JP7140742B2 - Condition monitoring device and condition monitoring method - Google Patents

Description

TECHNICAL FIELD The present invention relates to a condition monitoring device and a condition monitoring method that can be applied, for example, to detecting anomalies in railway vehicles.

As a method of detecting an abnormality in a device, a method of finding an abnormality pattern by comparing the operation of the device in a normal state and an abnormal state is widely used. For example, in Patent Document 1, an operation log output from a data processing means that processes output data of equipment is processed into a log pattern table, and the log pattern table is compared with the log pattern table during normal operation to determine the operation of a monitoring program. A monitoring system is disclosed that determines whether a condition is normal or abnormal and transmits the result to a display means.

JP 2014-203244 A

However, the method of individually analyzing the operation log patterns of multiple mechanical parts that make up a device to determine whether it is normal or abnormal requires a huge amount of calculations as the number of mechanical parts increases, so it is difficult to quickly obtain results. I can't do it. For example, when detecting an abnormality in a railway vehicle, it is required to quickly determine whether the vehicle is normal or not. Since time-series data is generated for each item, it is not easy to make quick judgments with existing methods that analyze data individually.

In view of the circumstances as described above, it is an object of the present invention to provide a state monitoring apparatus and a state monitoring method that can easily determine whether or not there is an abnormality in the operating state of equipment.

In order to achieve the above object, a condition monitoring device according to one aspect of the present invention includes an acquisition unit, a counting unit, and a gradation processing unit.
The acquisition unit acquires operation information within a range that matches specified conditions regarding a plurality of devices.
The tallying unit calculates a tally value of the motion information for a predetermined period of time for each of the plurality of devices.
The gradation processing unit performs gradation processing on the total value for each of the plurality of devices.

Since the above-mentioned condition monitoring device is configured to present the information necessary for determining the presence or absence of an abnormality based on the total value of the operation information of each device for a predetermined period of time, the approximation of the value for each item is sufficient. It is possible to easily judge whether the equipment is normal or not.

The gradation processing unit may be configured to generate heat map data of the total values. Values of heat map data are represented by gradation or hue.

The condition monitoring device may further include an image generation unit that generates image information in which the heat map data of the total values regarding the plurality of devices are arranged in one direction.

The image generating unit may be configured to generate image information by folding back an arbitrary number of heat map data of the aggregated values regarding the plurality of devices in a direction orthogonal to the one direction.

The state monitoring device may further include a determination unit that extracts a device including operation information determined to be abnormal based on the output of the gradation processing unit.

The determination unit may be configured to extract the device including the operation information determined to be abnormal based on the total value of the operation information of the plurality of devices in the normal state for the predetermined period of time as a reference.

Alternatively, the determination unit is configured to extract the device including the operation information determined to be abnormal based on the total value of the operation information of the plurality of devices during the past operation for the predetermined time period as a reference. good too.

The plurality of devices may be devices that constitute a railway vehicle.

The tallying unit may be configured to generate tally value data sorted by vehicle in the horizontal direction and by the plurality of devices in the vertical direction.

A state monitoring method according to one aspect of the present invention includes acquiring operation information about a plurality of devices at regular time intervals.
A total value of the motion information for a predetermined period of time is calculated for each of the plurality of devices.
The aggregate value is subjected to gradation processing for each of the plurality of devices.

According to the present invention, it is possible to easily determine whether there is an abnormality in the operating state of the device.

1 is a block diagram showing the configuration of a condition monitoring device according to one embodiment of the present invention; FIG. It is a figure which shows an example of the data structure of an operation log. It is a schematic diagram explaining the process performed in the total part of the said state-monitoring apparatus. It is a schematic diagram which shows the example of arrangement|positioning of total value data. It is a schematic diagram which shows the example of arrangement|positioning of total value data. FIG. 10 is a schematic diagram showing a display example of aggregate value data; It is a figure explaining the comparison method with the reference|standard data of total value data. It is a figure explaining the comparison method with the reference|standard data of total value data. It is a flow chart which shows an example of a processing procedure of the above-mentioned condition monitoring device. FIG. 10 is a schematic diagram for explaining the processing procedure of FIG. 9; It is a flow chart which shows an example of a processing procedure of the above-mentioned condition monitoring device. FIG. 12 is a schematic diagram for explaining the processing procedure of FIG. 11; It is a flow chart which shows an example of a processing procedure of the above-mentioned condition monitoring device. FIG. 14 is a schematic diagram for explaining the processing procedure of FIG. 13; It is a flow chart which shows an example of a processing procedure of the above-mentioned condition monitoring device. FIG. 16 is a schematic diagram for explaining the processing procedure of FIG. 15;

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing the configuration of a condition monitoring device 100 according to one embodiment of the invention. In this embodiment, the condition monitoring device 100 is applied to a condition monitoring system for monitoring whether there is an abnormality in a railway vehicle to be monitored.

