System and method for monitoring the technical status of technical equipment

Abstract

A system (100), method and computer program product are provided for determining an abnormal technical state of a technical system (200). The computer system (100) receives a plurality of signals from the technical system (200), wherein each signal (S1 to Sn) reflects a technical state of at least one system component. The system further retrieves a high alarm threshold (H1 to Hn) and a low alarm threshold (L1 to Ln) associated with the corresponding received signal (S1 to Sn) from an alarm management system (300). Signal values ​​within a range between the associated high alarm threshold and the associated low alarm threshold reflect normal operation of the corresponding system component. For each signal (S1), a univariate distance from its associated alarm threshold (H1 / L1) is calculated to quantify the degree of abnormality for the corresponding system component. An aggregate anomaly index (AAI) is calculated based on the univariate distance, which reflects the technical state of the entire technical system (200). A comparison of the aggregate anomaly index (AAI) with a predetermined anomaly threshold (AAT) is provided to an operator (10).

Description

Technical Field

[0001] The invention generally relates to the monitoring of technical equipment and more particularly to an alarm tool to support operators of technical equipment in controlling equipment to avoid malfunctions. Background Art

[0002] Many technical systems (such as, for example, technical devices in an automation system) are capable of generating alarms to indicate to an operator that an interaction with the technical device is required in order to take corresponding actions in response to the generated alarm. An alarm as used herein and as defined in technical standard IEC 62682, section 3.1.7, is an audible and / or visual means of indicating to an operator of the equipment a device failure, process deviation or abnormal condition requiring a timely response (see also International Society of Automation ISA-18.2). An instance of a particular alarm is referred to as an alarm activation.

[0003] In real-world situations, a series of alarm activations depending on a single root cause is often generated, where in reality a single alarm would be sufficient to indicate a problem in a technical system. Such a series of alarm activations is often referred to as an alarm flood. An alarm flood situation is characterized by a combination of multiple alarm activations that occur repeatedly. In other words, in multiple alarm floods, the same or similar combinations of alarms typically occur. In general, a permanently high alarm rate indicates a poor alarm quality. Good alarm quality is achieved when the following situations occur:

[0004] - Every alert warning, notification and guidance,

[0005] - present alarms at a rate that operators can respond to, and

[0006] - Provides early warning of detectable problems.

[0007] There are different approaches for monitoring large and complex industrial systems to detect abnormal situations and generate corresponding alarm notifications to (one or more) operators. For example, statistical data driven methods for (multivariate) process monitoring such as PCA and PLS (see Kresta, Macgregor and Marlin, "Multivariate statistical monitoring of process operating performance" in 1991, Canadian Journal of Chemical Engineering, 69(1), 35–47) use statistical analysis applied to actual measurements or technical status data. Alternatively, intelligent visualization approaches, such as parallel coordinate transformation combined with convex hulls calculated for each pair of variables (see multivariate operations; US patent application US20080234840A1; Brooks et al.), allow the range of process variables to be displayed in parallel coordinates as a pair of linear curves between corresponding parallel axes. However, such statistical or mathematical analysis relies solely on historical values ​​of the process variables and does not take into account any process knowledge of the monitored process, and therefore suffers from a large number of false positives in the detected alarms, because it does not become clear what is actually an abnormal situation.

[0008] A certain deviation of a technical status parameter may be identified by statistical monitoring in order to trigger an alarm notification, although the deviation may still be considered to be within normal operation of the corresponding device.

[0009] As a result, it is difficult for an operator to retrieve reliable anomaly information about the overall technical status of the monitored technical equipment from the alarm notifications based solely on such statistical analysis. Summary of the invention

[0010] Therefore, there is a need for improved alarm detection for operators in which the operator can quickly determine the overall technical status of the monitored equipment, so as to reduce the number of false positives and enable the operator to take appropriate corrective action if required.

[0011] Embodiments of the technical solution to the above mentioned problem are disclosed by a method, a computer program product and a computer system according to the independent claims.

[0012] In one embodiment, a computer-implemented method for determining an abnormal technical state of a technical system is provided. In another embodiment, a computer system is configured to perform the method by executing a corresponding computer program, the computer program comprising program instructions that cause the computer system to perform corresponding method steps when the computer program is loaded into a memory of the computer system and the instructions are processed by one or more processors.

[0013] A computer system receives a plurality of signals from a technical system. Each signal is sampled over time (using the same sampling frequency), or resampled in a preprocessing step in order to ensure the availability of measured or estimated values ​​of the plurality of signals at each instance of calculation), and reflects the technical state of at least one system component of the technical system. That is, each signal relates to one system component, but a specific system component can be monitored by an operator via a plurality of signals. Typically, the technical system is monitored by one or more human operators. The totality of all signals reflects the overall technical state of the entire technical system. However, a human operator cannot derive information about the overall technical state of the technical system from a single signal at the sensor level, because there is no possibility for a human to understand the plurality of signals received from the sensors in real time.

[0014] The computer system assists the operator in this monitoring task by deriving from the received sensor signals a single aggregate anomaly indicator reflecting the technical status of the entire system.

[0015] An alarm management system is associated with a technical system. An alarm management system stores information about alarms associated with signals. An alarm management system is a system for prioritizing, grouping, and classifying warnings and event notifications used in supervisory control and data acquisition (SCADA) to improve the provision of technical status information to operators. Most commonly, the main problem is that there are too many alarms that are notified in the chaos of the plant, which is generally referred to as an alarm flood as explained above. However, there may also be other problems with the alarm system, such as poorly designed alarms, inappropriately set alarm points, failed notifications, unclear alarm messages, etc. Poor alarm management is one of the main causes of unplanned downtime and major industrial accidents. The alarm management system stores high alarm thresholds and low alarm thresholds associated with the corresponding received signals. The signal value of a specific signal in the range between the associated high alarm threshold and the associated low alarm threshold reflects the normal operation of the corresponding at least one system component. In other words, the alarm threshold for a specific signal is based on the historical cognition of normal operation and abnormal system behavior. The alarm threshold reflects a critical value, and when the critical value is exceeded, the corresponding signal value is no longer considered to be within the normal operating range. The alarm management system typically issues a per-signal alarm when the signal value exceeds any of the corresponding alarm thresholds. Since many technical status parameters are correlated, this typically results in a so-called alarm flood that overwhelms the operator with information that cannot be resolved by the operator.

[0016] The alarm management system can be an integral part of the computer system, or the alarm management system can be a remote system that is communicatively coupled to the computer system so that the computer system can access data available in the alarm management system. The computer system retrieves the high alarm threshold and the low alarm threshold associated with the corresponding received signal from the alarm management system via an appropriate interface. The retrieval of the alarm threshold values ​​can occur, for example, as some initialization step for the computer system. That is, before the computer system begins any calculations, the computer system can retrieve all available alarm thresholds from the alarm management system. The retrieval can be repeated at regular update intervals to take into account changes in the alarm management system. For example, an update retrieval can retrieve alarm thresholds only for signals actually monitored via the computer system.

[0017] The computer system has a data processor configured to perform the computational tasks as described below. First, the data processor calculates the univariate distance from its associated alarm threshold for each signal with an associated alarm threshold at each sampling time point. In general, the univariate distance is the (simple) distance between the values ​​of a single variable j for two observations i and I. In the present application, the univariate distance is the maximum value of the distance between the value of the corresponding signal and its associated alarm threshold to quantify the degree of abnormality for the corresponding at least one system component. The univariate distance d(t) for a specific signal at the sampling time point t can be expressed by the following mathematical formula:

[0018] (F1)

[0019] in x(t) It's in time t A sample of the signal, x h is the high alarm threshold associated with the signal as defined in the alarm management system, x l is the low alarm threshold associated with the signal, and a is the normal value of the variable ( x l < a < x h ).

