METHOD AND SYSTEM FOR ANOMALY DETECTION AND DIAGNOSIS IN INDUSTRIAL PROCESSES AND EQUIPMENT

[0001] The present PCT application claims priority to India Patent Application No. 201921012444, filed before Indian Patent Office on Mar. 29, 2019. Entire contents of the aforementioned application are incorporated herein by reference.

[0002] The disclosure herein generally relates to monitoring industrial processes and systems, and, more particularly, to method and system for detecting and diagnosing anomalies in the industrial processes and systems.

[0003] In manufacturing and process plants, massive amounts of data are gathered by process and equipment sensors. This data represents the actual operational behavior of the plants and can be used to detect and diagnose anomalous behavior of the process or equipment. Anomalies are unusual patterns in data which do not conform to a notion of normal behavior. Anomalies can be categorized into two types viz. ‘point anomalies’ and ‘contextual anomalies’. Point anomalies are those that can be considered anomalous with respect to the rest of the data whereas ‘contextual anomalies’ are those that are anomalous in a specific context but not otherwise. Anomalies that occur in time series data collected from manufacturing and process industries are typically contextual in nature. For example, anomalous behavior in one operating regime may not be anomalous in another operating regime.

[0004] Anomaly detection and diagnosis is a challenging task due to the complex behavior of processes, interactions among sensors, and variability in anomalous behavior. Significant research effort has gone into developing effective data driven techniques for anomaly detection and diagnosis. However, all of the available techniques consider individual points (or instances) in the data to be independent of one another. This assumption is not valid for industrial data where the temporal behavior of sensor data is important. This limits the applicability of available techniques for anomaly detection and diagnosis in industrial data.

[0005] Embodiments of the present disclosure present technological improvements as solutions to one or more of the above-mentioned technical problems recognized by the inventors in conventional techniques. For example, in one embodiment, a processor implemented method of anomaly detection and diagnosis is provided. An input data from a plurality of sensors is collected, via one or more hardware processors, wherein the input data is a multivariate time series data. Further, the input data is divided into a plurality of segments along the temporal dimension each having a fixed window size, via the one or more hardware processors, and then the input data in each segment is processed via the one or more hardware processors. During processing of the input data in each segment, a plurality of features from the input data in the segment being processed are extracted at a plurality of stages, using an encoding mechanism. Further the input data in the segment is reconstructed using the extracted plurality of features using a decoding mechanism. Further, a reconstruction error value for each instance in each of the segments is calculated, corresponding to the reconstruction of the input data using the plurality of features. Further, the reconstruction error value of each of the instances in each of the plurality of segments is compared with a threshold of reconstruction error. Further, all segments for which the reconstruction error value exceeds the threshold of reconstruction error in at least one instance are determined as segments containing anomalous data, and then at least one of the plurality of sensors is identified as faulty, based on the input data in the segments determined as containing the anomalous data.

[0006] In another aspect, a system for anomaly detection and diagnosis is provided. The system includes a memory storing a plurality of instructions, one or more communication interfaces, and one or more hardware processors coupled to the memory via the one or more communication interfaces. The one or more hardware processors are caused by the plurality of instructions to execute the following method to perform the anomaly detection and diagnosis. An input data from a plurality of sensors is collected, via one or more hardware processors, wherein the input data is a multivariate time series data. Further, the input data is divided into a plurality of segments along the temporal dimension each having a fixed window size, via the one or more hardware processors, and then the input data in each segment is processed via the one or more hardware processors. During processing of the input data in each segment, a plurality of features from the input data in the segment being processed are extracted at a plurality of stages, using an encoding mechanism. Further the input data in the segment is reconstructed using the extracted plurality of features using a decoding mechanism. Further, a reconstruction error value for each instance in each of the segments is calculated, corresponding to the reconstruction of the input data using the plurality of features. Further, the reconstruction error value of each of the instances in each of the plurality of segments is compared with a threshold of reconstruction error. Further, all segments for which the reconstruction error value exceeds the threshold of reconstruction error in at least one instance are determined as segments containing anomalous data, and then at least one of the plurality of sensors is identified as faulty, based on the input data in the segments determined as containing the anomalous data.

