Server and system for automatically selecting labels for modeling and anomaly detection

Abstract

The server system can be operated to automatically associate tags within a system that defines a process. Operations include accessing tags and associated signals, which comprise multiple data values ​​over time indicating the physical properties, behavior, or measurement of components within the process. For each signal, a time-weighted average over a specific time period is calculated; a specific number of different date periods are selected from the tags and signals; and for each tag, the slope and intercept are calculated by performing a linear regression of multiple signals over the specific time period. Additionally, residuals for each data value of the signal over the specific time period are calculated, and a normalized value for each residual is calculated. The absolute value of the dot product of the normalized residual and the residuals of subsequent tags is then calculated.

Description

Background Technology

[0001] Computerized industrial control automation systems and networked computerized systems are typically used to monitor, record, and display relevant manufacturing / production events and associated data, providing supervisory-level control, manufacturing information, and diagnostics. Typical industrial processes are extremely complex, generating far more information than anyone can process in its raw form.

[0002] As an example, industrial facilities typically have thousands of sensors and control elements (e.g., actuators for physical assets) monitoring and / or controlling various aspects of multi-stage processes. These sensors come in many types and report numerous characteristics of the process. Their outputs may also vary similarly in their meaning of measurement, the amount of data sent per measurement, and their measurement frequency. Furthermore, for accuracy and to achieve rapid response, some of these sensors / control elements perform one or more measurements per second or less. A single sensor / control element multiplied by thousands of sensors and control elements (a typical industrial control environment) results in a massive influx of data into manufacturing information and process control systems. Distributing the entire amount of data to or from all user equipment would overload communication networks and could unnecessarily utilize network resources by sending user-irrelevant data associated with one or more user equipment.

[0003] "Historization" is a crucial task in the industry because it enables the analysis of data representing historical information to improve industrial processes. As more and more data is logged into operational historical recorders, customers are looking for ways to understand that data. For example, a plant may have many valves controlling the flow into many tanks. The historical recorder initially doesn't know which valve corresponds to which tank.

[0004] If interrelated and / or associated components can be automatically detected, this knowledge of relationships can be used to suggest data labels for joint analysis. For example, if an operator or engineer is viewing a line graph of a given tank, the system can suggest adding lines for attached valves. This knowledge of relationships can also be used to suggest search results. If a user searches for "tank," the system can include relevant inlet and outlet valves in the search results. Furthermore, this knowledge of relationships can be used to provide a network diagram of label relationships.

[0005] Knowledge of these relationships can also be used to provide input to anomaly detection systems to monitor ongoing relationships. As a non-limiting example only, if it is known that opening the inlet valve always fills the tank, and one day the valve is opened but the tank is not filled, then one or more users can be notified. Summary of the Invention

[0006] Some embodiments include a computer-implemented method comprising providing a server system including at least one processor, and at least one non-transitory computer-readable storage medium for data communication with the at least one processor. In some embodiments, the at least one non-transitory computer-readable storage medium includes program logic that, when executed by the at least one processor, causes the server system to operate for automatic association of tags within a system defining a process. For example, in some embodiments, the operation includes accessing a plurality of tags and a plurality of associated signals, which include a plurality of data values ​​over time indicating physical properties, behavior, or measurements of components of the process. Additionally, in some embodiments, the operation includes calculating a time-weighted average over a specific time period for each of the plurality of signals. Additionally, in some embodiments, the operation includes selecting a specific number of different date periods sampled from the plurality of tags and the plurality of associated signals for each signal. In some embodiments, the operation includes calculating a slope and intercept for each of the plurality of tags by calculating a linear regression of the plurality of signals over a specific time period. Additionally, in some embodiments, the operation includes calculating a residual value for each data value of the plurality of signals over a specific time period by subtracting the expected value calculated from the linear regression from the actual value of each data value of the plurality of signals over the specific time period. In some other embodiments, the operation includes calculating a normalized value for each residual value by subtracting its mean from all its samples and dividing each sample by its residual standard deviation. In some embodiments, the operation includes calculating the absolute value of the dot product of the normalized residual value and the residual values ​​of a plurality of subsequent labels among a plurality of labels.

[0007] In some embodiments, the operation includes assigning the minimum dot product of the dot products calculated for each specific time period as a score, and recording the highest multiple scores and associated label names, such that each label includes the highest multiple most closely associated labels and scores.

[0008] In some embodiments, a specific time period is ten minutes. In some embodiments, a specific number of different date periods is three. In some other embodiments, the date periods include two-day periods. In some embodiments, the highest multiple scores include the top five scores, and the top five closely associated labels and scores include systems within the system. In some other embodiments, subsequent multiple labels among multiple labels equal one thousand labels.