[0020] For example, by default, a Can be selected as ,but x l and x h Other values ​​in between can be selected, for example, by estimating normal operating values ​​based on normal operating data.

[0021] In one embodiment, the univariate distance for a particular signal at a particular sampling time point can be calculated as a piecewise linear index such that:

[0022] exist hour, (F2a)

[0023] exist Sometimes or hour, (F2b)

[0024] exist hour, (F2c)

[0025] In other words, if the sampled signal value is between the low alarm threshold and the high alarm threshold, the distance value is between 0 and 1 (F2a); if the sampled signal value is less than or equal to the low alarm threshold or greater than or equal to the high alarm threshold, the distance value is 1 (F2b); and if the sampled signal value corresponds to a predefined parameter value reflecting normal operation, the distance value is 0 (F2c).

[0026] In an alternative embodiment, the univariate distance d(t) can be calculated as a smooth exponential instead of the piecewise linear calculation above.

[0027] For example, d(t) can be calculated using exponential smoothing as:

[0028] ,in (Typically, a = 2) (F3)

[0029] For example, a = 2 involves parabolic smoothing, and a = 3 involves hyperbolic smoothing.

[0030] Furthermore, the real signal is noisy, because its "regular" values ​​are distributed in a Gaussian fashion around this value " a ” Fluctuations around. Therefore, the calculation of univariate distances can be done by introducing a “normal range” that defines the signal [a l , a2], where the upper limit of the interval a 2 Less than the corresponding high alarm threshold x h , and the lower limit of the interval a l Greater than the corresponding low alarm threshold x l Such intervals are used as regular ranges. al and a 2 Deadband x l < a l < a 2 < x h ). The deadband (sometimes called the neutral region or dead zone) is the band of input values ​​in the domain of a transfer function in a control system or signal processing system where the output is zero (the output is 'dead' – no action occurs). The deadband region can be used in control systems (such as servo amplifiers) to prevent oscillation or repeated activation-deactivation cycles.

[0031] In the case of such a dead band, the univariate distance for a particular signal d(t) The following index can be calculated:

[0032] for , (F4a)

[0033] for , (F4b)

[0034] for , (F4c)

[0035] In other words, if the sampled signal value is within the deadband interval for a particular signal at a particular sampling time point, the distance value is 0 (F4a); for signal values ​​below the lower limit of the interval of the normal range, the distance value is (F4b), and for signal values ​​above the upper limit of the interval of the normal range, the distance value is (F4c).

[0036] Once the univariate distances are determined by the data processor, further calculation steps are performed. At each sampling time point, the computer system now calculates an aggregate anomaly indicator reflecting the technical state of the entire technical system based on the univariate distances at the corresponding sampling time point.

[0037] In one embodiment, the aggregate anomaly indicator is calculated as the Euclidian distance D(t) based on the univariate distances of the corresponding signals and the total number of signals:

[0038] (F5)

[0039] In an alternative embodiment, the clustered anomaly indicator is calculated as a weighted Euclidian distance D based on the univariate distances of the corresponding signals and the total number of signals.w (t), where each univariate distance contribution is weighted with a weighting factor corresponding to the severity of the alarm associated with the corresponding signal as defined in the alarm management system:

[0040] ,in ,and ,for (F6)

[0041] in d i (t) Corresponding to the signal i , and N Corresponds to the total number of signals received.

[0042] The aggregate anomaly index now reflects the technical state of the entire technical system because the aggregate anomaly index includes technical state information about all monitored system components. In other words, presenting the aggregate anomaly index to the operator provides the operator with a visual indication of the internal state that is prevalent in the technical system. In order to enable the operator to quickly identify abnormal system behavior and take corrective actions, the system provides a comparison of the aggregate anomaly index with a predetermined anomaly threshold. The anomaly threshold is selected to ensure that the aggregate anomaly index value below the anomaly threshold reflects the normal operation of the technical system with a given probability (or confidence, such as 95%). The given probability can be defined by the user as a target probability, or the given probability can be a predefined confidence value. For example, as known to those skilled in the art, the anomaly threshold can be determined by using the cumulative distribution function of the aggregate anomaly index during the normal operation of the technical system. When the aggregate anomaly index exceeds the anomaly threshold, the abnormal technical state is determined.

[0043] The aggregate anomaly index AAI provides simplified technical status information for the entire system that can be easily processed by the operator. For example, at the moment when the AAI exceeds the anomaly threshold in the corresponding graphical visualization, the operator is warned that the technical system exhibits abnormal behavior. In other words, AAI is a trigger for the operator to conduct a more thorough system analysis to identify the root cause of the abnormal behavior. The trigger point in the AAI curve is typically reached even before the alarm is triggered by the alarm management system, because the alarm triggering typically depends on patterns in the signal behavior that can be easily extended over a longer period of time. AAI does not require any pattern recognition, but only considers aggregate indicators for all signals. As a result, non-high-performance hardware and complex models are not required for pattern recognition, because the claimed approach is a purely data-driven approach that can be easily used for technical systems in factories without the need for adaptation hardware or OPC Alarm and Event (A&E) servers.

[0044] In order to apply the method for determining an abnormal technical state of a technical system, it is advantageous when the technical system is operating in a steady state. Therefore, before the calculation step for the AAI calculation, a steady state detection algorithm can be used to determine whether the technical system is operating in a steady state process. If the process is not in a steady state, the AAI calculation can be suppressed. This optional switch function saves computing resources for a period of time in which a meaningful AAI calculation is not possible. Steady state detection algorithms are well known in the art and are disclosed in many papers, such as, for example, "An efficient method for on-line identification of steady state" by Cao, S. and Rhinehart, RR in 1995 in Journal of Process Control, 5(6), 363–374.

[0045] As previously mentioned, AAI can be interpreted as a trigger function for an operator to perform root cause analysis for a technical system. The disclosed method can also support the operator in this task. In one embodiment, the computer system also provides the operator with a subset of univariate distances at corresponding sampling time points, wherein the subset relates to such univariate distances with the highest contribution to the increase of the aggregate anomaly index. The size of the subset can be configurable by the operator. For example, the operator can define 5 or 10 to configure the computer system to show a drill down option for AAI, the top 5 or top 10 univariate distances. As a result, the operator can immediately see which signal - and therefore which system component - is primarily responsible for the AII increase that exceeds the anomaly threshold.

[0046] In another alternative embodiment, the support for root cause analysis is further improved. The component hierarchy of the technical system can define multiple functional blocks of the technical system. The functional blocks can be represented by sub-nodes of the technical system in the component hierarchy. Each functional block can again include multiple sub-nodes, which include additional functional blocks and / or system components. That is, the hierarchy can describe multiple levels of functional blocks (nested functional blocks). The computer system can now calculate the aggregated block anomaly index (BAI) for the corresponding functional block at each sampling time point. The calculation for a specific functional block is thus based on a subset of the univariate distance associated with the specific functional block (at the corresponding sampling time point). The calculated (one or more) block anomaly index (BAI) reflects the technical status of the functional block of the technical system. The computer system can now also provide the operator with a comparison of the block anomaly index (BAI) with a predetermined block anomaly threshold. In addition, the block anomaly threshold is selected to ensure that the aggregated block anomaly index value below the block anomaly threshold reflects the normal operation of the specific functional block with a given probability. By using such a BAI in addition to the AAI and the univariate distance, the operator receives simplified technical status parameters for each functional block defined in the component level. That is, the operator can quickly drill down to the corresponding functional block of the technical system (e.g., boiler, pump, turbine or process area) when the AAI exceeds the abnormal threshold, and identify the functional block that contributes most to the abnormality. Similar to the univariate distance, the computer system can provide a ranking list for the functional blocks that contribute most to the abnormal behavior. Of course, for each BAI, it is possible to further drill down on the corresponding univariate distance. With this option, the operator can quickly identify the system component of the functional block that causes the failure of the entire system.