[0007] In yet another aspect, a non-transitory computer readable medium for anomaly detection and diagnosis is provided. The non-transitory computer readable medium executes the following method for performing the anomaly detection and diagnosis. An input data from a plurality of sensors is collected, via one or more hardware processors, wherein the input data is a multivariate time series data. Further, the input data is divided into a plurality of segments along the temporal dimension each having a fixed window size, via the one or more hardware processors, and then the input data in each segment is processed via the one or more hardware processors. During processing of the input data in each segment, a plurality of features from the input data in the segment being processed are extracted at a plurality of stages, using an encoding mechanism. Further the input data in the segment is reconstructed using the extracted plurality of features using a decoding mechanism. Further, a reconstruction error value for each instance of each of the segments is calculated, corresponding to the reconstruction of the input data using the plurality of features. Further, the reconstruction error value of each instance of each of the plurality of segments is compared with a threshold reconstruction error. Further, all segments for which the reconstruction error value exceeds the threshold of reconstruction error in at least one instance are determined as segments containing anomalous data, and then at least one of the plurality of sensors is identified as faulty, based on the input data in the segments determined as containing the anomalous data.

[0008] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.

[0014] Exemplary embodiments are described with reference to the accompanying drawings. In the figures, the left-most digit(s) of a reference number identifies the figure in which the reference number first appears. Wherever convenient, the same reference numbers are used throughout the drawings to refer to the same or like parts. While examples and features of disclosed principles are described herein, modifications, adaptations, and other implementations are possible without departing from the spirit and scope of the disclosed embodiments. It is intended that the following detailed description be considered as exemplary only, with the true scope and spirit being indicated by the following claims.

[0015] Any industrial enterprise includes one or more industrial processes and one or more equipment that is used to execute the one or more industrial processes. If any of the processes and/or equipment are faulty i.e. malfunctioning, overall output of the industrial enterprise is affected. The industrial enterprise can be monitored during which real-time data pertaining to working of the processes and/or the one or more equipment is collected and processed to perform a health estimation of the process/equipment and/or to verify accuracy of output of the process/equipment.

[0016] Referring now to the drawings, and more particularly to FIG. 1 through FIG. 4, where similar reference characters denote corresponding features consistently throughout the figures, there are shown preferred embodiments and these embodiments are described in the context of the following exemplary system and/or method.

[0017] FIG. 1 illustrates an exemplary system for anomaly detection and diagnosis in industrial processes and equipment, according to some embodiments of the present disclosure. The system 100 includes at least one memory 101, at least one hardware processor 102, and at least one communication interface 103.

[0018] The one or more hardware processors 102 can be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, graphics controllers, logic circuitries, and/or any devices that manipulate signals based on operational instructions. Among other capabilities, the hardware processor(s) 102 are configured to fetch and execute computer-readable instructions stored in the memory 101, which causes the hardware processor(s) 102 to perform actions depicted in FIG. 2, FIG. 3, and FIG. 4 for the purpose of detecting and diagnosing anomalies. In an embodiment, the system 100 can be implemented in a variety of computing systems, such as laptop computers, notebooks, hand-held devices, workstations, mainframe computers, servers, a network cloud and the like.

[0019] The communication interface(s) 103 can include a variety of software and hardware interfaces, for example, a web interface, a graphical user interface, and the like and can facilitate multiple communications within a wide variety of networks N/W and protocol types, including wired networks, for example, LAN, cable, etc., and wireless networks, such as WLAN, cellular, or satellite. In an embodiment, the communication interface(s) 103 can include one or more ports for connecting a number of devices to one another or to another server.

