by comparing the transformed features of the suspected data with features included in an anomaly model or a pre-trained normal model, or by comparing the suspected data with the past sensing data itself. The results identified by the analysis system 100 can be used, for example, by being reflected in anomaly labels, when updating the anomaly model. In other words, the analysis system 100 can train a new anomaly model that reflects the identified results.

[0016] Furthermore, the analysis system 100 described in this embodiment classifies the type of abnormality and identifies the sensor 300 that detected information corresponding to the cause of the abnormality, based on suspected abnormality data acquired by multiple sensors 300 for a device having multiple operating conditions, such as a vehicle. For example, the analysis system 100 may learn abnormality models and normality models for each operating condition. Alternatively, when the analysis system 100 acquires suspected abnormality data, it may divide the data according to the operating condition and classify the type of abnormality for each operating condition or identify the sensor that detected information corresponding to the cause of the abnormality based on the divided suspected abnormality data.

[0017] In this embodiment, "operating status" refers to conditions or states such as the driving status of the target device, including stopping, slow speed, high speed, right turn, left turn, deceleration, etc. However, the operating status may be specific to the device being analyzed by the analysis system 100, such as a vehicle. For example, the object of analysis analyzed by the analysis system 100 may be an aircraft, drone, ship, submersible, etc., and the operating status may include conditions or states specific to the object of analysis, such as flight status, navigation status, or diving status. As will be described later, in this embodiment, a status label indicating the operating status can be assigned to time-series sensing data according to the result of classifying the operating status by the operating status classification unit 252. The status label may be automatically generated, automatically assigned from a dictionary, or redefined by a person afterward.

[0018] Furthermore, in this embodiment, the abnormality label indicates the type of abnormality, such as bearing failure or engine noise. For example, the abnormality label may be determined during maintenance work performed periodically or in response to the detection of an abnormality. In other words, the abnormality label does not necessarily need to clearly indicate the cause of the abnormality, and may be a classification corresponding to the faulty part or replacement part, or an abstract classification such as engine noise abnormality, in addition to the type of abnormality.

[0019] Figure 1 shows an example configuration of the analysis system 100. Referring to Figure 1, the analysis system 100 includes, for example, an analysis device 200 and a plurality of sensors 300. In this embodiment, the plurality of sensors 300 acquire sensing data corresponding to the driving of a vehicle with multiple operating conditions. For example, the sensors 300 may be a sensor that detects the vehicle's speed, a sensor that detects the engine's on / off status, a sensor that detects the vehicle's position, etc. The plurality of sensors 300 may all be located on the vehicle, or some may be installed outside the vehicle. As shown in Figure 1, the sensing data acquired by the sensors 300 can be transmitted to the analysis device 200 via a network or the like.

[0020] The analysis device 200 is an information processing device that acquires sensing data obtained by the sensor 300 as suspected data when some kind of abnormality occurs, and classifies the type of abnormality based on the acquired suspected data. Furthermore, the analysis device 200 can identify the sensors and sensing data that detected information corresponding to the cause of the abnormality based on the suspected data. Figure 2 shows an example of the main configuration of the analysis device 200. Referring to Figure 2, the analysis device 200 has as its main components, for example, an operation input unit 210, a screen display unit 220, a communication I / F unit 230, a storage unit 240, and an arithmetic processing unit 250.

[0021] Figure 2 illustrates a case where the functions of the analysis device 200 are realized using a single information processing device. However, the analysis device 200 may be realized using multiple information processing devices, for example, by being implemented on the cloud. Furthermore, the analysis device 200 may not include some of the configurations exemplified above, such as not having an operation input unit 210 or a screen display unit 220, and may have configurations other than those exemplified above.

[0022] The operation input unit 210 consists of an operation input device such as a keyboard or mouse. The operation input unit 210 detects the operation of the operator operating the analysis device 200 and outputs it to the calculation processing unit 250.

[0023] The screen display unit 220 consists of a screen display device such as an LCD (Liquid Crystal Display). The screen display unit 220 can display various information stored in the memory unit 240, information corresponding to the results of processing by the anomaly classification unit 255 and the anomaly cause identification unit 256, etc., in response to instructions from the arithmetic processing unit 250.

[0024] The communication interface unit 230 consists of data communication circuits and the like. The communication interface unit 230 performs data communication with sensors 300 and other external devices connected via a communication line.

[0025] The memory unit 240 is a storage device such as a hard disk or memory. The memory unit 240 stores processing information and programs 245 necessary for various processes in the arithmetic processing unit 250. The programs 245 are read into the arithmetic processing unit 250 and executed to realize various processing functions. The programs 245 are pre-read from external devices or recording media via data input / output functions such as the communication I / F unit 230 and stored in the memory unit 240. The main information stored in the memory unit 240 includes, for example, learning information 241, classification database 242, abnormal model database 243, and normal model database 244.

[0026] The learning information 241 includes learning data such as sensing data used when learning abnormal and normal models. For example, the learning information 241 is updated when the learning data receiving unit 251 (described later) receives sensing data from the sensor 300 or other external devices via the communication I / F unit 230. The learning information 241 can also be updated according to the results of the classification process performed by the operating status classification unit 252 (described later).