[0047] In one embodiment, a specific technical state parameter can be represented by multiple sensor signals that provide redundant information in a specified specific technical state. In such a scenario, the calculation of the univariate distance for the technical state parameter can be implemented in a manner that is robust against the failure of the sensor that provides the redundant information. In other words, robust resistance to failure means that the failure of a single sensor does not significantly affect the reliability of the technical state parameter reflected by the corresponding univariate distance. This is achieved by aggregating the univariate distances associated with multiple sensor signals to provide a robust univariate distance for a specific technical state parameter. Even if one of the signals disappears (for example, because the battery or data communication link of the sensor fails), the robust univariate distance still provides meaningful information about the normal / abnormal behavior of the corresponding system component.

[0048] In one embodiment, a computer program product for determining an abnormal technical state of a technical system is provided. The program comprises instructions which, when loaded into a memory of a computer system and being executed by at least one processor of the computer system, cause the computer system to carry out the method steps as disclosed herein.

[0049] A computer system for executing the computer program can be described by functional modules configured to perform the method steps at system runtime. The computer system has an interface for receiving a plurality of signals from a technical system, wherein each signal is sampled over time and reflects a technical state of at least one system component. Furthermore, via the interface, the computer system retrieves a high alarm threshold and a low alarm threshold associated with the respective received signal from an alarm management system associated with the technical system. A signal value of a particular signal within a range between an associated high alarm threshold and an associated low alarm threshold reflects normal operation of the respective at least one system component.

[0050] In addition, the computer system has a data processor to calculate the univariate distance from the associated alarm threshold for each signal with an associated alarm threshold at each sampling time point as the maximum value of the simple distance between the value of the corresponding signal and the alarm threshold associated with it, so as to quantify the degree of abnormality for the corresponding at least one system component; and to calculate the aggregated abnormality index reflecting the technical status of the entire technical system based on the univariate distance at the corresponding sampling time point at each sampling time point. As used herein, the term "at each sampling time point" refers to each sampling time point used for the calculation step. That is, in the case of a high sampling frequency, it may be sufficient to perform the calculation step only for every other, every other, etc. sampling time point. The technician will understand that it is not necessary to use every physical sampling time point in any scenario.

[0051] The user interface of the computer system provides the operator with a comparison of the aggregate anomaly index with a predetermined anomaly threshold. The anomaly threshold ensures with a given probability (confidence) that the aggregate anomaly index value reflects normal operation of the technical system when it is below the anomaly threshold. In other words, when the aggregate anomaly index exceeds the anomaly threshold, the technical system transitions to an abnormal technical state.

[0052] In one embodiment, the computer system further comprises a computation switch utilizing a steady state detection algorithm (SDA) configured to determine whether the technical system is operating in a steady state process and inhibit subsequent computation steps when the process is not in a steady state.

[0053] In one embodiment, a computer system has a component hierarchy of a technical system. The hierarchy defines a plurality of functional blocks as sub-nodes of the technical system, wherein each functional block includes a plurality of sub-nodes, and the plurality of sub-nodes include additional functional blocks and / or system components. A processor of the computer system is capable of calculating an aggregated block anomaly index BAI for a specific functional block at each sampling time point (i.e., a sampling time point used for calculation) based on a subset of univariate distances associated with the specific functional block at the corresponding sampling time point, wherein the block anomaly index reflects the technical status of the functional block. A user interface is capable of providing an operator with a comparison of the BAI with a predetermined block anomaly threshold. The block anomaly threshold ensures, with a given probability, that an aggregated block anomaly index value below the block anomaly threshold reflects normal operation of a specific functional block.

[0054] In one embodiment, the user interface further provides the operator with a subset of univariate distances at corresponding sampling time points, wherein the subset relates to such distances having the highest contribution to an increase in the aggregate anomaly index or the corresponding block anomaly index. The subset has a configurable (e.g., configurable by the operator) or predefined size.

[0055] Further aspects of the invention will be realized and attained by means of the elements and combinations particularly described in the appended claims.It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not intended to limit the invention as described. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A block diagram comprising a computer system for determining an abnormal technical state of a technical system according to an embodiment;

[0057] Figure 2 is a simplified flow chart of a computer-implemented method for determining an abnormal technical state of a technical system according to an embodiment;

[0058] Figure 3A illustrating univariate distances for example signals of system components reflecting a technical state of a technical system;

[0059] Figure 3B 1. shows an aggregate anomaly indicator for a technical system according to calculations according to an embodiment;

[0060] Figure 3C illustrates the types of cumulative distribution functions that can be used to determine anomaly thresholds according to embodiments;

[0061] Figure 3D shows univariate distances for a subset of signals having high contributions to the aggregate anomaly indicator according to an embodiment;

[0062] Figure 4illustrates an example of a component hierarchy of a technical system including functional blocks;

[0063] FIG. 5A to FIG. 5C illustrates a real-world example scenario for which aggregate anomaly indicators are determined;

[0064] Figure 6 is a diagram illustrating examples of a general purpose computer device and a general purpose mobile computer device that may be used with the techniques described herein. DETAILED DESCRIPTION

[0065] Figure 1 1 is a block diagram of an example embodiment of a computer system 100 for determining an abnormal technical state of a technical system 200 according to an embodiment. The computer system 100 and the technical system 200 are communicatively coupled, and the computer system 100 is configured to monitor the technical state of the technical system 200. For example, the technical system 200 can be a processing plant, a power plant, or any other equipment that performs an industrial process. Typically, industrial processes in factories (e.g., chemical plants, refineries, paper mills, and pulp mills, etc.) are controlled by automation systems that use networks to interconnect sensors, controllers, operator terminals, and actuators. Such automation systems often use a control system architecture known as Supervisory Control and Data Acquisition (SCADA). The computer system 100 has an interface 110 that receives multiple signals S1 to Sn from the technical system 200. Each signal is sampled over time and reflects the technical state of at least one system component. For example, a temperature signal can reflect the technical state of a motor component by indicating the temperature of the motor (too high a temperature can be an indicator for overheating). At the same time, further signals, such as vibration sensor signals, may also provide information about the technical state of the motor, since a too high degree of vibration may indicate problems with the bearings of the motor. The person skilled in the art knows which types of sensors are suitable in a technical system for monitoring the technical state of corresponding components or functional blocks of the technical system. A functional block can include a plurality of system components which together carry out a certain function, for example gas purification.

[0066] Figure 2 is a simplified flow chart of a computer-implemented method 1000 for determining an abnormal technical state of a technical system 200. The computer system 100 is capable of executing the method when a computer program is loaded into a memory of the computer system 100, wherein the computer program has computer-readable instructions that, when loaded and being executed by at least one processor of the computer system 100, cause the computer system to carry out the steps of the method 1000.

[0067] In the following, Figure 2 The flowchart is disclosed in the context of Figure 1For this reason, the following description uses reference Figure 1 and Figure 2 Optional components of computer system 100 and optional method steps are illustrated by dashed lines in the corresponding figures.

[0068] The computer system 100 can use any suitable protocol standard for process automation protocols for receiving 1100 sensor data S1 to Sn from the technical system 200 via the interface 110. For example, a person skilled in the art can select a suitable protocol from the protocol standards listed in the Wikipedia list of automation protocols available at: https: / / en.wikipedia.org / wiki / List_of_automation_protocols.