[Status monitoring device]
As shown in FIG. 1 , the condition monitoring device 100 has an acquisition unit 101 , an aggregation unit 102 , a gradation processing unit 103 , an image generation unit 104 and a determination unit 105 .
The condition monitoring device 100 is composed of a computer having an arithmetic device such as a CPU (Central Processing Unit) and a memory. Each of them is configured as a functional block of the CPU.

The condition monitoring device 100 may be installed in a railroad vehicle, or may be installed in a railroad vehicle garage, a control center, or the like.

Acquisition unit 101 acquires operation information of a plurality of devices A, B, C, and D that constitute a railway vehicle (not shown). Although the number of devices is not particularly limited, four devices A to D will be described as an example in this embodiment.

Acquisition unit 101 may include a communication device capable of acquiring operation information from devices A to D in a wired or wireless manner. Acquisition unit 101 accumulates operation information acquired from devices A to D in database 101 . Further, the acquisition unit 101 is configured to be able to read the operation information of the devices A to D stored in the database 101 .

Here, the motion information refers to motion information within a range that matches specified conditions. In the present embodiment, it is operation information about a plurality of predetermined items of each of the devices A to D constituting the railway vehicle at regular time intervals, and is hereinafter also referred to as an operation history. Equipment A to D means on-board equipment or operation equipment such as brakes, master controllers, compressors, air conditioners, various switches, etc. Not only equipment in a single car but also equipment in each car that constitutes a train. include. Also, each of the devices A to D has a plurality of items for detecting the presence or absence of an abnormality.

FIG. 2 shows an example of the data structure of operation history.
The operation information consists of time information, organization information, and state information.
The organization information is information as organization, and includes operation information, speed, distance, and the like.
The state information is the state of on-board equipment such as ON/OFF of switches and brakes for each vehicle. The contents of the state information are typically ON (1)/OFF (0) digital values. Not only ON/OFF of a switch but also bit ON/OFF in communication information transmitted from on-vehicle equipment may be used. As a result, it is possible to perform threshold value determination for digital values that cannot be threshold value determined (only 0 or 1).
Note that the status information is not limited to a digital value, and may be an analog value that takes any value. In the case of analog values, judgment can be made by comparing the threshold value and the current value.

All of the organization information shown in FIG. 2 may be monitored, or only part of the information may be monitored. In this embodiment, for example, information on date and time, train number, rear station, and next station are extracted as organization information.

Here, the date and time is the date and time of the vehicle operation information.
A train number is a number and a symbol given to each train in a railway diagram, and is an identifier for distinguishing trains in operation services. The trains are separated by starting time, type (local, rapid, etc.), etc. Even if the train is running between the same stations, if the train number is different, it will be distinguished as being operated at a different time and type.
A rear station is a station located behind a running vehicle.
The next station means the next station to stop when viewed from the running vehicle.

The tallying unit 102 calculates a tally value of the motion information for a predetermined period of time for each of the plurality of devices. In this embodiment, the aggregated value for the predetermined time is the aggregated value for the travel time from the rear station to the next station. 3A and 3B are schematic diagrams for explaining the processing executed in the counting unit 102. FIG.

In FIG. 3, items of a given device are shown in the horizontal direction, and digital data representing operation information of each item acquired at regular time intervals (for example, 1 second) are shown in the vertical direction. As items, for example, "powering 4-line" and "powering 5-line" represent the operation state of the master controller, and "281-line", "282-line", "283-line" and "284-line" represent the brake "1" corresponds to ON, and "0" corresponds to OFF.