[0027] Figure 3 shows an example of training information 241. Referring to Figure 3, training information 241 includes anomalous data used when training the anomalous model and normal data used when training the normal model.

[0028] Anomaly data includes sensing data with anomaly labels indicating the type of anomaly. For example, referring to Figure 3, in the learning information 241, identification information, time-series data, anomaly labels, and secondary information are associated as anomaly data. Here, identification information is information for identifying time-series data, etc. Identification information may be any information that is uniquely assigned. Time-series data shows time-series sensing data acquired by sensors 300, etc. For example, referring to Figure 4, time-series data includes multiple sensing data. In addition, status labels indicating the operating status of the vehicle at the time corresponding to the data can be assigned to the time-series data by the operating status classification unit 252, which will be described later. In other words, time-series data may be divided according to operating status by status labels. Secondary information includes information that explains the related time-series data, such as information indicating the maintenance content and parts replacement content during maintenance work. For example, secondary information includes information indicating parts replaced in response to anomalies, information indicating the sensor 300 that detected information corresponding to the cause of the anomaly, and various other information that can be assigned during maintenance, such as various maintenance records. Secondary information may include any other information as needed.

[0029] Normal data includes sensing data acquired by the sensor 300, etc., when no abnormalities occur. For example, referring to Figure 3, in the learning information 241, identification information and time-series data are associated as normal data. Here, the identification information is information used to identify the time-series data, etc. The identification information may be any information that is uniquely assigned. The time-series data represents the time-series sensing data acquired by the sensor 300, etc. Similar to the case of abnormal data, the time-series data may include multiple sensing data. In addition, the time-series data can be assigned a status label indicating the operating status of the vehicle at the time corresponding to the sensing data by the operating status classification unit 252, which will be described later. Note that arbitrary secondary information may also be associated with the normal data.

[0030] The classification database 242 contains information used by the operating status classification unit 252 when classifying operating status based on sensing data, etc. For example, the information included in the classification database 242 is acquired in advance from external devices, etc., via the communication I / F unit 230. The classification database 242 may be updated, for example, according to the results of classification processing such as clustering performed by the operating status classification unit 252.

[0031] For example, the classification database 242 may include thresholds for classifying the operating status based on one or any number of sensing data from multiple sensing data. For example, if the operating status classification unit 252 classifies the operating status based on sensing data acquired by a sensor 300 that detects the vehicle's speed, the classification database 242 may include information associating speed ranges with status labels such as stopped, slow, and fast. The ranges included in the classification database 242 and the types of associated status labels can be set arbitrarily. The operating status may also be classified based on sensing data acquired by multiple sensors, such as the vehicle's speed and engine operating status. In such cases, the classification database 242 may be associated with status labels corresponding to the ranges of each sensing data. Alternatively, for example, if the operating status classification unit 252 classifies the operating status by using an unsupervised algorithm such as clustering on each time-series data (or a feature obtained by transforming time-series data) included in the learning information 241, the classification database 242 may include information corresponding to the results of the classification process such as clustering.

[0032] For example, as described above, the classification database 242 stores information for classifying the operating status. As mentioned above, the information stored in the classification database 242 may be acquired in advance from an external device via the communication I / F unit 230 or the like, or it may be updated according to the results of processing by the operating status classification unit 252 or the like.

[0033] The anomaly model database 243 contains information for determining the type of anomaly, such as anomaly features, which are features calculated based on time-series data included in the anomaly data. For example, the anomaly model database 243 is updated when the model generation unit 253, described later, performs known processing such as model-free analysis to convert the time-series data included in the anomaly data into anomaly features. The anomaly model database 243 may also include status labels assigned by the operational status classification unit 252.

[0034] Figure 5 shows an example of the information included in the anomaly model database 243. Referring to Figure 5, the anomaly model database 243 associates, for example, identification information, anomaly features, and situation labels. Here, identification information is information used to identify features, etc. The identification information may correspond to the identification information included in the feature generator of the anomaly data. Also, anomaly features are values ​​calculated based on time-series data included in the anomaly data. For example, anomaly features may be in vector format. Also, situation labels may be the same as those attached to the feature generator of the anomaly data. Note that the anomaly model database 243 may also include information other than those exemplified above, such as associated anomaly labels.

[0035] The normal model database 244 contains information indicating a normal state, such as normal features, which are features calculated based on time-series data included in the normal data. For example, the normal model database 244 is updated when the model generation unit 253, described later, performs known processing such as model-free analysis to convert the time-series data included in the normal data into normal features. The normal model database 244 may also include status labels assigned by the operational status classification unit 252.

[0036] Figure 6 shows an example of the information included in the normal model database 244. Referring to Figure 6, the normal model database 244 associates, for example, identification information, normal features, and situation labels. Here, identification information is information used to identify features, etc. The identification information may correspond to the identification information included in the feature generator of the normal data. Also, normal features are values ​​calculated based on time series data included in the normal data. For example, normal features may be data in vector format. Also, situation labels may be the same as those attached to the feature generator of the normal data. Note that the normal model database 244 may include information other than that exemplified above.