[0009] Some embodiments include a server system comprising at least one processor configured to be coupled to an industrial process, and a non-transitory computer-readable storage medium thereon for tangibly storing program logic executable by the processor. In some embodiments, the program logic includes logic executable by the at least one processor for receiving at least one data communication from at least one industrial control system of the industrial process. Additionally, the at least one data communication includes a plurality of signals, comprising a plurality of data values ​​received from the industrial process over time and a plurality of associated tags. In some embodiments, at least one processor-executable logic for automatically associating tags defines the system within the industrial process, wherein the automatic association, at least a portion of the program logic executable by the at least one processor, operates by calculating a time-weighted average of each of the plurality of signals over a specific time period. Additionally, in some embodiments, this is achieved by selecting a specific number of different date periods sampled from the plurality of tags and the associated plurality of signals. Additionally, in some embodiments, this is achieved by performing a linear regression of the plurality of signals on each of the plurality of tags over a specific time period. Additionally, in some embodiments, this is achieved by calculating the slope and intercept of the linear regression. Additionally, in some embodiments, the residual value for each data value of multiple signals within a specific time period is calculated by subtracting the expected value calculated from linear regression from the actual value of each data value of multiple signals within a specific time period. Additionally, in some embodiments, the normalized value of each residual value is calculated by subtracting its mean from all its samples and dividing each sample by its residual standard deviation. Additionally, in some embodiments, the absolute value of the dot product between the normalized residual value and the residual values ​​of subsequent labels among multiple labels is calculated. Additionally, in some embodiments, the minimum value of the dot product calculated for each specific time period is assigned as a score. Additionally, in some embodiments, the system is defined by recording the highest multiple scores and associated label names, such that each label includes the highest multiple most closely associated labels and scores.

[0010] In some embodiments, the specific time period is between five and ten minutes. In some embodiments, the specific time period is longer than ten minutes. In some other embodiments, the specific number of different date periods is three. In some embodiments, the date periods include two-day periods. In some embodiments, the highest plurality of scores include the top five scores, and the top five closely associated labels and scores define the system. In some embodiments, the subsequent plurality of labels among the plurality of labels equals one thousand labels. In some other embodiments, the labels among the plurality of labels within the specific time period are sorted by name. In some embodiments, scores are calculated for all label pairs within the subsequent plurality of labels among the plurality of labels. In some embodiments, the highest plurality of scores and associated label names are calculated for the x-axis label and the y-axis label. Attached Figure Description

[0011] Figure 1 The illustration shows an operable historical recorder data pattern detection and communication service system according to some embodiments of the present invention.

[0012] Figure 2 The illustrations depict programming to provide according to some embodiments of the present invention. Figure 1 The system architecture of computing devices for operational historical recorder data pattern detection and communication service systems.

[0013] Figure 3 The illustrations depict the enabling or operation of some embodiments of the present invention. Figure 2 Computer systems of computer equipment.

[0014] Figure 4 The illustration shows a process flow according to some embodiments of the present invention. Detailed Implementation

[0015] Before explaining any embodiments of the invention in detail, it should be understood that the application of the invention is not limited to the construction details and arrangement of components set forth in the following description or illustrated in the accompanying drawings. The invention can have other embodiments and can be practiced or performed in various ways. Moreover, it should be understood that the wording and terminology used herein are for descriptive purposes and should not be considered limiting. The use of “comprising,” “including,” or “having,” and variations thereof herein is intended to cover the items listed thereafter and their equivalents, as well as additional items. Unless otherwise specified or limited, the terms “mounted,” “connected,” “supported,” and “coupled,” and variations thereof are used extensively and include direct and indirect mounting, connection, support, and coupling. Furthermore, “connected” and “coupled” are not limited to physical or mechanical connections or couplings.

[0016] The following discussion is provided to enable those skilled in the art to make and use embodiments of the invention. Various modifications to the illustrated embodiments will be apparent to those skilled in the art, and the general principles herein can be applied to other embodiments and applications without departing from the embodiments of the invention. Therefore, embodiments of the invention are not intended to be limited to the illustrated embodiments, but should be given the widest scope consistent with the principles and features disclosed herein. The following detailed description will be read with reference to the accompanying drawings, in which similar elements in the different drawings have similar reference numerals. The drawings are not necessarily drawn to scale, depict selected embodiments, and are not intended to limit the scope of embodiments of the invention. Those skilled in the art will recognize that the examples provided herein have many useful alternatives and fall within the scope of embodiments of the invention.