[0069] In addition, the computer system 100 is communicatively coupled to an alarm management system 300 associated with the technical system 200. The alarm management system 300 can also be an integral part of the computer system 100, or the alarm management system 300 can be run on a remote computer accessible to the computer system 100 through a corresponding network. The alarm management system 300 stores or determines high alarm thresholds H1 to Hn and low alarm thresholds L1 to Ln associated with the corresponding signals S1 to Sn of the technical system 200. The signal value of a specific signal in the range between the associated high alarm threshold and the associated low alarm threshold reflects the normal operation of the corresponding system component monitored by the specific signal. Alarm management is typically used in a process manufacturing environment controlled by an operator using a supervisory control system (such as a DCS, SCADA or a programmable logic controller (PLC)). Such a system can have hundreds of individual alarms that are often designed with only limited consideration of other alarms in the system. Since humans can only do one thing at a time and can focus on a limited number of things at a time, some way is needed to ensure that alarms are presented at a rate that can be thoroughly understood (assimilated) by human operators, especially when the plant is in chaos or in an abnormal situation. Advantageously, the alarm should be able to focus the operator's attention on the most important issues he or she needs to deal with, for example, using a priority indicating the degree of importance or rank. However, although the alarm management system includes all the knowledge of the alarm situation of the associated technical system (reflected by the low / high alarm thresholds), the system does not provide an aggregated indicator reflecting the overall technical status of the entire plant. In this context, information about the alarm thresholds is still valuable because the information includes knowledge of the entire alarm history of the technical system. In an initialization step, the computer system 100 can retrieve 1050 the high alarm thresholds H1 to Hn and the low alarm thresholds L1 to Ln associated with the corresponding signals S1 to Sn of the technical system 200 from the alarm management system 300, and use such data for the next data processing step to determine an indicator reflecting the technical status of the entire technical system 200 based on the received signal data and the alarm thresholds. This indicator will be referred to as the Aggregate Anomaly Index AAI of the technical system 200. Optionally, the computer system can perform an update search step 1200 to adapt to changes in the alarm management system during operation of the technical system. Such an update search 1200 can be limited to the alarm thresholds associated with the signals actually monitored via the computer system 100.

[0070] The computer system 100 has a data processor 120 having various modules for performing data processing tasks on received input data (signals S1 to Sn and high / low alarm threshold pairs (H1 / L1 to Hn / Ln). In the example, each signal S1 to Sn has an associated alarm threshold pair. In a real technical system, there may be signals that do not have an associated alarm threshold pair. Such signals can be ignored by the data processor when performing the following calculations. The aggregate anomaly index is calculated using alarms with associated limits such as: for example, absolute alarms, deviation alarms, rate of change alarms as defined by the standard NAMUR NA 102 for the application of alarm management. The version of the NA 102 specification dated February 10, 2018 can be obtained at: https: / / www.namur.net / de / empfehlungen-u-arbeitsblaetter / aktuelle-nena.html.

[0071] For each signal (e.g., signal S1) having an associated alarm threshold pair (e.g., H1 / L1), the univariate distance module 121 of the data processor calculates 1300 the univariate distance (e.g., dS1(t)) as the alarm threshold associated with the corresponding signal at each sampling time point. The univariate distance is determined as the maximum value of the distance between the value of the corresponding signal and the alarm threshold associated with it to quantify the degree of abnormality for (one or more) system components associated with the corresponding signal. Thus, the calculation can be used according to formulas F1, F2a to F2c. Alternatively, exponential smoothing can be used according to formulas F3, F4a to F4c. The calculated univariate distance is then provided as input to the abnormality indicator module 122 of the data processor.

[0072] The module 122 calculates 1400 an aggregate anomaly index AAI reflecting the technical status of the entire technical system 200 at each sampling time point based on the univariate distance at the corresponding sampling time point. For example, the aggregate anomaly index at a specific sampling time point can be calculated according to formula F5 as a Euclidian distance based on the univariate distance of the corresponding signal and the total number of signals.

[0073] Alternatively, it may be calculated as a weighted Euclidian distance based on the univariate distance of the corresponding signal and the total number of signals according to Formula F6. Thus, each univariate distance contribution is weighted with a weighting factor corresponding to the severity of the alarm associated with the corresponding signal as defined in the alarm management system. In other words, alarms for signals whose associated components may have a lower impact on the overall technical performance of the technical system 200 may contribute less to the aggregate anomaly index.

[0074] The computer system 200 also has a user interface (UI) component 130. The UI 130 can be implemented as any kind of human-machine interface (HMI) that allows the operator 10 of the technical system to communicate with the computer system 200. The UI 130 can include corresponding input / output components, including but not limited to audio-visual components including a display / sound output component that conveys information to the user and a data input component (e.g., keyboard, mouse, touch screen, etc.) that receives input data from the user. The UI 130 provides 1500 a comparison of the aggregated anomaly index AAI with a predetermined anomaly threshold to the operator 10. The anomaly threshold ensures that the aggregated anomaly index value reflects the normal operation of the technical system 200 when it is below the anomaly threshold with a given probability. In other words, when the aggregated anomaly index value is less than the anomaly threshold, there is a given probability (e.g., with a confidence of 0.95) that the technical system 200 is in normal operation. By using a corresponding anomaly threshold, the probability may even become higher (e.g., 0.99). Advantageously, the anomaly threshold is determined by using the cumulative distribution function of the aggregated anomaly index AAI during normal operation of the technical system 200. The computing tasks in steps 1300, 1400, and 1500 of method 1000 utilize FIG. 3A to FIG. 3C for more detailed discussion.

[0075] In an optional embodiment, the data processor 120 has a calculation switch 123. The calculation switch is implemented as a steady state detection algorithm SDA capable of determining 1250 whether the technical system 200 is operating in a steady state process. If the technical system is not in a steady state ("no"), the computer system does not perform any of the calculation tasks of steps 1300, 1400, 1500. Otherwise ("yes"), the method 1000 continues with step 1300. For the calculation tasks, it is advantageous that the process run by the technical system is in a steady state. Therefore, the calculation switch 121 is capable of switching off the calculation of all indices (univariate distance and aggregate anomaly index) during the transient phase. For example, well-known stable detection algorithms can be used to identify when the calculation of the indices should be started again (e.g., Cao, S., and Rhinehart, RR et al. (1995). An efficient method for on-line identification of steady state. Journal of Process Control, 5 (6), 363–374).

[0076] In a further optional embodiment, the computer system 100 is able to access a component hierarchy of the technical system 200. Such a component hierarchy may be stored by the computer system itself, or such a component hierarchy may be provided by the technical system or its associated automation system. The component hierarchy defines a plurality of functional blocks as sub-nodes of the technical system. Each functional block may include a plurality of sub-nodes, which may be further functional blocks and / or system components of the technical system. In other words, the functional blocks are used to group together a plurality of system components that may be associated with the same function of the technical system. Such functional blocks are sometimes also referred to as process blocks (e.g., boilers, pumps, turbines, or process areas). In Figure 4 The details of the component level are discussed in the context of .

[0077] In this optional embodiment, the data processor 120 is further configured to calculate 1450 (one or more) aggregated block anomaly indicators BAI at each sampling time point. (One or more) block anomaly indicators BAI reflect the technical status of (one or more) corresponding functional blocks. Based on a subset of univariate distances associated with a specific functional block (at the corresponding sampling time point), the corresponding aggregated block anomaly indicator BAI is calculated for the specific functional block. The calculation is performed in a similar manner to the calculation of AAI, but only for a subset of univariate distances associated with a specific functional block. In addition, the user interface 130 provides 1550 a comparison of a specific block anomaly indicator BAI with a predetermined block anomaly threshold to the operator. Similar to the comparison with AAI, the block anomaly threshold ensures that the aggregated block anomaly indicator value reflects the normal operation of a specific functional block when it is below the block anomaly threshold with a given probability. In this embodiment, the operator can drill down from the original AAI of the functional blocks of the technical system to the BAI. This allows the operator to perform root cause analysis at the level of the functional blocks of the technical system and quickly identify the (one or more) functional blocks that contribute the most to the abnormal situation of the technical system as a whole as identified by the AAI.