[0037] The arithmetic processing unit 250 has an arithmetic device such as a CPU (Central Processing Unit) and its peripheral circuits. The arithmetic processing unit 250 reads and executes the program 245 from the storage unit 240, thereby realizing various processing units by having the hardware and the program 245 cooperate. The main processing units realized by the arithmetic processing unit 250 include, for example, a learning data receiving unit 251, an operating status classification unit 252, a model generation unit 253, a suspected data receiving unit 254, an anomaly classification unit 255, It includes an abnormality cause identification unit 256, an output unit 257, and so on.

[0038] The analysis device 200 may have, instead of the CPU mentioned above, a GPU (Graphic Processing Unit), a DSP (Digital Signal Processor), an MPU (Micro Processing Unit), an FPU (Floating Point Number Processing Unit), a PPU (Physics Processing Unit), a TPU (Tensor Processing Unit), a quantum processor, a microcontroller, or a combination thereof.

[0039] The learning data receiving unit 251 receives sensing data acquired by the sensor 300 and other external devices. The sensing data received by the learning data receiving unit 251 may have an abnormality label attached to it. The learning data receiving unit 251 also stores the received sensing data as learning information 241 in the storage unit 240. For example, the learning data receiving unit 251 can store sensing data with an abnormality label attached as abnormal data in the storage unit 240, and sensing data without an abnormality label attached as normal data in the storage unit 240. The learning data receiving unit 251 may also receive sensing data along with information indicating whether it is abnormal or normal data.

[0040] The learning data receiving unit 251 may receive arbitrary secondary information along with sensing data. The learning data receiving unit 251 can store the received secondary information as learning information 241 in the storage unit 240.

[0041] The operational status classification unit 252 classifies the operational status of the vehicles at each time point based on the time-series data included in the learning information 241. For example, the operational status classification unit 252 can classify the operational status based on one or any number of sensing data from among multiple sensing data included in the time-series data, using thresholds included in the classification database 242. The operational status classification unit 252 may also classify the operational status according to the results of classification processing such as clustering. Furthermore, the operational status classification unit 252 can store information such as a clustering model corresponding to the classification results in the storage unit 240 as the classification database 242.

[0042] For example, the operating status classification unit 252 can classify the operating status at each time point in the time series data based on sensing data acquired by the sensor 300 that detects the vehicle's speed, among multiple sensing data included in the time series data, and thresholds included in the classification database 242. The operating status classification unit 252 can also assign a status label to the time series data according to the classification result. By classifying the operating status, the operating status classification unit 252 divides the time series sensing data into multiple categories according to the operating status, as illustrated in Figure 4. As mentioned above, the operating status classification unit 252 may also classify the operating status based on sensing data acquired by multiple sensors 300, such as the vehicle's speed and engine operating status.

[0043] Furthermore, for example, the operational status classification unit 252 may classify the operational status by executing an unsupervised clustering algorithm such as DBSCAN (Density-based spatial clustering of applications with noise) on each time series data included in the normal data and normal features calculated from the time series data. In this case, the operational status classification unit 252 may be configured to automatically assign a provisional status label to each classified cluster. The provisional status label may be redefined retrospectively by a person or other means at any time. The operational status classification unit 252 may also classify each time series data included in the normal data using the results of the above classification. The operational status classification unit 252 may also perform the above classification process using time series data included in abnormal data instead of normal data, or together with normal data.

[0044] For example, as described above, the operational status classification unit 252 classifies the operational status of vehicles based on the time-series data included in the learning information 241 and assigns corresponding status labels. The operational status classification unit 252 can also classify the suspected data received by the suspected data receiving unit 254 using the classification database 242. The operational status classification unit 252 may classify the operational status of the suspected data using a method similar to the one described above.

[0045] The model generation unit 253 learns an abnormal model based on the abnormal data contained in the training information 241. The model generation unit 253 also learns a normal model based on the normal data contained in the training information 241. The model generation unit 253 may learn abnormal and normal models for each status label classified by the operating status classification unit 252, or it may learn abnormal and normal models regardless of the status label.

[0046] For example, the model generation unit 253 performs unsupervised model-free analysis on the time series data included in the abnormal data, thereby converting the time series data into abnormal features, which are features that indicate an abnormal state and consist of vector-form data, etc. For example, as shown in Figure 7, the model generation unit 253 divides the time series data into segment data based on arbitrary criteria and extracts features corresponding to temporal changes and features corresponding to the relationships between sensors 300 from each divided segment data. The model generation unit 253 can then convert the extracted features into the aforementioned abnormal features by synthesizing them. Note that the extraction process of features corresponding to temporal changes and features corresponding to the relationships between sensors 300 may be realized by machine learning such as deep learning. The model generation unit 253 also stores the generated abnormal features in the storage unit 240 as an abnormal model database 243.

[0047] As described above, the model generation unit 253 may calculate anomaly features for each situation label based on time-series data divided by situation label. The model generation unit 253 may also associate the anomaly features with the situation labels assigned to the time-series data from which the anomaly features were calculated in the anomaly model database 243.