[0017] The embodiments of the invention described herein generally depict unconventional approaches to systems and methods for automated process data analysis that are not well-known and, furthermore, are not taught or suggested by any known conventional methods or systems. Moreover, specific functional features represent significant technical improvements to conventional methods and systems, including at least the operation and functionality of the computing system as a technical improvement. These technical improvements include one or more aspects of the systems and methods described herein that describe details of how the machine operates, which the Federal Circuit Court explicitly states is the substance of the statutory subject matter.

[0018] One or more of the embodiments described herein include functional constraints that work together in an orderly combination to transform the operation of the data repository in a way that improves data storage and addresses existing database update issues. In particular, some embodiments described herein include systems and methods for managing single or multiple content data items across different sources or applications, which presents problems for users of such systems and services, where maintaining reliable control over distributed information is difficult or impossible.

[0019] The description herein further describes embodiments providing novel features that improve the performance of communications and software, systems, and servers by providing automation functionality for users to manage resource and asset data effectively and more efficiently in a manner that cannot be efficiently accomplished manually. Therefore, those skilled in the art will readily recognize that these features provide the automation functionality described herein in a manner that is not previously known and is certainly not conventional. Thus, the embodiments of the invention described herein are not directed at abstract concepts but rather provide further, more readily apparent innovations. Moreover, the functionality described herein was unthinkable in prior computing systems and only became available after some embodiments of the invention addressed the previously described technical problems.

[0020] Some embodiments of the present invention include systems and methods for detecting and / or identifying and visualizing interrelated and / or associated components that can be automatically detected. In some embodiments, detecting and / or identifying and / or visualizing interrelated and / or associated components may be used to suggest “tags” for joint analysis. As used herein, tags may include a series of letters and / or numbers and may include process control tags associated with process control systems, process components and / or any process variables, time series data or other data, etc. In some embodiments, tags may include asset identifiers or data associated with assets. For example, in some embodiments, if an operator or engineer is viewing a line graph or other system layout of a given industrial component, the system may suggest adding lines or other conventional relationship markers for other coupled components. In some embodiments, industrial components that can be identified and linked in this way may include any conventional industrial component, including but not limited to tanks or reservoirs, instruments, valves, flow restrictors or diverters, heating or cooling assemblies, separators, filters or filtration systems, mixers, pumps, optical systems, electrical systems, electromagnetic systems, etc. In some embodiments, tags or tag data may include tag metadata or metadata.

[0021] In some embodiments, knowledge of one or more industrial components, including their links, couplings, and / or operational relationships with one or more industrial components, can also be used to enhance or suggest search results (e.g., if an operator is searching for one or more components, one or more systems, and / or one or more operational or functional relationships). For example, in a non-limiting embodiment, if a user has already searched for "tank," the system can include relevant inlet and outlet valves in the search results.

[0022] In some embodiments of the invention, knowledge of one or more industrial components, including their links, couplings, and / or operational relationships with one or more industrial components, can be used to provide a network graph of these relationships. In some embodiments of the invention, this knowledge of relationships can also be used to provide input to anomaly detection systems or other monitoring and control systems to monitor ongoing relationships.

[0023] Figure 1The illustration shows a non-limiting example of a history recorder system 100 for automatically selecting tags for modeling and anomaly detection. In some embodiments, the illustrated system 100 can analyze data stored in an operational history recorder and transform that data into timely reports, which are delivered to appropriate devices at the appropriate time and in the appropriate manner. In this way, aspects of the system 100 filter (e.g., organize) data to improve its visibility to users (e.g., via user devices) without overwhelming them and / or overburdening communication networks. In some embodiments, the system 100 may include an operational history recorder 102, and / or a reporting service 104, and / or a reporting database 106, and / or an organization service 108, and / or a user-specific report set 110, and / or a general report set 112, and / or an alert service 114, and / or a search service 116. In some embodiments of the invention, the system 100 may provide users with a history recorder news feed of generated reports (i.e., reports) based on data provided by the operational history recorder and / or other providers.

[0024] In some embodiments, the operable history recorder 102 may be adapted to store (e.g., “historicize”) various types of data related to an industrial process. In some embodiments, the data includes, but is not limited to, time-series data, metadata, event data, configuration data, raw time-series binary data, tag metadata, diagnostic log data, etc. In some embodiments, the operable history recorder 102 is also adapted to record trends and historical information about the industrial process for future reference. Some embodiments include the operable history recorder 102, which stores data about various aspects of an industrial process in quantities that are inexplicable or unanalyzable by humans. For example, in some embodiments, the operable history recorder may receive two million or more data values ​​per second (e.g., tags associated with process control components, process variables, etc.). In some embodiments, the history recorder 102 includes processor-executable instructions implemented on a storage memory device (e.g., as part of a server computing device) that enable the operable history recorder 102 to be provided via a software environment. In some embodiments, the operable history recorder 102 includes commercially available information from AVEVA Group plc. Historian and Online software.