The tallying unit 102 extracts motion information for each station between the rear station A and the next station B, and tallies it for each item. Since the operation information is a record of ON "1" and OFF "0", the number of times can be calculated by totaling "1". Since the sampling period is 1 second in this example, the number of times is the operating time. Therefore, if the total value data during normal operation is used as the reference data, it is possible to determine whether the operation is normal or not by comparing the total value data of the operation information with the reference data.

As shown in FIG. 2, since the items are arranged in the horizontal direction, when the number of items reaches 10,000, the aggregate value data in the unprocessed state becomes long data of 1 row and 10,000 columns in the horizontal direction, making it difficult to handle. Therefore, as shown in FIG. 4, the tabulation unit 102 classifies items for each vehicle or each device, and compresses the number of data in the horizontal direction by folding back the tabulated value data by a predetermined number in the vertical direction.

FIG. 5 shows an example of the result of repeating such loopback processing. As shown in FIG. 5, the aggregated value data of each item is rearranged in a manner that the aggregated value data classified by vehicle in the horizontal direction and equipment A to D in the vertical direction can be easily confirmed at a glance. In this example, 10 units of aggregate value data of 8 items per device are arranged in one row, that is, aggregate value data for a total of 10,000 columns of 80 columns and 125 rows are two-dimensionally arranged. Note that the aggregate value data of each item is not limited to the above example, and aggregate value data may be generated in which the vehicle is classified in the vertical direction and the devices A to D are classified in the horizontal direction.

The gradation processing unit 103 performs gradation processing on the rearranged total value data for each of the plurality of devices AD. In this embodiment, the gradation processing unit 103 converts the total value data for 10,000 columns shown in FIG. 5 into heat map data when performing gradation processing with a predetermined number of bits.

The image generator 104 generates a two-dimensional image as shown in FIG. 6 based on the heat map data generated by the gradation processor 103 . The values of heat map data are represented by gradation or hue. In FIG. 6, the larger the numerical value of the total value data, the darker the color. However, the color is not limited to this, and the larger the total value data, the lighter the color.

The image generation unit 104 generates image information in which heat map data of total value data regarding a plurality of devices A to D are arranged in one direction (horizontal direction). In particular, in this embodiment, as shown in FIG. 6, an image obtained by folding an arbitrary number of heat map data of total value data for a plurality of devices A to D in one direction (horizontal direction) and a direction (vertical direction) perpendicular to each other. Generate information. The image generation unit 104 outputs the generated image information to the display unit 20 (see FIG. 1) to display it on the screen of the surface unit 20 .

By displaying the operation information about the devices A to D for each vehicle as a heat map image as shown in FIG. 6, the operation status of each device can be grasped at a glance. Since each coordinate position of the two-dimensional image shown in FIG. 6 is associated with a predetermined item of a predetermined device and displayed, an item presumed to be abnormal can be quickly detected.

In addition, by preparing a similar heat map image during normal operation of the railway vehicle as reference data, it is possible to check the operation status of each device while comparing the heat map image acquired this time with the reference data. can.

For example, FIG. 7 shows a comparison between an image of the reference data and an image of the current data. From these results, compared to the reference data, the current data tends to have an insufficient number of operations for the device A in the first vehicle, and an excessive number of operations for the device B in the first vehicle. In addition, regarding the device A of the third car, there are some items that do not move. From these two pieces of data, it is possible to provide the user with information regarding the presence or absence of an abnormality in each of the devices AD.

Based on the output of the gradation processing unit 103, the determination unit 105 extracts a device including operation information determined to be abnormal. For example, the determination unit 105 includes operation information determined to be abnormal based on the total value (reference data) for the predetermined time period of the operation information of each of the devices A to D in the normal state shown on the left side of FIG. Extract equipment. Note that the determination unit 105 may be omitted as necessary.

The method of extracting abnormal items by the determination unit is not particularly limited. It may be displayed at the corresponding position of the two-dimensional coordinates with a gradation corresponding to the difference.

Note that the reference data is not limited to the total value of operation information of the devices A to D during normal operation for a predetermined period of time, but the operation information of the devices A to D during the past operation such as the previous operation is totaled for a predetermined period of time. It may be a value, and a device including operation information determined to be abnormal may be extracted based on a total value at the time of the past operation. As a result, it is possible to detect the deterioration of each device over time, so that it is possible to identify the device that needs to be replaced or repaired before it fails. For example, FIG. 8 shows a comparison of total value data of operation information of each device between the same station acquired on different dates. In the figure, the horizontal axis represents the item, the vertical axis represents the car number, and the regions with different shading represent the degree of difference in the number of operations from the time of acquisition.