[0048] Furthermore, for example, the model generation unit 253 performs unsupervised model-free analysis on the time series data included in the normal data to convert the time series data into normal features, which are features that indicate a normal state and consist of vector data or the like. The model generation unit 253 may, as in the case of generating an abnormal model, extract features corresponding to temporal changes and features corresponding to the relationships between sensors 300 from each segment data obtained by dividing the time series data, and then convert to the above-mentioned normal features by synthesizing the extracted features. The model generation unit 253 also stores the generated normal features in the storage unit 240 as a normal model database 244. As in the case of generating an abnormal model, the model generation unit 253 may calculate normal features for each situation label based on the time series data divided by situation label. The model generation unit 253 may also associate the normal features with the situation labels assigned to the time series data from which the normal features were calculated in the normal model database 244.

[0049] For example, as described above, the model generation unit 253 can learn abnormal models and normal models based on the learning information 241. The model generation unit 253 may also perform model learning using methods other than those exemplified above. For example, in generating a normal model, the model generation unit 253 may perform machine learning using other machine learning algorithms capable of representing normal behavior, such as invariant analysis.

[0050] The suspected data receiving unit 254 receives sensing data acquired by the sensor 300 as suspected data when some kind of abnormality occurs. In other words, the suspected data receiving unit 254 receives sensing data from the sensor 300 or other external devices as suspected data around the time the abnormality was recognized using some external means. As described above, the operating status classification unit 252 can assign a status label to the suspected data received by the suspected data receiving unit 254. In other words, the suspected data received by the suspected data receiving unit 254 can be divided according to operating status by the operating status classification unit 252.

[0051] The anomaly classification unit 255 classifies the type of anomaly that has occurred based on the suspected data received by the suspected data receiving unit 254. The anomaly classification unit 255 may classify the type of anomaly according to the operating status, or it may classify the type of anomaly regardless of the operating status.

[0052] For example, the anomaly classification unit 255 performs unsupervised model-free analysis on the suspected data to convert it into features consisting of vector data and the like. The anomaly classification unit 255 then compares the converted features with the anomaly features contained in the anomaly model database 243. The anomaly classification unit 255 then identifies the anomaly feature in the anomaly model database 243 that is most similar to the converted features, and identifies the anomaly label and other information associated with the time series data from which the identified anomaly feature was calculated.

[0053] For example, as described above, the anomaly classification unit 255 identifies an anomaly label indicating the type of anomaly corresponding to the suspected data by comparing the features converted from the suspected data with the anomaly features included in the anomaly model database 243. The anomaly classification unit 255 may identify similar features using any means, such as cosine similarity. In addition, the anomaly classification unit 255 may also identify related secondary information along with the anomaly label. For example, as mentioned above, secondary information may include information indicating the sensor 300 that detected information corresponding to the cause of the anomaly. Therefore, the anomaly classification unit 255 may also identify information indicating the sensor 300 that detected information corresponding to the cause of the anomaly, which was determined in the past, along with the anomaly label.

[0054] As mentioned above, the anomaly classification unit 255 may also identify an anomaly label indicating the type of anomaly for each operating status. When identifying an anomaly label for each operating status, the anomaly classification unit 255 may perform feature transformations for each operating status. Furthermore, the anomaly classification unit 255 may identify similar anomaly features by comparing the transformed features with anomaly features related to the corresponding status label in the anomaly model database 243.

[0055] The anomaly cause identification unit 256 identifies sensors 300 and sensing data that detected information presumed to be the cause of the anomaly, as classified by the anomaly classification unit 255, based on the suspected data. For example, the anomaly cause identification unit 256 identifies sensors 300 and other devices that detected information corresponding to the cause of the anomaly by comparing features converted from the suspected data with features included in the anomaly model or normal model, or by comparing the suspected data with past sensing data itself. In other words, the anomaly cause identification unit 256 can identify sensors 300 and sensing data that detected information presumed to be the cause of the anomaly, based on information corresponding to the sensing data such as the suspected data itself or features converted from the suspected data, and past data such as features included in the anomaly model or normal model or past sensing data itself.

[0056] For example, the anomaly cause identification unit 256 compares the suspected data with the time-series data included in the normal data. The anomaly cause identification unit 256 then identifies the sensing data among the multiple sensing data included in the suspected data that deviates the most from the normal state, thereby determining that the sensor 300 corresponding to the identified sensing data is detecting information corresponding to the cause of the anomaly. The anomaly cause identification unit 256 may determine the time-series data to be compared with the suspected data from the time-series data included in the normal data by any means. Furthermore, the anomaly cause identification unit 256 may determine whether or not there is a deviation from the normal state by any means. For example, the anomaly cause identification unit 256 may determine whether or not there is a deviation from the normal state by calculating the distance between the corresponding sensing data in the suspected data and the time-series data.