[0020] The memory 101 may include any computer-readable medium known in the art including, for example, volatile memory, such as static random access memory (SRAM) and dynamic random access memory (DRAM), and/or non-volatile memory, such as read only memory (ROM), erasable programmable ROM, flash memories, hard disks, optical disks, and magnetic tapes. In an embodiment, one or more modules (not shown) of the system 100 can be stored in the memory 101. The memory 101 stores a plurality of instructions which when executed cause the one or more hardware processors 102 to perform the anomaly detection and diagnosis.

[0021] One or more sensors being used to collect real-time input pertaining to one or more processes and/or equipment being monitored can communicate with the system 100 through one or more suitable interfaces provided by the communication interface(s) 103, and can facilitate transfer of the data from the sensor(s) to the system 100. In various embodiments, different types of sensors may be installed/deployed/used for collecting appropriate data, which means the system 100 may be collecting different types of data simultaneously. In an example, the sensor is a physical sensor. In another example, the sensor may be a data-based soft-sensor/physics-based soft sensor being used to simulate the required data in the absence/unavailability of original data or physical sensors. The input data collected by the system 100 is multivariate time-series data. Further, the process being monitored could be one or more unit operations or processes from manufacturing or process industries such as iron and steel making, power generation, pharma manufacturing, refineries, cement making, oil and gas production, fine chemical production and so on, and the equipment could be any equipment used in the unit operations or processes in manufacturing and process industries, such as but not limited to valves, compressors, blowers, pumps, steam turbines, gas turbines, heat exchangers, chemical reactors, bio-reactors, condensers, and boilers.

[0022] As the data collected from the different types of sensors may be of different sampling frequencies, may be in different formats and may have gaps due to communication problems or failed sensors, initially the system 100 may have to pre-process the collected data to fill the gaps, and to convert the collected data to a standard format for further processing. The system 100 then divides the input data to a plurality of segments of a specific window size along the temporal dimension, wherein the window size of each of the plurality of segments is pre-defined and configured with the system 100. In various embodiments, the window size of each of the plurality of segments is pre-configured or dynamically configured with the system 100. After dividing the input data to the plurality of segments, the system 100 further processes the input data in each of the plurality of segments.

[0023] During the processing of the input data in each segment, the system 100 extracts a plurality of features corresponding to the input data, at a plurality of different stages. In this context the term ‘feature’ represents a reduced dimensional data of the input data, using an encoding mechanism. In the encoding mechanism, the input data is passed through multiple sets of convolution layers and pooling layers present in the system 100 (not shown), wherein the number of sets of the convolution layers and pooling layers may vary as per requirements and may be configured/re-configured based on the requirements. In an example embodiment, consider that two sets of convolution layers and pooling layers present in the system 100. The system 100 initially passes the input data (in a segment being considered) through a first convolution layer, and output of the first convolution layer is passed through a first pooling layer that forms the first set of convolution layer and pooling layer. Output of the first set of convolution layer and pooling layer is then passed through the convolution layer and the pooling layer that form the second set of convolution layer and pooling layer. Output of each set of convolution layer and pooling layer forms multiple features, the number of which is lower than the number of sensors/features in the input data to the set of convolution layer and pooling layer. Processing of the input data using different sets of convolution layers and pooling layers is referred to as extraction of the features at the plurality of different stages.

[0024] After extracting a plurality of features from the input data being processed, the system 100 uses a decoding mechanism to reconstruct the input data from the extracted features. During the decoding mechanism, the system 100 passes the features through multiple sets of de-convolution layers and up-sampling layers. Output of final set of de-convolution layer and up-sampling layer is reconstructed data, which is expected to have same dimension of the input data.