[0078] In another optional embodiment, the drill-down function of the level of system components is enabled. In this embodiment, UI 130 further provides 1600 the operator with a subset TOPm of the univariate distance at the corresponding sampling time point. Thus, the subset TOPm involves such distances with the highest contribution to the increase of the aggregated abnormal index, wherein the size m of the subset TOPm is predefined. Since each univariate distance is directly associated with a signal, which is in turn associated with a system component, the drill-down to the component level is enabled. For example, the operator can set the size m so that he receives a certain amount of technical status information that can still be handled with his cognitive ability. Different operators can choose different sizes. The computer system can set a default value that can be selected as an average size used by all users of the computer system. Based on the technical status information conveyed to the operator 10 through AAI (and optional drill-down information about BAI and / or system components), the operator can initiate a corrective action 20 in response to (one or more) determined abnormal indicators. As a result, the computer system helps the operator to perform the technical task of monitoring the technical system and interact with the technical system when required.

[0079] In another optional embodiment, as previously described, a specific technical state parameter (such as the state of a chemical reactor) can be represented by a plurality of sensor signals (such as, for example, the temperature measured by a plurality of temperature sensors). The sensor provides redundant information in the specific technical state of a given reactor. Nevertheless, each of the temperature signals indicates normal or abnormal operation of the reactor. The data processor can aggregate the univariate distances associated with the plurality of sensor signals to provide a robust univariate distance for a specific technical state parameter. In the reactor example, the univariate distances corresponding to the temperature signals of the corresponding temperature sensors can be aggregated. If one of the sensors fails, there is still a meaningful distance value available that characterizes the technical state of the reactor. For example, a "two-thirds" vote can be used to obtain the actual reactor temperature in the event of a sensor failure. In other cases, sensor redundancy can be used, for example, where the first sensor is used by the control system and the second sensor is used by the safety system.

[0080] Figure 3A The univariate distances d1 to d34 for real-world example signals reflecting the technical status system components of the technical system are illustrated. Some of the signals show abnormal behavior reflected by the corresponding univariate distance (e.g., d3, d4, d13, d15, d20, d21, etc.) increasing to the upper (abnormal) limit of the univariate distance range at certain time points. Some signals (e.g., d5 to d10) show no increase in univariate distance at all. Some signals (e.g., d18, d19) show an intermediate increase in the univariate distance that is normalized again without reaching the upper limit.

[0081] Figure 3B A view 360 is shown with an aggregate anomaly index AAI for a technical system provided to an operator of the technical system. The view 360 also includes a visualization of an anomaly threshold AAI to which the AAI is compared. The AAI is calculated according to formulas F5 to F6. Figure 3A The anomaly threshold AAT is predetermined so that the aggregate anomaly index value reflects the normal operation of the technical system with a given probability p (e.g., p=0.95) when it is below the anomaly threshold AAT. Advantageously, the anomaly threshold AAT is determined by using the cumulative distribution function of the aggregate anomaly index AAI during normal operation of the technical system. In probability theory and statistics, the cumulative distribution function (CDF) of a true-valued random variable X1 evaluated at x is the probability that X1 will take a value less than or equal to x. In the case of a continuous distribution, it gives the area under the probability density function from negative infinity to x.

[0082] Figure 3C The CDF type of cumulative distribution function that can be used to determine anomaly thresholds is illustrated. Cumulative distribution functions are explained in detail in many publications, such as, for example, in "Introduction to Statistical Modelling" by Annette J. Dobson, Chapman, and Hall, et al., 1983. CDF type 371 shows the cumulative distribution function of a discrete probability distribution. CDF type 372 shows the cumulative distribution function of a continuous probability distribution. CDF type 373 shows the cumulative distribution function of a distribution having both a continuous portion and a discrete portion. Those skilled in the art can select an appropriate CDF type for determining anomaly thresholds. In many cases, CDF type 372 is appropriate.

[0083] Figure 3D The univariate distances d20, d21, d25, d32, d33 for a subset of signals with high contributions to the aggregate anomaly index are shown. In the example, the subset TOPm includes Figure 3A The subset TOPm includes the top 5 distances among the univariate distances of Figure 3B The subset allows the operator to immediately drill down to the univariate distances of the predefined number m (in the example: m=5) that make the highest contribution to the increase of the aggregate anomaly indicator AAI in Figure 3B The anomaly threshold AAT in is the most relevant signal contributing to the abnormal system behavior indicated by AAI. Therefore, the operator can immediately focus on the potential root cause of the abnormal system behavior by focusing on the status parameters that present a potential high correlation for the abnormal behavior.

[0084] Figure 4 An example of a component hierarchy 400 of a technical system 200 including functional blocks 210, 220, 230 is illustrated. As described in detail above, the technical state of the technical system 200 is reflected by the associated AAI. The technical system 200 typically includes a large number of system components monitored by corresponding sensor signals. The hierarchy 400 only shows a simplified view on the technical system 200 with system components 211, 212, 221, 231, 232, 233 that are considered to represent hundreds or even thousands of components of a real-world technical process system. Each system component is associated with a corresponding univariate distance d211, d212, d221, d231, d232, d233 that reflects the technical state of the component. Typically, certain functions of the technical system 200 are implemented by a subset of components that act together to implement the corresponding functions. In the example hierarchy 400, the components 212, 213 are grouped into a functional block 210, for which the aggregated block anomaly indicator BAI1 is calculated based on a subset of the univariate distances d211, d212. For example, the functional block 210 may be an additive supply for a reactor, comprising a tank 211 monitored via a level gauge, for which the univariate distance d211 is determined, and also comprising a pump 212 monitored via a flow meter, for which the univariate distance d212 is determined. The overall technical status of the block 210 is then reflected by BAI1. The functional block may also include functional sub-blocks as shown in the example of a functional block 220 including a functional block 230 of the next level in the hierarchy 400. For example, the functional block 220 may reflect the reactor function of the technical system 200 including a functional block 230 representing the reactor itself and a component 221 representing a peripheral component of the reactor function (e.g., an output valve). For example, a chemical reactor may include components such as valves, tanks, heaters, pumps, coolers, sensors, safety devices (such as emergency shut-off switches, etc.). The technical status of valve 221 can be monitored by a corresponding flow meter, for which a univariate distance d232 is determined. The technical status of reactor 230 can be characterized by the filling level, temperature, and pressure in the reactor. The corresponding level gauge 231, thermometer 232, and pressure gauge 233 are system components grouped into a reactor functional block 230. The associated univariate distances d231, d232, and d233 are aggregated into a corresponding aggregate block abnormality indicator BAI3 reflecting the overall technical status of the reactor. Then, BAI3 is aggregated with d232 into an aggregate block abnormality indicator BAI2 reflecting the technical status of the overall reactor function 220 including peripheral components.

[0085] Using aggregated block anomaly indicators associated with functional blocks of the component hierarchy 400 of the technical system 200 allows an operator to quickly drill down to a more granular view of the technical system and identify the underlying functions causing abnormal behavior of the technical system. Figure 3D A user interface for an operator may also present such a top ranking list of aggregated functional block indicators, thereby allowing an operator to quickly identify functions to be analyzed in detail due to their contribution to abnormal behavior reflected by the associated BAI.