[0057] Furthermore, the anomaly cause identification unit 256 may identify the sensor 300 or sensing data that detected information presumed to be the cause of the anomaly, based on the results of comparing the suspected data with the time-series data included in the anomaly data. For example, by identifying the sensing data that is judged to be most similar to the time of the anomaly as a result of the comparison, the anomaly cause identification unit 256 can identify that the sensor 300 corresponding to the identified sensing data is detecting information corresponding to the cause of the anomaly. The anomaly cause identification unit 256 may determine the time-series data to be compared with the suspected data from among the time-series data included in the anomaly data by any means. For example, the anomaly cause identification unit 256 may use any means to select one of the time-series data from among the anomaly data that is associated with the same anomaly label as identified by the anomaly classification unit 255 as the comparison target. The anomaly cause identification unit 256 may also use known means to determine whether or not it is similar to the time of the anomaly.

[0058] Furthermore, the anomaly cause identification unit 256 may identify sensing data that deviates from normal conditions or is similar to abnormal conditions by comparing the features converted from the suspected data with the features included in the abnormal model or normal model. In other words, the anomaly cause identification unit 256 may identify the aforementioned sensing data according to the comparison result between the vector data converted from the suspected data and the vector data included in the abnormal model or normal model.

[0059] For example, as described above, the abnormality cause identification unit 256 can identify the sensor 300 or sensing data that detected information that is presumed to have been the cause of the abnormality classified by the abnormality classification unit 255, based on the suspected data.

[0060] Furthermore, when the anomaly classification unit 255 identifies information such as the sensor 300 that detected information corresponding to the cause of the anomaly along with the anomaly label, the anomaly cause identification unit 256 may be configured to compare the results identified by the anomaly classification unit 255 with the results identified by the anomaly cause identification unit 256 itself. Also, for example, as a result of the comparison, the anomaly cause identification unit 256 can determine whether the sensor 300 identified by the anomaly classification unit 255 and the sensor 300 identified by the anomaly cause identification unit 256 are the same. For example, if the sensor 300 identified by the anomaly classification unit 255 and the sensor 300 identified by the anomaly cause identification unit 256 are different, the anomaly cause identification unit 256 may output information indicating that it detected information caused by a sensor 300 different from the sensor 300 identified from past results.

[0061] The output unit 257 outputs the type of anomaly and anomaly label identified by the anomaly classification unit 255, the sensor 300 and sensing data that detected information suspected to be the cause of the anomaly identified by the anomaly cause identification unit 256, and information corresponding to the comparison results by the anomaly cause identification unit 256. For example, the output unit 257 can display the above various information on the screen display unit 220 or transmit it to an external device via the communication I / F unit 230. In addition to the above information, the output unit 257 may also output identified secondary information.

[0062] For example, Figure 8 shows an example of output from the output unit 257. As illustrated in Figure 8, the output unit 257 can output information such as the type of failure and the location of the failure, which are identified according to the failure label identified by the failure classification unit 255. In addition to the above information, the output unit 257 can also output the sensor 300 and sensing data identified by the failure cause identification unit 256. In addition to the above information, the output unit 257 may also output secondary information such as maintenance records.

[0063] The above is an example of the configuration of the analytical apparatus 200. Next, an example of the operation of the analytical apparatus 200 will be explained with reference to Figures 9 and 10.

[0064] First, with reference to Figure 9, an example of the operation of the analysis device 200 during the training of abnormal and normal models will be explained. Referring to Figure 9, the operating status classification unit 252 classifies the operating status of the vehicle at each corresponding time point for the time-series data included in the training information 241 (step S101). For example, the operating status classification unit 252 classifies the operating status based on one or any number of sensing data from among multiple sensing data included in the time-series data, using thresholds included in the classification database 242. The operating status classification unit 252 may also classify the operating status by performing classification processing such as clustering.

[0065] The model generation unit 253 learns an abnormal model based on the abnormal data contained in the training information 241 (step S102). The model generation unit 253 may learn an abnormal model for each status label classified by the operating status classification unit 252, or it may learn an abnormal model regardless of the status label.

[0066] Furthermore, the model generation unit 253 learns a normal model based on the normal data included in the learning information 241 (step S102). The model generation unit 253 may learn a normal model for each status label classified by the operating status classification unit 252, or it may learn a normal model regardless of the status label.

[0067] The above is an example of the operation during model training. Note that the processing in step S102 and the processing in step S103 may be performed in either order or in parallel.

[0068] Next, with reference to Figure 10, an example of the operation of the analysis device 200 when suspected data is received will be described. Referring to Figure 10, the suspected data receiving unit 254 receives the sensing data acquired by the sensor 300 as suspected data when some kind of abnormality occurs (step S201).

[0069] The operational status classification unit 252 classifies the operational status of the suspected data based on the classification database 242. In other words, the operational status classification unit 252 can divide the suspected data according to its operational status by performing the operational status classification process (step S202).

[0070] The anomaly classification unit 255 classifies the type of anomaly that occurred based on the suspected data (step S203). For example, the anomaly classification unit 255 converts the suspected data into features consisting of vector data by performing unsupervised model-free analysis on the suspected data. The anomaly classification unit 255 also compares the converted features with the anomaly features included in the anomaly model database 243. The anomaly classification unit 255 then identifies the anomaly feature that is most similar to the converted features among the anomaly features included in the anomaly model database 243, and identifies the anomaly label in the anomaly data from which the identified anomaly feature was calculated. The anomaly classification unit 255 may classify the type of anomaly according to the operating status, or it may classify the type of anomaly regardless of the operating status.