The condition monitoring device 100 of the present embodiment configured as described above determines the presence or absence of an abnormality based on total value data obtained by totalizing the number of operations of each item in each of the devices A to D for a predetermined period of time. Therefore, it is possible to judge whether the operation at that time is normal or not by approximating the value for each item. The details will be described below.

[Action of this embodiment]
(Challenges of predictive detection of failures)
In order to obtain a sign of failure of a railway vehicle, it is generally necessary to establish a "normal operation pattern" and an "abnormal operation pattern of failure". If a causal correlation between vehicle state and failure can be found, it can be treated as an operating pattern.
But even if we apply the following well-known techniques of data analysis: Finding causal correlations between vehicle conditions and failures is difficult.
For example, in a multivariate analysis method that selects principal components (causes) for results (failures) from multivariate data consisting of multiple variables using a statistical method, there are too many vehicle condition items to find correlations.
In addition, the neural network multi-layer perceptron method, which is a basic deep learning method, can process many vehicle condition items, but cannot find a correlation with failures.
Furthermore, in the neural network convolution method, which absorbs local data positional deviations, it is possible to see what seems to be a correlation between vehicle status items and failures, but the processing itself takes time and is not suitable for practical use. be.

In actual operation, quick results are desired, so a method of detecting signs of failure that can be performed with simple calculations is required. Therefore, in the present embodiment, by creating total value data of the number of operations for each item for each station, it is possible to compare "tendencies" and detect anomalies.

(Examination of data extraction)
First, any data requires a reference axis for comparison. In addition, since it is difficult to handle large data, the basis of data analysis is to cut out each part and reduce it to a size that is easy to handle.
In general, time is an easy-to-understand unit, so it is possible to divide the data by time. However, depending on the operation, the time may not be suitable as a data delimiter because the vehicle travels to different places every day.
Therefore, in this embodiment, "between stations" is used as a delimiter from the viewpoint of performing the same operation even if the time and the train set are different. The reason for the selection is that if the trains of the same type converge at a fixed distance and time, it is possible to compare even if the train number and service date and time are different. This is because the data size is compact and easy to handle because it takes less than 10 minutes, and about 30 minutes to 1 hour in the suburbs.

(Examination of comparison method)
After extracting the data for each station, the time-series data of multiple items are compared to determine whether the train is normal or abnormal. A common method for comparing time-series data is to determine whether the values are the same at the same timing (Manhattan distance), or whether points have the same slope when cut out in a certain block (Euclidean distance). , Since the vehicle is not a stationary machine, the waveform fluctuates.
The reason for the fluctuation is that "they behave roughly the same way, but not exactly the same" due to factors such as the peculiarities of each vehicle, the handling of the driver, and the weather. For example, even if the vehicle is traveling between the same stations, the timing of power running or braking by the driver may be different. In such a case, the timing-value discrepancies and waveform matching described above cannot be applied.
In order to deal with such a case, there is a method of preparing and checking the allowable value for each item per second, but in the end, a huge number of exception patterns are generated, the process does not end, and the accuracy is not obtained. It is conceivable that

(New comparison method)
The basic idea is that the vehicle performs fixed operations and actions at roughly fixed locations during normal operation. Therefore, it is possible to easily judge whether the operation at that time is normal or not by approximating the values for each item.

Most of the vehicle data obtained in this embodiment is digital information, and consists of pressurized (ON) and non-pressurized (OFF) electric wires. Therefore, ON is treated as "1" and OFF is treated as "0", and the values are aggregated for each item. As a result, ON (1) summed data for each item is obtained, and the time series is compressed to one dimension. Since the original data is recorded every second, the total value can be read as the operating time for each item. This makes it possible to compare whether the vehicle has been operating for the same amount of time in the same section, and to determine whether each part of the vehicle is moving correctly. For example, as described with reference to FIG. 7, if a certain item is conspicuously large or small compared to the aggregated data during normal operation, there is some sort of anomaly. can be determined.