[0086] FIG. 5A to FIG. 5C A real-world example scenario (including two reactor tanks) is illustrated for which aggregation anomaly indicators are determined. Process alarms are a known method of indicating a required action to an operator. For example, when the tank level reaches a certain limit, a high alarm is issued indicating that the tank has reached a high level. The affected equipment ((one or more) system components) is typically sending an alarm and a message text shown to the operator in an alarm list. The operator can then act accordingly and, for example, open a valve and start a pump to reduce the liquid level inside the tank. When an alarm occurs, the alarm is typically visualized in an alarm list including the technical name of the corresponding component signal as shown in Table 1.

[0087] Table 1: Example of a traditional alert list

[0088] Day / Time Signal Device Type 05 15:25:28 70_V11 Exhaust valve 05 15:25:28 70_M1 fan 05 15:25:28 70_M1 fan 05 15:25:28 70_M2 fan 05 15:25:28 70_P1 Pump 05 15:25:28 70_P1 Pump 05 15:25:28 70_V12 valve 05 15:25:28 70_V13 valve

[0089] In addition, in some cases, the alarms are also visualized directly in the human-machine interface at the device. Now, the operator can react to those alarms. However, it is very difficult to perform any root cause analysis on this type of alarm information, because the alarm is often followed by several subsequent alarms. In the example in Table 1, multiple system components control the alarms issued by two reactors. The operator is overwhelmed by a large number of process alarms (alarm flood) and cannot decide which alarm to react to. Therefore, the operator needs a compact visualization of technical status information that indicates the current process state and allows tracking the process state over time.

[0090] Figure 5A A (simplified) part of a technical process system 500 with two connected reactor tanks R1, R2 is shown. A pump P can supply liquid to the tanks. The inflow of the tanks is controlled by valve V A and V B There may be associated alarm visualizations AP, AV implemented directly on the respective device. A and AV B Each reactor tank has a level gauge L1, L2 that controls the fill level of the respective tank R1, R2. The outflow of the tank is controlled by a valve V C and VD With pump P C and P D Furthermore, the associated alarm visualization AV C ,AV D 、AP C and AP D May be available in the corresponding system components. For tanks R1, R2, the level gauge values ​​can be visualized over time as a graph with a low level indicator LL (e.g., 5% of the tank level) and an upper level indicator UL (e.g., 95% of the tank level) as boundaries of the normal operating range. For example, the LL boundary may correspond to a low alarm threshold in an alarm management system of the system 500, and UL may correspond to a high alarm threshold. On an actual (real world) operator screen, typically only the current value of the monitored technical parameter is displayed. In order to obtain a time trend of the process variable, the operator usually opens another page of the monitoring application. Therefore, FIG. 5A to FIG. 5C The visualization of the time trend of the level gauges L1 , L2 in FIG. 1 illustrates the concept of visualization. In a real system, data showing the time trend is typically retrieved in a multi-step interaction between an operator and the HMI.

[0091] Since the diagram is simplified, in reality the reactors R1, R2 may be connected to additional conduits with additional inflow valves (e.g. for adding additives to the liquid stored in the tank). Further system components like temperature sensors or pressure sensors for characterizing the technical status of the tank are not shown in the diagram. However, a person skilled in the art will understand that a real-world process system comprises more system components. However, for explaining the concept of the invention, Figure 5A A simplified example is sufficient.

[0092] For both reactors, the actual fill level increases over time and moves above the average level indicated by the horizontal average line between UL and LL near the upper limit UL. Now, the computer system can determine the univariate distance for the level gauge signals L1, L2 and calculate the AAI for the overall process system 500. The results can be visualized to the operator via the human machine interface HMI. The operator immediately sees that at time t1, the AAI exceeds the AAT threshold indicating abnormal system behavior.

[0093] Figure 5BIt is illustrated that, for the two reactors R1 and R2, at a time point t1', t1'' later than t1, the conventional alarm thresholds for the corresponding level gauge signals are exceeded. In other words, conventional alarm management, which issues an alarm when the signal exceeds the high / low alarm thresholds, indicates an abnormal situation in the system at the earliest at a time point t1' that occurs after the time point t1. That is, the aggregate alarm indicator AAI warns the operator at a time point earlier than the individual alarms at the signal level. In this case, the operator is notified "early enough" (i.e., before a flood of alarms is generated by the control system) that the process is evolving towards an abnormal situation. The operator is able to take preemptive action on the process to avoid the process reaching an abnormal situation. This can be advantageous in situations where it is required to shut down some equipment immediately to avoid damage to certain system components. It will be noted that Figure 5B , Figure 5C The univariate distances for the level gauge parameters are not shown, but the signal values ​​SR1, SR2 compared to the high alarm thresholds HTR1, HTR2 are shown. The corresponding univariate distances are then calculated based on these values. The process variables SR1, SR2 can exceed their alarm thresholds HTR1, HTR2 (i.e. reach a level above the upper limit). The corresponding univariate distance d(t) is bounded by 1). The aggregate anomaly indicator is where N is the number of process variables. This value can be normalized (i.e., divided by ), to have a bound of 1 on D(t).

[0094] Figure 5C The following diagram shows the situation: Figure 3A The drill-down of AAI in facilitates root cause analysis for the operator. In this example, only the level gauge L1 of reactor R1 shows abnormal behavior, while L2 of R2 stays completely within the normal range. The operator is able to focus on and react to the subset of process variables that are most relevant to the deviation of the process abnormality indicator above its tolerable limit.

[0095] Figure 6 is a diagram showing an example of a general purpose computer device 900 and a general purpose mobile computer device 950 that can be used with the techniques described herein. In some embodiments, the computing device 900 can be related to the system 100 (see Figure 1 ). Computing device 950 is intended to represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, and other similar computing devices. In the context of the present disclosure, computing device 950 may allow a human user to interact with device 900. In other embodiments, the entire system 100 may be implemented on mobile device 950. The components shown herein, their connections and relationships, and their functions are intended to be exemplary only, and are not intended to limit the implementation of the inventions described and / or claimed in this document.

[0096] The computing device 900 includes a processor 902, a memory 904, a storage device 906, a high-speed interface 908 connected to the memory 904 and a high-speed expansion port 910, and a low-speed interface 912 connected to a low-speed bus 914 and the storage device 906. Each of the components 902, 904, 906, 908, 910, and 912 is interconnected using various buses and can be installed on a common motherboard or otherwise installed where appropriate. The processor 902 is capable of processing instructions for execution within the computing device 900, including instructions stored in the memory 904 or stored on the storage device 906, to display graphical information for a GUI on an external input / output device (such as a display 916 coupled to the high-speed interface 908). In other implementations, multiple processors and / or multiple buses can be used in conjunction with multiple memories and multiple types of memories where appropriate. In addition, multiple computing devices 900 can be connected to each device that provides a portion of the necessary operations (for example, as a server group, a group of blade servers, or a multi-processor system).

[0097] The memory 904 stores information within the computing device 900. In one implementation, the memory 904 is a volatile memory unit(s). In another implementation, the memory 904 is a non-volatile memory unit(s). The memory 904 may also be another form of computer-readable medium, such as a magnetic disk or optical disk.

[0098] The storage device 906 can provide mass storage for the computing device 900. In one implementation, the storage device 906 can be or include a computer-readable medium, such as a floppy disk device, a hard disk device, an optical disk device or a tape device, a flash memory or other similar solid-state memory device or device array, including devices in a storage area network or other configuration. A computer program product can be tangibly embodied in an information carrier. The computer program product may also include instructions that, when executed, implement one or more methods (such as those described above). The information carrier is a computer or machine-readable medium, such as the memory 904, the storage device 906, or a memory on the processor 902.