[0025] In some embodiments, Figure 1The reporting service 104 shown is adapted to retrieve data from an operable history recorder 102, detect patterns in the retrieved data, generate a report including information about the detected patterns, and store the generated report in a report repository, such as a database 106. Some embodiments include the reporting service 104, which includes processor-executable instructions implemented on a storage memory device to provide the reporting service 104 via a software environment. For example, in some embodiments, the reporting service 104 may be provided as processor-executable instructions including procedures, functions, routines, methods, and / or subroutines used independently by the computing device 103 or in conjunction with additional aspects of the system 100. Further details of the reporting service 104 are provided herein.

[0026] In at least one embodiment of the invention, the reporting service 104 is adapted to retrieve data from the operational history recorder 102 by transmitting a query to the operational history recorder 102, the operational history recorder 102 receiving and using the query to select stored data that matches the query. In some embodiments, the operational history recorder 102 then transmits the selected data to the reporting service 104.

[0027] In some embodiments, the reporting service 104 may retrieve data continuously or periodically or at other intervals. Figure 2 In the illustrated embodiment, the reporting service 104 retrieves and / or receives data from additional sources, including external third-party reporting applications 206 (e.g., via the application programming interface (API) of the reporting service 104) and built-in reporting services 208 (e.g., One or more of the following: an online software built-in reporter, an application-specific reporting service 210 configured based on the client application, and a human-machine interface (HMI) 212. Other embodiments include additional reporting entities that can be used to extend the capabilities of the reporting service 104.

[0028] In some embodiments, the reporting service 104 may be adapted to analyze data using algorithms and detect certain patterns (e.g., “patterns of interest”) and / or inconsistencies in the data. Some algorithms include statistical algorithms, machine learning algorithms, rule-based algorithms, etc. In some embodiments, upon detecting certain patterns, the reporting service 104 may generate a report about these detected patterns. In some embodiments, the report may include text, graphics (e.g., charts, images, etc.), and metadata. In some embodiments, the report may include information about the detected patterns in a format conforming to the organization service 108 and / or a human-understandable format when displayed via a display device and / or human-machine interface device. In this way, the reporting service 104 transforms data from the organization service 108 and a human-incomprehensible format into a format that is both the organization service 108 and human-understandable when displayed via a device.

[0029] In some embodiments, after a report is generated, the reporting service 104 may transfer the report to the report database 106 for storage. In some embodiments, the reporting service 104 may be configured to transfer the report to the report database 106 via an HTML interface, a REST interface, an ODATA interface, and similar interfaces. In some embodiments, the system 100 includes a plurality of reporting services 104, each of which retrieves data from an operable history recorder 102, detects patterns in the data, generates a report, and stores the report in the report database 106. Some embodiments utilize multiple reporting services, and each reporting service may operate independently, or the collective operating services may operate in parallel on different parts of a larger reporting task.

[0030] In some embodiments, the report database 106 may be adapted to store reports as an organized collection of data. In some embodiments, the report database 106 may store reports in a central location for access by a wide variety of systems and devices. Additionally, in some embodiments, the organization service 108 may intelligently review reports stored in the database 106, rank and / or categorize the reviewed reports, and route (e.g., distribute) the ranked reports to collections, devices, other services, etc. In some embodiments, the organization service 108 may tailor the reports and improve their visibility to users at any desired frequency and in a manner that prevents users from being overwhelmed by data, but rather provides useful information from the reports periodically and in a way that best suits each specific user or user group.

[0031] For example, in some embodiments, for each user, the organization service 108 may determine whether a particular report should appear on the main page / homepage of that user's feed, on that user's secondary page, or simply be archived in a format searchable by that user. In some embodiments, by distributing relevant reports to certain user devices, the organization service 108 may alleviate the burden on the communication network. In some embodiments, the organization service 108 may use artificial intelligence to help determine some or all aspects of the reporting functionality, including what information might be expected, what format might be most helpful, and which pages and feeds a particular user can optimize over time.

[0032] In some embodiments, the organization service 108 may be configured to take additional actions based on the relevance of a particular report to a particular user, such as beeping or alerting the user's device 118, as further described herein. In another embodiment, the organization service 108 may be used as a filter to determine which of a plurality of reports in the report database 106 are transmitted to certain users and when those reports are transmitted.