[0025] The system 100 maintains in the memory 101 a Convolutional Autoencoder (ConvAE) data model. The ConvAE data model is generated using historic data pertaining to a normal working (i.e. when there was no error/malicious data) of the equipment(s)/the process(es). In this process, so as to use the temporal dependency of time-series data, data is divided into fixed windows along temporal dimension. A data splitter method is used to divide fixed window size into two sets i.e. a training data, and a validation data. The training data is used to train the ConvAE model in order to optimize cost function. Cost function can be mean squared error (MSE), absolute error (AE) or mean absolute percentage error (MAPE) between the input data and the reconstructed data. The weights and biases in ConvAE are updated so that cost is as low as possible. The validation data set comprises validation data that is used for unbiased evaluation of the ConvAE data model while tuning hyper parameters of the ConvAE data model, and is reconstructed using the trained ConvAE data model.

[0026] By using the ConvAE data model, the system 100 calculates a reconstruction error (RE) value for each instance in each of the plurality of segments, wherein the RE value at an instance represents extent of deviation between the (original) input data and the reconstructed data at that instance. The terms ‘reconstruction error value’ and ‘RE value’ are used interchangeably throughout the specification and claims. The RE value is calculated as at least one of an absolute difference, squared difference, percentage difference, between the original and reconstructed data. Equations used for calculating each of these errors is given below:

Absolute difference reconstruction error

$\begin{array}{cc}{\mathrm{RE}}_i=\frac{1}{m}{\sum }_{j=1}^mX_{i,j}-X_{i,j}^{\prime }& \left(1\right)\end{array}$

Squared difference reconstruction error

$\begin{array}{cc}{\mathrm{RE}}_i=\frac{1}{m}{\sum }_{j=1}^m{\left(X_{i,j}-X_{i,j}^{\prime }\right)}^2& \left(2\right)\end{array}$

Percentage difference reconstruction error

$\begin{array}{cc}{\mathrm{RE}}_i=\frac{1}{m}{\sum }_{j=1}^m\frac{X_{i,j}-X_{i,j}^{\prime }}{X_{i,j}}\times 100& \left(3\right)\end{array}$

where RE_i is the reconstruction error value for instance or time i

[0027] X_i,j is the original value of sensor j at instance or time i

[0028] X′_i,j is the reconstructed value of sensor j at instance or time i

[0029] m is the total number of sensors

[0030] The threshold for the reconstruction error, beyond which the instance is classified as anomalous, is obtained as μ+Kσ where μ and σ are the mean and standard deviation of all the reconstruction errors and K is a user-defined parameter such that 95% or 99% of the reconstruction error values are lower than the threshold of reconstruction error.

[0031] The RE value is calculated separately for each instance in each of the plurality of segments. The RE value of each of the instances is compared with the threshold of RE. If for any instance the RE value exceeds the threshold of RE, then that particular segment containing the instance is classified as containing anomalous data. The segments for which the RE value does not exceed the threshold of RE are considered as not containing anomalous data (i.e. containing normal data).

[0032] After identifying the segments containing the anomalous data, the next step is diagnosis, which consists of identification of the subset of sensors that caused/contributed to the anomaly from among all the sensors. In this step, the system 100 processes input data in only those segments which have been identified as containing the anomalous data. For each segment considered, the system 100 identifies all source sensors that are contributing to the input data in the considered segments. For example, consider that in a particular segment the input data corresponds to temperature and pressure values, then one or more temperature sensors and one or more pressure sensors are contributing to the input data in that particular segment. After identifying all the source sensors, the system 100 calculates a sensor reconstruction error (RE) value for each of the identified sensors, wherein the sensor RE value of each of the sensors represents extent of deviation between the (original) input data and the reconstructed data for the sensor (i.e. at a sensor level). The sensor reconstruction error for each sensor is calculated as one of the absolute difference, squared difference and percentage absolute difference between the original and reconstructed data for each sensor. Absolute difference reconstruction error for each sensor

RES_i,j=|X_i,j−X′_i,j|  (4)

Squared difference reconstruction error for each sensor

RES_i,j=(X_i,j−X′_i,j)²  (5)