[0071] The anomaly cause identification unit 256 identifies sensors 300 and sensing data that detected information presumed to be the cause of the anomaly classified by the anomaly classification unit 255, based on the suspected data (step S204). For example, the anomaly cause identification unit 256 identifies sensors 300 and other devices that detected information corresponding to the cause of the anomaly by comparing the features converted from the suspected data with features included in an anomaly model or a pre-trained normal model, or by comparing the suspected data with past sensing data itself.

[0072] The output unit 257 outputs the type of abnormality and abnormality label identified by the abnormality classification unit 255, and the sensor 300 and sensing data that detected information that is presumed to have caused the abnormality, as identified by the abnormality cause identification unit 256 (step S205). For example, the output unit 257 can display the above information on the screen display unit 220 or transmit it to an external device via the communication I / F unit 230. In addition to the above information, the output unit 257 may also output identified secondary information.

[0073] The above is an example of the operation of the analysis device 200 when suspected data is received.

[0074] Thus, the analysis device 200 has an anomaly classification unit 255 and an anomaly cause identification unit 256. With this configuration, the anomaly cause identification unit 256 can identify sensors 300 and sensing data that detected information presumed to be the cause of the anomaly classified by the anomaly classification unit 255, based on the suspected data. As a result, it becomes possible to update the anomaly model and the like based on the learning information 241 to which anomaly labels reflecting the results identified by the anomaly cause identification unit 256 have been assigned, enabling more appropriate learning. In other words, with the above configuration, it becomes possible to assign more appropriate anomaly labels that identify sensors 300 and the like that detected information corresponding to the cause of the anomaly.

[0075] Furthermore, the analysis device 200 can identify the aforementioned sensors 300 and other components according to their operating status. As a result, it becomes possible to make more appropriate judgments and assign more appropriate abnormality labels.

[0076] Note that the configuration of the analyzer 200 is not limited to that illustrated in this embodiment. For example, Figure 11 shows another example of the configuration of the analyzer 200. Referring to Figure 11, the arithmetic processing unit 250 of the analyzer 200 can have a labeling unit 258 in addition to the configuration illustrated in Figure 2, by reading and executing the program 245.

[0077] The labeling unit 258 updates the learning information 241 by adding an anomaly label to the suspected data, which includes information about the sensor 300 identified by the anomaly cause identification unit 256. The labeling unit 258 can also update the anomaly model database 243 based on the transformed features of the suspected data.

[0078] Furthermore, the labeling unit 258 may be configured to assign an abnormality label and update the abnormality model database when the abnormality cause identification unit 256 outputs information indicating that it has detected information caused by a sensor 300 different from the sensor 300 identified from past results.

[0079] Thus, the analyzer 200 may have a labeling unit 258. By having a labeling unit 258, the analyzer 200 can automatically perform tasks such as updating the anomaly model to reflect the results identified by the anomaly cause identification unit 256.

[0080] Furthermore, in this embodiment, referring to Figure 1, the analysis system 100 is assumed to have an analysis device 200 and a plurality of sensors 300. For example, the analysis system 100 may have an arbitrary information processing device 400 connected to the plurality of sensors 300, as shown in Figure 12. In this case, the analysis device 200 may receive sensing data from the sensors 300 via the information processing device 400. Also, as shown in Figure 12, the analysis system 100 may have a plurality of information processing devices 400 located, for example, at different locations.

[0081] [Second Embodiment] In a second embodiment of this disclosure, an example configuration of an analysis device 500, which is an information processing device that classifies the type of anomaly based on time-series sensing data and identifies the sensor that detected information corresponding to the cause of the anomaly, will be described. Figure 13 shows an example of the hardware configuration of the analysis device 500. Referring to Figure 13, the analysis device 500 has, as an example, the following hardware configuration. ·CPU (Central Processing Unit) 501 (computing unit) ROM (Read Only Memory) 502 (Storage Device) • RAM (Random Access Memory) 503 (storage device) • Program group 504 loaded into RAM 503 • Storage device 505 for storing the program group 504 • Drive device 506 for reading and writing to the recording medium 510 outside the information processing device. • Communication interface 507 connecting to the communication network 511 outside the information processing device. • Input / output interface 508 for data input and output. • Bus 509 connecting each component

[0082] Furthermore, the analysis device 500 can realize the functions of the abnormal classification unit 521 and the identification unit 522 shown in Figure 14 by having the CPU 501 acquire the program group 504 and execute it. The program group 504 is, for example, stored in advance in a storage device 505 or ROM 502, and the CPU 501 loads it into RAM 503 or the like and executes it as needed. Alternatively, the program group 504 may be supplied to the CPU 501 via a communication network 511, or it may be stored in advance in a recording medium 510, and the drive device 506 may read the program and supply it to the CPU 501.