[0099] The high-speed controller 908 manages bandwidth-intensive operations for the computing device 900, while the low-speed controller 912 manages lower bandwidth-intensive operations. Such functional allocation is exemplary only. In one implementation, the high-speed controller 908 is coupled to the memory 904, the display 916 (e.g., through a graphics processor or accelerator), and the high-speed expansion port 910, which can accept various expansion cards (not shown). In this implementation, the low-speed controller 912 is coupled to the storage device 906 and the low-speed expansion port 914. The low-speed expansion port, which can include various communication ports (e.g., USB, Bluetooth, Ethernet, wireless Ethernet), can be coupled to one or more input / output devices, such as a keyboard, a pointing device, a scanner, or a networking device, such as a switch or a router, for example, through a network adapter.

[0100] As shown in the figure, computing device 900 can be implemented in a number of different forms. For example, it can be implemented as a standard server 920 or multiple times in a group of such servers. It can also be implemented as part of a rack server system 924. In addition, it can be implemented in a personal computer (such as a laptop computer 922). Alternatively, components from computing device 900 can be combined with other components in a mobile device (not shown) (such as device 950). Each of such devices can contain one or more of computing devices 900, 950, and the entire system can be composed of multiple computing devices 900, 950 that communicate with each other.

[0101] Computing device 950 includes, among other components, a processor 952, a memory 964, an input / output device such as a display 954, a communication interface 966, and a transceiver 968. Device 950 may also be provided with a storage device, such as a microdrive or other device, to provide additional storage. Each of components 950, 952, 964, 954, 966, and 968 are interconnected using various buses, and several of the components may be mounted on a common motherboard or otherwise where appropriate.

[0102] The processor 952 is capable of executing instructions within the computing device 950 (including instructions stored in the memory 964). The processor may be implemented as a chipset including individual and multiple analog and digital processor chips. The processor may, for example, provide coordination of other components of the device 950 (such as control of a user interface, applications executed by the device 950, and wireless communications performed by the device 950).

[0103] The processor 952 can communicate with the user through the control interface 958 and the display interface 956 coupled to the display 954. The display 954 can be, for example, a TFT LCD (thin film transistor liquid crystal display) or an OLED (organic light emitting diode) display or other appropriate display technology. The display interface 956 may include an appropriate circuit system for driving the display 954 to present graphics and other information to the user. The control interface 958 can receive commands from the user and convert these commands so as to submit them to the processor 952. In addition, an external interface 962 can be provided in communication with the processor 952 so as to enable near-field communication of the device 950 with other devices. The external interface 962 can provide, for example, wired communication in some implementations, or wireless communication in other implementations, and multiple interfaces can also be used.

[0104] The memory 964 stores information within the computing device 950. The memory 964 can be implemented as one or more of (one or more) computer-readable media, (one or more) volatile memory units, or (one or more) non-volatile memory units. The expansion memory 984 can also be provided and connected to the device 950 through the expansion interface 982, which can include, for example, a SIMM (single in-line memory module) card interface. Such an expansion memory 984 can provide additional storage space for the device 950, or can also store applications or other information for the device 950. In particular, the expansion memory 984 can include instructions for implementing or supplementing the above-mentioned processes, and can also include security information. Therefore, for example, the expansion memory 984 can act as a security module for the device 950 and can be programmed with instructions for the safe use of the licensed device 950. In addition, a security application can be provided via a SIMM card together with additional information, such as placing identification information on the SIMM card in an unhackable manner.

[0105] As discussed below, the memory may include, for example, flash memory and / or NVRAM memory. In one implementation, a computer program product is tangibly embodied in an information carrier. The computer program product contains instructions that, when executed, implement one or more methods (such as those described above). The information carrier is a computer or machine readable medium, such as memory 964, expansion memory 984, or memory on processor 952, which may be received, for example, via transceiver 968 or external interface 962.

[0106] Device 950 can communicate wirelessly through communication interface 966, and described communication interface 966 can include digital signal processing circuit system when necessary.Among other things, communication interface 966 can also provide communication under various modes or protocols (such as, GSM voice call, SMS, EMS or MMS message transmission, CDMA, TDMA, PDC, WCDMA, CDMA2000 or GPRS).Such communication can occur, for example, through radio frequency transceiver 968.In addition, short-range communication can occur such as using Bluetooth, WiFi or other such transceivers (not shown).In addition, GPS (global positioning system) receiver module 980 can provide additional wireless data related to navigation and position (which can be used by applications running on device 950 in appropriate circumstances) to device 950.

[0107] The device 950 may also communicate audibly using an audio codec 960, which may receive verbal information from a user and convert it into usable digital information. The audio codec 960 may likewise generate audible sounds for the user, such as through a speaker in a handheld device of the device 950, for example. Such sounds may include sounds from voice phone calls, may include recorded sounds (e.g., voice messages, music files, etc.), and may also include sounds generated by applications operating on the device 950.

[0108] As shown in the figure, computing device 950 can be implemented in many different forms. For example, computing device 950 can be implemented as a cellular telephone 980. Computing device 950 can also be implemented as part of a smart phone 982, a personal digital assistant, or other similar mobile device.

[0109] Various implementations of the systems and techniques described herein can be obtained in digital electronic circuit systems, integrated circuit systems, specially designed ASICs (application specific integrated circuits), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementations in one or more computer programs executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from a storage system, at least one input device, and at least one output device, and to transmit data and instructions to the storage system, at least one input device, and at least one output device.

[0110] These computer programs (also referred to as programs, software, software applications or code) include machine instructions for a programmable processor and can be implemented in high-level procedural and / or object-oriented programming languages ​​and / or in assembly / machine languages. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0111] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user, and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other kinds of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form including sound, voice, or tactile input.

[0112] The systems and techniques described herein can be implemented in a computing device that includes a back-end component (e.g., as a data server) or includes a middleware component (e.g., an application server) or includes a front-end component (e.g., a client computer with a graphical user interface or a web browser through which a user can provide his or her interaction with an implementation of the systems and techniques described herein), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), and the Internet.

[0113] The computing device can include clients and servers. Clients and servers are generally remote from each other and typically interact through a communication network. The relationship of client and server arises in view of computer programs running on respective computers and having a client-server relationship to each other.

Claims

1. A computer-implemented method (1000) for determining an abnormal technical state of a technical system (200), comprising: receiving (1100) a plurality of signals from the technical system (200), wherein each signal (S1 to Sn) is sampled over time and reflects a technical state of at least one system component; retrieving high alarm thresholds (H1 to Hn) and low alarm thresholds (L1 to Ln) from an alarm management system (300) associated with the technical system (200); For each signal (S1) having an associated high alarm threshold and a low alarm threshold obtained from the alarm management system (300), at each sampling time point, a univariate distance from its associated alarm threshold (H1 / L1) is calculated (1300) as the maximum value of the distance between the value of the corresponding signal and its associated alarm threshold, so as to quantify the degree of abnormality for the corresponding at least one system component, wherein The univariate distance d(t) for a particular signal at sampling time t can be expressed by the following mathematical formula: where x(t) is a sample of the signal at time t, x h is the high alarm threshold associated with the signal defined in the alarm management system, x l is the low alarm threshold associated with the signal, and a is the normal value of the variable, where x l <a<x h ; At each sampling time point, an aggregate anomaly index (AAI) reflecting the technical status of the entire technical system (200) is calculated (1400) based on the univariate distance at the corresponding sampling time point, wherein the aggregate anomaly index at the sampling time point is: - According to the formula is calculated as the Euclidian distance based on the univariate distance of the corresponding signals and the total number of signals, or - According to the formula is calculated as a weighted Euclidian distance based on the univariate distance of the corresponding signals and the total number of signals, where And for i=1..n, w i ≥0, where d i (t) corresponds to the univariate distance of signal i, and N corresponds to the total number of signals received, wherein each univariate distance contribution is weighted with a weighting factor corresponding to a severity of an alarm associated with the corresponding signal as defined in the alarm management system, and wherein the calculation of the Aggregate Anomaly Index (AAI) does not involve any pattern recognition; and A comparison of the aggregate anomaly index (AAI) with a predetermined anomaly threshold is provided (1500) to an operator (10), wherein the anomaly threshold ensures with a given probability that the aggregate anomaly index value reflects normal operation of the technical system when it is below the anomaly threshold, wherein the abnormal technical state is determined when the aggregate anomaly index exceeds the anomaly threshold.