Percentage difference reconstruction error for each sensor

$\begin{array}{cc}{\mathrm{RES}}_{i,j}=\frac{X_{i,j}-X_{i,j}^{\prime }}{X_{i,j}}\times 100& \left(6\right)\end{array}$

where RES_i,j is the reconstruction error value for instance or time i for sensor j

[0033] X_i,j is the original value of sensor j at instance or time i

[0034] X′_i,j is the reconstructed value of sensor j at instance or time i

[0035] The threshold of the sensor reconstruction error for each sensor j, beyond which the sensor is identified to be causing the anomaly, is obtained as μ_j+K_jσ_j where μ_j and σ_j are the mean and standard deviation of all the reconstruction errors for sensor j. K is a user-defined parameter such that 95% or 99% of the reconstruction error values are lower than the threshold of reconstruction error.

[0036] The calculated sensor RE value of each of the sensors is compared with the corresponding threshold of sensor RE. If for any of the sensors the sensor RE value exceeds the threshold of sensor RE, that particular sensor is identified as a faulty sensor or causing the anomaly.

[0037] After identifying all the faulty sensors, the system 100 may report the same to one or more users in any appropriate format pre-configured. For example, the system 100 may display any unique ID of the faulty sensors along with the corresponding sensor RE values and difference with the threshold of sensor RE, via an appropriate user interface provided by the communication interface(s) 103, so that the user may be able to assess extent of error in the values/data generated by each of the sensors. In another example, the system 100 may display data pertaining to faulty sensors identified at any given time instance (as in Table 1).

TABLE 1
Time		Faulty	Faulty	Faulty
(instance)	Normal/anomalous	sensor 1	sensor 2	sensor 3
Jan. 1, 2018	Normal	—	—	—
00:00:01
Jan. 1, 2018	Anomalous	T101	—	—
00:00:02
Jan. 1, 2018	Anomalous	T101	P023	—
00:00:03

[0038] The system 100 may further allow the user to save and/or download the data pertaining to the RE values of each of the sensors, with a time stamp, in any suitable format. The system 100 may be further configured to store the data pertaining to the RE values of each of the instances in each of the segments, the RE value of each of the sensors, the threshold of RE (overall and sensor level), data pertaining to the faulty sensors identified and so on, in one or more databases in the memory 101, and may allow authorized users to access the data for reference at any point of time.

[0039] FIG. 2 (including FIG. 2A and FIG. 2B) is a flow diagram depicting steps involved in the process of anomaly detection and diagnosis, using the system of FIG. 1, according to some embodiments of the present disclosure. The system 100 collects (202) multivariate time series data from a plurality of sensors as input, and then divides (204) the collected multivariate time series data to a plurality of segments having a fixed window size. The system 100 then extracts (206) a plurality of features from each of the plurality of segments, using an encoding mechanism. The system 100 then uses a decoding mechanism to reconstruct (208) the input data in each of the plurality of segments, from the corresponding features extracted. After reconstructing the input data using the decoding mechanism, the system 100 calculates (210) a RE value for each of the instances in each of the segments, wherein the RE value of each of the instances represents extent of deviation of the original input data in the instance and the reconstructed data in the instance. The system 100 then compares the RE value of each of the instances with a threshold of RE, and all the segments for which the RE value of at least one of the instances exceeds the threshold of RE are identified (212) as segments containing anomalous data. The system 100 then identifies (214) all the faulty sensors that contribute to the anomalous data in the segments identified.

[0040] FIG. 3 is a flow diagram depicting steps involved in the process of identifying segments of input data that contain anomalous data, using the system of FIG. 1, according to some embodiments of the present disclosure. In order to identify whether a segment contains anomalous data, the system 100 compares (302) the RE value of the instance with a threshold of RE value. If the RE value of at least one instance exceeds the threshold of RE, then the segment containing the instance is classified (306) as containing the anomalous data. If the RE value of all the instances is lower than the threshold of RE, then the segment is identified as containing no anomalous data (308). In an embodiment, the threshold of RE is determined using the ConvAE data model.