[0083] Figure 13 shows an example of the hardware configuration of the analyzer 500. The hardware configuration of the analyzer 500 is not limited to the case described above. For example, the analyzer 500 may consist of only a part of the configuration described above, such as not having a drive device 506.

[0084] The anomaly classification unit 521 classifies the type of anomaly that occurred based on time-series sensing data received from multiple sensors at the time of the anomaly and a pre-trained model.

[0085] The identification unit 522 identifies the sensor that detected information corresponding to the cause of the anomaly classified by the anomaly classification unit 521, based on information corresponding to the sensing data and information corresponding to past data, which is pre-stored past sensing data.

[0086] Thus, the analysis device 500 has an anomaly classification unit 521 and a identification unit 522. With this configuration, the identification unit 522 can identify the sensor that detected information corresponding to the cause of the anomaly classified by the anomaly classification unit 521. As a result, it becomes possible to assign a label that reflects the results identified by the identification unit 522, enabling more appropriate learning.

[0087] The analysis device 500 described above can be realized by incorporating a predetermined program into an information processing device such as the analysis device 500. Specifically, another form of the present invention is a program that enables the information processing device such as the analysis device 500 to perform the following processing: classifying the type of anomaly that occurred based on time-series sensing data received from multiple sensors at the time of anomaly occurrence and a pre-trained model; and identifying the sensor that detected information corresponding to the cause of the classified anomaly based on information corresponding to the sensing data and information corresponding to past data, which is pre-stored past sensing data.

[0088] Furthermore, the analysis method performed by the information processing device such as the analysis device 500 described above involves the information processing device such as the analysis device 500 classifying the type of anomaly that occurred based on time-series sensing data received from multiple sensors at the time of anomaly occurrence and a pre-trained model, and then identifying the sensor that detected information corresponding to the cause of the classified anomaly based on information corresponding to the sensing data and information corresponding to past data, which is pre-stored past sensing data.

[0089] Even if the invention is a program, a recording medium readable by a computer containing the program, or an analysis method having the above-described configuration, it can achieve the same functions and effects as the analysis apparatus 500 described above, and thus the objectives of the present invention described above can be achieved.

[0090] <Note> Some or all of the above embodiments may also be described as follows. The general outline of the analytical apparatus and other components in the present invention will be described below. However, the present invention is not limited to the following configuration.

[0091] (Note 1) An anomaly classification unit classifies the type of anomaly that occurred based on time-series sensing data received from multiple sensors at the time of an anomaly occurrence and a pre-trained model. Based on the information corresponding to the sensing data and the information corresponding to past sensing data which is stored in advance, the identification unit identifies the sensor that detected information corresponding to the cause of the anomaly classified by the anomaly classification unit. has Analyzer. (Note 2) The analytical apparatus described in Appendix 1, The aforementioned historical data includes information corresponding to past sensing data under normal conditions. The identification unit identifies the sensor that detected information corresponding to the cause of the abnormality by checking the discrepancy between the information corresponding to the sensing data and the information corresponding to past sensing data under normal conditions. Analyzer. (Note 3) The analytical apparatus described in Appendix 1, The aforementioned historical data includes information corresponding to past sensing data at the time of the anomaly. The identification unit identifies the sensor that detected information corresponding to the cause of the anomaly by checking the similarity between the information corresponding to the sensing data and the information corresponding to past sensing data at the time of the anomaly. Analyzer. (Note 4) The analytical apparatus described in Appendix 1, The identification unit identifies the sensor that detected information corresponding to the cause of the anomaly classified by the anomaly classification unit by comparing the sensing data with past sensing data. Analyzer. (Note 5) The analytical apparatus described in Appendix 1, The identification unit identifies the sensor that detected information corresponding to the cause of the anomaly classified by the anomaly classification unit by comparing the feature quantities obtained by converting the sensing data with the normal feature quantities obtained by converting past sensing data under normal conditions. Analyzer. (Note 6) The analytical apparatus described in Appendix 1, The aforementioned anomaly classification unit is configured to classify the type of anomaly that occurred and to identify information indicating the sensor that detected information corresponding to the cause of the anomaly. The identification unit compares the identified sensor with the sensor indicated by the information identified by the anomaly classification unit, and outputs information corresponding to the comparison result. Analyzer. (Note 7) The analytical apparatus described in Appendix 6, The system includes a labeling unit that, when the sensor identified by the identification unit and the sensor indicated by the information identified by the anomaly classification unit are different, assigns a new label to the time-series sensing data at the time of the anomaly. Analyzer. (Note 8) The analytical apparatus described in Appendix 1, It has a status classification unit that classifies the operating status based on time-series sensing data received from multiple sensors when an anomaly occurs. The anomaly classification unit classifies the type of anomaly that occurred based on the classification results by the situation classification unit and the trained models learned for each operating situation. Analyzer. (Note 9) In an information processing device, Based on time-series sensing data received from multiple sensors at the time of an anomaly occurrence and a pre-trained model, the type of anomaly that occurred is classified. Based on the information corresponding to the aforementioned sensing data and the information corresponding to past sensing data that has been stored in advance, the sensor that detected the information corresponding to the classified cause of the anomaly is identified. A program to perform the processing. (Note 10) Information processing device, Based on time-series sensing data received from multiple sensors at the time of an anomaly occurrence and a pre-trained model, the type of anomaly that occurred is classified. Based on the information corresponding to the aforementioned sensing data and the information corresponding to past sensing data that has been stored in advance, the sensor that detected the information corresponding to the classified cause of the anomaly is identified. A program to perform the processing.