In general, vehicle failure detection is performed by a combination of a plurality of conditions such as ON/OFF of electric wires in a monitor device and ON/OFF of bits in transmission data with devices. The monitor device does not treat a failure unless all the conditions are satisfied, but in cases where ON/OFF is repeated in a short period of time, or in failures in which the time element is incorporated in the condition, the failure condition is cleared before the specified time is reached. There is something. In this case, the monitor device and other in-vehicle devices do not detect a failure because the conditions are not satisfied.

Also, in the present embodiment, the time (for example, in the vertical direction in FIG. 3) is reduced by totaling, but if there are more than 10,000 columns of items (in the same, horizontal direction), confirmation becomes difficult. Therefore, as described with reference to FIGS. 4 and 5, in the present embodiment, by folding back the aggregated data in a predetermined size, the vehicle and the on-board equipment can be expressed as a matrix from a horizontal row. This makes it easier to get a bird's-eye view of the whole because partitions are divided for each vehicle and each device.

Furthermore, in this embodiment, as shown in FIGS. 6 to 8, graphs (heat map images) are generated by performing gradation processing on the total value data of each item. It becomes possible to understand more intuitively whether is moving. In this way, the presence or absence of anomalies can be easily foreseen from the difference distribution of the entire system by arranging and graphing the data.

[Status monitoring method]
Next, a processing procedure of the state monitoring device 100 configured as described above will be described.
FIG. 9 is a flow chart showing an example of a processing procedure of the state monitoring device 100. As shown in FIG. FIG. 10 is a schematic diagram for explaining the processing procedure of FIG.

First, the acquisition unit 101 extracts the operation history of the target railroad vehicle from the database 10 based on the date, train number, rear station, and next station (step 101).
Subsequently, the acquisition unit 101 sets the data extraction position (step 102). The take-out position corresponds to position information in the row direction in FIG. 3, and a flag "1" is set to the take-out position.

Next, the acquisition unit 101 acquires data that matches the management number and the take-out position from the extracted operation history (step 103), and sets the flag "1" to the item number corresponding to the position information in the column direction in FIG. set (step 104). Then, the acquisition unit 101 acquires data on the operation history corresponding to the item number and item position (step 105).

Aggregating unit 102 adds the data acquired in step 105 to the data corresponding to the item number position of the aggregated data (step 106). When the number of item positions is less than the total number of items, totaling section 102 repeatedly executes the processes of steps 105 and 106 (steps 107 and 108). When the number of item positions is equal to or greater than the total number of items, totalizing section 102 repeats the processing of steps 103 to 108 until the number of take-out positions reaches the maximum management number (steps 109 and 110). Then, when the take-out position is equal to or greater than the maximum management number, totalization unit 102 outputs the totalized data as intermediate data for a graph (step 111).

FIG. 11 is a flow chart showing an example of the procedure of aggregation processing and heat map processing. FIG. 12 is a schematic diagram for explaining the processing procedure of FIG.

The tallying unit 102 extracts the data of the specified device from the tallied data (step 201), and sets the flag "1" of the vehicle from which the data was acquired (step 202). Subsequently, the counting unit 102 extracts the data of the specified vehicle (step 203), and outputs the extracted data to the specified position (step 204). The tallying unit 102 repeats steps 201 to 204 until the number of data acquisition vehicles reaches the total number of vehicles (steps 205 and 206).

When the number of data acquisition vehicles reaches the total number of vehicles, a heat map graph of the total data is generated (step 207). At this time, the gradation processing unit 103 performs gradation processing on the aggregated data for each vehicle/equipment item, and the image generation unit 104 generates a heat map image based on the result of the processing.

FIG. 13 is a flow chart showing an example of a procedure for processing such as return processing of aggregated data. FIG. 14 is a schematic diagram for explaining the processing procedure of FIG.

The counting unit 102 sets a flag "1" to the data acquisition vehicle (step 301), and extracts the data of the data acquisition vehicle for each device from the aggregation data (step 302). Subsequently, the tabulating unit 102 combines the extracted data (step 303), wraps the data in units of vehicles such as car No. 1 and car No. 2 (step 304), and outputs vehicle data for each car No. (step 305). ).

The tallying unit 102 repeats the processing of steps 302 to 304 until the number of data acquisition vehicles reaches the total number of vehicles (steps 306 and 307). When the number of data acquisition vehicles reaches the total number of vehicles, the counting unit 102 combines the vehicle data for each car number (step 308). Thereafter, a heat map graph of aggregated data is generated in a manner similar to that described above (step 309).