2. The method according to claim 1, wherein: The anomaly threshold is determined by using a cumulative distribution function of the aggregate anomaly index (AAI) during normal operation of the technical system (200).

3. The method according to claim 1, wherein: Prior to the calculation steps (1300, 1400), a steady state detection algorithm (SDA) is used to determine (1250) whether the technical system (200) is operating in a steady state process, and the calculation steps (1300, 1400) are inhibited when the process is not in a steady state.

4. The method according to claim 1, further comprising: The operator is further provided with a subset (TOPm) of the univariate distances at the corresponding sampling time points, wherein the subset relates to such univariate distances having the highest contribution to the increase of the aggregated anomaly indicator, wherein a size m of the subset (TOPm) is predefined.

5. The method according to claim 1, wherein: The univariate distance for a specific signal at a specific sampling time point is calculated so that: if the sampled signal value is between the low alarm threshold and the high alarm threshold, the distance value is between 0 and 1; if the sampled signal value is less than or equal to the low alarm threshold or greater than or equal to the high alarm threshold, the distance value is 1; and if the sampled signal value corresponds to a predefined parameter value reflecting normal operation, the distance value is 0.

6. The method according to any one of claims 1 to 5, wherein: The univariate distance for a particular signal at a particular sampling time point is smoothed by exponential smoothing.

7. The method according to claim 6, wherein: The univariate distance for a particular signal at a particular sampling time point is defined by introducing the normal range of the signal [a l ,a2], where the upper limit a2 is less than the corresponding high alarm threshold x h , and the lower limit a1 of the interval is greater than the corresponding low alarm threshold x l , so that: if the sampled signal value is within the interval, the distance value is 0; for x(t) l , the distance value is And for x(t)>a2, the distance value is Among them, α>1.​ 8. The method according to any one of the preceding claims 1 to 5, wherein: The component hierarchy (400) of the technical system defines a plurality of functional blocks (210, 220) as sub-nodes of the technical system (200), wherein each functional block (210, 220) comprises a plurality of sub-nodes, wherein the plurality of sub-nodes comprises further functional blocks (230) and / or system components (211, 212, 221), and the method further comprises: At each sampling time point, based on a subset of univariate distances associated with a specific functional block, calculating (1450) an aggregated block anomaly index (BAI) for the specific functional block at the corresponding sampling time point, wherein the block anomaly index (BAI) reflects the technical status of the functional block; and A comparison of the block anomaly index (BAI) to a predetermined block anomaly threshold is provided (1550) to the operator, the block anomaly threshold ensuring, with a given probability, that an aggregate block anomaly index value reflects normal operation of the particular functional block when below the block anomaly threshold.

9. The method according to any one of the preceding claims 1 to 5, wherein: The specific technical state parameter is represented by a plurality of sensor signals providing redundant information in specifying the specific technical state, the method further comprising: The univariate distances associated with the plurality of sensor signals are aggregated to provide a robust univariate distance for the particular technology state parameter.

10. A computer program product is provided for determining an abnormal technical state of a technical system (200), the computer program product comprising instructions which, when loaded into a memory of a computer system and being executed by at least one processor of the computer system, cause the computer system to carry out the method steps according to any one of claims 1 to 9.

11. A computer system (100) for determining an abnormal technical state of a technical system (200), the computer system (100) comprising: An interface (110), the interface (110): configured to receive a plurality of signals from said technical system (200), wherein each signal (S1 to Sn) is sampled over time and reflects said technical state of at least one system component; as well as configured to retrieve, from an alarm management system (300) associated with the technical system (200), a high alarm threshold (H1 to Hn) and a low alarm threshold (L1 to Ln) associated with the respective received signal (S1 to Sn), wherein a signal value of a particular signal within a range between the associated high alarm threshold and the associated low alarm threshold reflects normal operation of the respective at least one system component; as well as A data processor (120), wherein the data processor (120): The method is configured to calculate, for each signal (S1) having an associated alarm threshold, a univariate distance from the associated alarm threshold (H1 / L1) as the maximum value of the distance between the value of the corresponding signal and the associated alarm threshold at each sampling time point, so as to quantify the degree of abnormality for the corresponding at least one system component, wherein the univariate distance d(t) for a specific signal at the sampling time point t can be expressed by the following mathematical formula: where x(t) is a sample of the signal at time t, x h is the high alarm threshold associated with the signal defined in the alarm management system, x l is the low alarm threshold associated with the signal, and a is the normal value of the variable, where x l <a<x h ;as well as The method is configured to calculate, at each sampling time point, an aggregate anomaly index (AAI) reflecting the technical status of the entire technical system (200) based on the univariate distance at the corresponding sampling time point, wherein the aggregate anomaly index at the sampling time point is: - According to the formula is calculated as the Euclidian distance based on the univariate distance of the corresponding signals and the total number of signals, or - According to the formula is calculated as a weighted Euclidian distance based on the univariate distance of the corresponding signals and the total number of signals, where And for i=1..n, w i ≥0, where d i (t) corresponds to the univariate distance of signal i, and N corresponds to the total number of signals received, wherein each univariate distance contribution is weighted using a weighting factor corresponding to a severity of an alarm associated with the corresponding signal as defined in the alarm management system, and wherein the aggregate anomaly index (AAI) calculation does not involve any pattern recognition; as well as A user interface component (130) is configured to provide an operator (10) with a comparison of the aggregate anomaly index (AAI) with a predetermined anomaly threshold (AAT), the anomaly threshold ensuring with a given probability that the aggregate anomaly index value reflects normal operation of the technical system when it is below the anomaly threshold, wherein the abnormal technical state is determined when the aggregate anomaly index exceeds the anomaly threshold.

12. The computer system according to claim 11, wherein: The data processor (120) further includes: A calculation switch (123) utilizing a steady state detection algorithm (SDA) is configured to determine whether the technical system (200) is operating in a steady state process and to inhibit subsequent calculation steps when the process is not in a steady state.

13. The computer system according to claim 11, wherein: The component hierarchy of the technical system defines a plurality of functional blocks as sub-nodes of the technical system (200), wherein each functional block comprises a plurality of sub-nodes, the plurality of sub-nodes comprising further functional blocks and / or system components, The processor (120) is further configured to calculate an aggregated block anomaly index (BAI) for a specific functional block at each sampling time point based on a subset of univariate distances associated with the specific functional block at the corresponding sampling time point, wherein the block anomaly index (BAI) reflects the technical status of the functional block; as well as The user interface (130) is further configured to provide the operator with a comparison of the block anomaly index (BAI) with a predetermined block anomaly threshold value, the block anomaly threshold value ensuring with a given probability that an aggregated block anomaly index value reflects normal operation of the particular functional block when below the block anomaly threshold value.

14. The computer system according to any one of claims 11 to 13, wherein the user interface (130) is further configured to: A subset (TOPm) of the univariate distances at the respective sampling time points is provided to the operator, wherein the subset relates to such distances having the highest contribution to the increase of the aggregated anomaly indicator, wherein a size m of the subset (TOPm) is predefined.

Images