[0092] Although the present invention has been described above with reference to the embodiments described above, the present invention is not limited to the embodiments described above. Various modifications to the structure and details of the present invention can be made within the scope of the present invention as can be understood by those skilled in the art. [Explanation of symbols]

[0093] 100 Analysis Systems 200 Analyzer 210 Operation Input Section 220 Screen display section 230 Communication I / F section 240 Storage section 241 Learning Information 242 Classification Databases 243 Anomaly Model Database 244 Normal Model Database 245 Programs 250 Arithmetic Processing Unit 251 Learning data receiving unit 252 Operation Status Classification Section 253 Model Generation Unit 254 Suspect Data Receiving Unit 255 Anomaly Classification Department 256 Abnormality cause identification section 257 Output section 258 Labeling section 300 sensors 400 Information Processing Devices 500 Analyzer 501 CPU 502 ROM 503 RAM 504 Program Groups 505 Storage device 506 Drive unit 507 Communication Interface 508 Input / Output Interfaces Bus 509 510 Recording media 511 Communication Network 521 Abnormality Classification Department 522 Specific part

Claims

1. An anomaly classification unit classifies the type of anomaly that occurred based on time-series sensing data received from multiple sensors at the time of an anomaly occurrence and a pre-trained model. Based on the information corresponding to the sensing data and the information corresponding to past sensing data which is stored in advance, the identification unit identifies the sensor that detected information corresponding to the cause of the anomaly classified by the anomaly classification unit. It has, The aforementioned anomaly classification unit is configured to classify the type of anomaly that has occurred and to identify information indicating the sensor by identifying secondary information that is stored in advance. The identification unit compares the identified sensor with the sensor indicated by the information identified by the anomaly classification unit, and outputs information corresponding to the comparison result. Analyzer.

2. The analytical apparatus according to claim 1, The aforementioned historical data includes information corresponding to past sensing data under normal conditions. The identification unit identifies the sensor that detected information corresponding to the cause of the abnormality by checking the discrepancy between the information corresponding to the sensing data and the information corresponding to past sensing data under normal conditions. Analyzer.

3. The analytical apparatus according to claim 1, The aforementioned historical data includes information corresponding to past sensing data at the time of the anomaly. The identification unit identifies the sensor that detected information corresponding to the cause of the anomaly by checking the similarity between the information corresponding to the sensing data and the information corresponding to past sensing data at the time of the anomaly. Analyzer.

4. The analytical apparatus according to claim 1, The identification unit identifies the sensor that detected information corresponding to the cause of the anomaly classified by the anomaly classification unit by comparing the sensing data with past sensing data. Analyzer.

5. The analytical apparatus according to claim 1, The identification unit identifies the sensor that detected information corresponding to the cause of the anomaly classified by the anomaly classification unit by comparing the feature quantities obtained by converting the sensing data with the normal feature quantities obtained by converting past sensing data under normal conditions. Analyzer.

6. The analytical apparatus according to claim 1, The system includes a labeling unit that, when the sensor identified by the identification unit and the sensor indicated by the information identified by the anomaly classification unit are different, assigns a new label to the time-series sensing data at the time of the anomaly. Analyzer.

7. The analytical apparatus according to claim 1, It has a status classification unit that classifies the operating status based on time-series sensing data received from multiple sensors when an anomaly occurs. The anomaly classification unit classifies the type of anomaly that occurred based on the classification results by the situation classification unit and the trained models learned for each operating situation. Analyzer.

8. Information processing device, Based on time-series sensing data received from multiple sensors at the time of an anomaly occurrence and a pre-trained model, the type of anomaly that occurred is classified. Based on the information corresponding to the aforementioned sensing data and the information corresponding to past sensing data which is stored in advance, the sensor that detected information corresponding to the classified cause of the anomaly is identified. When classifying the type of anomaly that occurred, the information indicating the sensor is identified by classifying the type of anomaly and identifying secondary information to be stored in advance. The system compares the identified sensor with the sensor indicated by the information identified during anomaly classification, and outputs information corresponding to the comparison result. Processing method.

9. In an information processing device, Based on time-series sensing data received from multiple sensors at the time of an anomaly occurrence and a pre-trained model, the type of anomaly that occurred is classified. Based on the information corresponding to the aforementioned sensing data and the information corresponding to past sensing data stored in advance, a process is implemented to identify the sensor that detected information corresponding to the classified cause of the anomaly. When classifying the type of anomaly that occurred, the information indicating the sensor is identified by classifying the type of anomaly and identifying secondary information to be stored in advance. The system compares the identified sensor with the sensor indicated by the information identified during anomaly classification, and outputs information corresponding to the comparison result. program.

Images