FIG. 15 is a flowchart showing an example of the procedure of processing in the determination unit 105. As shown in FIG. FIG. 16 is a schematic diagram for explaining the processing procedure of FIG.

The determination unit 105 acquires from the database 10 reference data (reference data) between stations that are the same as the traveling station distance of the generated data this time (step 401). The determination unit 105 compares the acquired reference data with the currently generated data for each item (step 402), and outputs the difference for each item (step 403). If there is a plurality of reference data, the above steps 402 and 403 are repeated until comparison with all reference data is completed (steps 404 and 405).

The determination unit 105 determines a comparison difference between the generated data this time and the reference data (step 405). The determination method is not particularly limited. For example, it is determined whether or not the difference in gradation between corresponding items is equal to or greater than a predetermined value. In this case, if the difference is less than a predetermined value, the item is determined to be "normal", and if the difference is greater than or equal to the predetermined value, the item is determined to be "abnormal". The determination unit 105 graphs the item determined as "abnormal" in a form that is easy to recognize as an abnormal location (step 407). At this time, the abnormal location may be heat-mapped according to the magnitude of the difference (see FIG. 15).

Although the embodiments of the present invention have been described above, it is needless to say that the present invention is not limited to the above-described embodiments and can be modified in various ways.

For example, in the above embodiments, a railroad vehicle was used as an example of an abnormality detection target device. be.

DESCRIPTION OF SYMBOLS 10... Database 20... Display part 100... Condition monitoring apparatus 101... Acquisition part 102... Aggregation part 103... Gradation processing part 104... Image generation part 105... Judgment part

Claims (8)

an acquisition unit that acquires operation information between specified stations regarding a plurality of devices that constitute a railway vehicle;
a tally unit that calculates a tally value of the motion information for a predetermined time for each of the plurality of devices;
a gradation processing unit that performs gradation processing on the aggregated value for each of the plurality of devices;
a determination unit that extracts a device including operation information determined to be abnormal based on the output of the gradation processing unit and using the total value of the operation information of the plurality of devices in normal operation for the predetermined time as a reference. condition monitoring device. an acquisition unit that acquires operation information between specified stations regarding a plurality of devices that constitute a railway vehicle;
a tally unit that calculates a tally value of the motion information for a predetermined time for each of the plurality of devices;
a gradation processing unit that performs gradation processing on the aggregated value for each of the plurality of devices;
a determination unit for extracting a device including operation information determined to be abnormal , based on the output of the gradation processing unit, with reference to the total value of the operation information of the plurality of devices during past operation for the predetermined time period; A condition monitoring device comprising: The condition monitoring device according to claim 1 or 2,
The condition monitoring device, wherein the gradation processing unit generates heat map data of the aggregated values. The condition monitoring device according to claim 3,
A condition monitoring apparatus further comprising an image generation unit that generates image information in which the heat map data of the aggregate values regarding the plurality of devices are arranged in one direction. The condition monitoring device according to claim 4,
The image generation unit generates image information by folding back an arbitrary number of heat map data of the aggregated values regarding the plurality of devices in a direction perpendicular to the one direction. The condition monitoring device according to any one of claims 1 to 5,
The totalizing unit generates aggregate value data classified according to the vehicle in the horizontal direction and the plurality of devices in the vertical direction, or the vehicle in the vertical direction and the plurality of devices in the horizontal direction. A state monitoring method executed by a state monitoring device,
Acquiring operation information between specified stations regarding multiple equipment that constitutes a railway vehicle,
calculating a total value of the operation information for a predetermined period of time for each of the plurality of devices;
gradation processing the aggregated value for each of the plurality of devices;
A state monitoring method for extracting a device including operation information determined to be abnormal, based on the gradation-processed output, with reference to the aggregated value of the operation information of the plurality of devices during normal operation for the predetermined period of time. A state monitoring method executed by a state monitoring device,
Acquiring operation information between specified stations regarding multiple equipment that constitutes a railway vehicle,
calculating a total value of the operation information for a predetermined period of time for each of the plurality of devices;
gradation processing the aggregated value for each of the plurality of devices;
A status monitoring method for extracting a device including operation information determined to be abnormal, based on the gradation-processed output, with reference to the total value of the operation information of the plurality of devices during past operation for the predetermined time period.

Images