[0041] FIG. 4 is a flow diagram depicting steps involved in the process of identifying one or more sensors as faulty, using the system of FIG. 1, according to some embodiments of the present disclosure. For each segment identified as containing the anomalous data, the system 100 identifies (402) all source sensors that are contributing to the input data in the segments considered. After identifying all the source sensors, the system 100 calculates a reconstruction error (RE) value for each of the identified sensors, wherein the RE value of each of the sensors represents extent of deviation between the (original) input data and the reconstructed data for the sensor (i.e. at a sensor level). The calculated RE value of each of the sensors is compared (404) with a threshold of sensor RE. If for any of the sensors the RE value exceeds the threshold of sensor RE, that particular sensor is identified (408) as a faulty sensor. The sensors for which the RE value does not exceed the threshold of sensor RE are identified (410) as not faulty/in normal working condition.

[0042] The written description describes the subject matter herein to enable any person skilled in the art to make and use the embodiments. The scope of the subject matter embodiments is defined by the claims and may include other modifications that occur to those skilled in the art. Such other modifications are intended to be within the scope of the claims if they have similar elements that do not differ from the literal language of the claims or if they include equivalent elements with insubstantial differences from the literal language of the claims.

[0043] The embodiments of present disclosure herein addresses unresolved problem of detection and diagnosis of anomalous data in an industrial enterprise. The embodiment, thus provides a mechanism to identify anomalous data in the industrial processes/equipment being monitored. Moreover, the embodiments herein further provide a mechanism to identify a sensor as faulty or normal, by processing the data collected from the sensors.

[0044] It is to be understood that the scope of the protection is extended to such a program and in addition to a computer-readable means having a message therein; such computer-readable storage means contain program-code means for implementation of one or more steps of the method, when the program runs on a server or mobile device or any suitable programmable device. The hardware device can be any kind of device which can be programmed including e.g. any kind of computer like a server or a personal computer, or the like, or any combination thereof. The device may also include means which could be e.g. hardware means like e.g. an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination of hardware and software means, e.g. an ASIC and an FPGA, or at least one microprocessor and at least one memory with software modules located therein. Thus, the means can include both hardware means and software means. The method embodiments described herein could be implemented in hardware and software. The device may also include software means. Alternatively, the embodiments may be implemented on different hardware devices, e.g. using a plurality of CPUs.

[0045] The embodiments herein can comprise hardware and software elements. The embodiments that are implemented in software include but are not limited to, firmware, resident software, microcode, etc. The functions performed by various modules described herein may be implemented in other modules or combinations of other modules. For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can comprise, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

[0046] The illustrated steps are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments. Also, the words “comprising,” “having,” “containing,” and “including,” and other similar forms are intended to be equivalent in meaning and be open ended in that an item or items following any one of these words is not meant to be an exhaustive listing of such item or items, or meant to be limited to only the listed item or items. It must also be noted that as used herein and in the appended claims, the singular forms “a,” “an,” and “the” include plural references unless the context clearly dictates otherwise.

[0047] Furthermore, one or more computer-readable storage media may be utilized in implementing embodiments consistent with the present disclosure. A computer-readable storage medium refers to any type of physical memory on which information or data readable by a processor may be stored. Thus, a computer-readable storage medium may store instructions for execution by one or more processors, including instructions for causing the processor(s) to perform steps or stages consistent with the embodiments described herein. The term “computer-readable medium” should be understood to include tangible items and exclude carrier waves and transient signals, i.e., be non-transitory. Examples include random access memory (RAM), read-only memory (ROM), volatile memory, nonvolatile memory, hard drives, CD ROMs, DVDs, flash drives, disks, and any other known physical storage media.

[0048] It is intended that the disclosure and examples be considered as exemplary only, with a true scope and spirit of disclosed embodiments being indicated by the following claims.