[0033] In some embodiments, the tidying service 108 may include processor-executable instructions implemented on a storage memory device to provide the tidying service 108 via a software environment. For example, in some embodiments, the tidying service 108 may be implemented by processor-executable instructions including procedures, functions, routines, methods, and / or subroutines used independently by the computing device 103 or in conjunction with additional aspects of the system 100.

[0034] According to embodiments of this disclosure, the organization service 108 may be adapted to intelligently review reports stored in the database 106 using passive evaluation factors. When the database 106 receives a report from the reporting service 104, the organization service 108 may be adapted to assign a general score and a user-specific score to each report based on various factors. Some factors based on report content include, but are not limited to, labels on the same chart, labels on the same window, labels on the same analysis, "SmartGlance" reports, labels from the same data source, labels with similar names, labels with similar summary statistics, and related labels. Additionally, some evaluation factors based on user actions include, but are not limited to, selections on reports (e.g., clicks, taps, etc. via HMI), selection of related labels, search history, actions of similar users (e.g., operators of a specific subsystem, all operators, all administrators, etc.), and so on.

[0035] In some embodiments, user actions may be provided as feedback from user device 118 to organization service 108. In some embodiments, organization service 108 may be adapted to utilize factors based on intentional user actions, such as voting, answering polls about the report (e.g., "yes," "no problem," etc.). Furthermore, in some embodiments, organization service 108 may be adapted to utilize certain tags, process control devices, etc., to determine a specific assignment for a particular user when determining general scores and scores per user.

[0036] In some embodiments, the sorting service 108 may be adapted to rank reviewed reports for each user or user group based on report content and data about user attention patterns. In some embodiments, the sorting service 108 may rank reports based on operators of specific subsystems of an industrial process. In some embodiments, when the intelligent review of a report by the sorting service 108 reveals that the report relates to a component in an operator's subsystem, the sorting service 108 may be adapted to rank that report relative to the operator higher than reports about components in different subsystems that the operator is not responsible for. In some embodiments, the sorting service 108 may be adapted to use data about components that are regularly viewed by the operator (e.g., via user profiles), and when the intelligent review of a report by the sorting service 108 reveals that the report relates to components that the operator regularly views, the sorting service 108 may be adapted to rank that report relative to the operator higher than reports about items that the operator does not regularly view. In some embodiments, the ranking performed by the sorting service 108 is a numerical ranking or score. However, some embodiments include any ranking or scoring mechanism that may be used to indicate the higher relevance or importance of a report relative to different reports. In one embodiment, report ranking is made available to reporting service 104, which uses this ranking to customize report generation to produce a higher-ranked report. In some embodiments, organization service 108 directs reports to user device 118 based on context, including but not limited to areas(s) of interest, the user's own events, and events of other operators in the team.

[0037] In some embodiments, the organization service 108 may be adapted to categorize reports based on their ranking and determine which actions to take relative to a particular report. For example, in some embodiments, the organization service 108 may categorize and route reports based on general interest levels (e.g., scores), user-specific interest levels (e.g., scores), and / or urgency. In some embodiments, the organization service 108 may determine, based on a report's ranking, not to forward the report to any device or user, but instead to continue storing the report in database 106, where the report is available for access via search service 116.

[0038] In some embodiments, the organization service 108 may determine whether to transmit a report to a user-specific report set 110 based on the report's ranking. In another embodiment, the organization service 108 may determine to transmit a report to a general report set 112 based on the report's ranking. In yet another embodiment, the organization service 108 may determine to transmit a report in real-time to one or more user devices 118 as an alert via the alert service 114 based on the report's ranking. In some embodiments, additional actions of the organization service 108 may occur based on the report's classification, including displaying the report as a news report in a news feed, displaying the report as activity in a related trend, displaying the report only when searched via the search service 116, and displaying the report on a related process graph (e.g., displaying a line graph of a specific attribute of an industrial process, where anomalies are highlighted).

[0039] As described above, according to embodiments of the present invention, the sorting service 108 categorizes and routes reports based on urgency and / or other time-based factors. For example, in some embodiments, the sorting service 108 may determine that a report includes time-sensitive and / or highly important content to an industrial process, and transmit the report to the user device 118 via the reminder service 114, except for and / or without a general report set 112. In some embodiments, the sorting service 108 may analyze the volume of reports generated by the reporting service 104 within a given time period (e.g., work shift, day, etc.) and distribute the reports accordingly. For example, in some embodiments, when the volume of reports generated by the reporting service 104 is within a specific day (e.g., ...), the sorting service 108 may distribute the reports accordingly.

[0040] When the number of "slow" news days is low, the organization service 108 distributes fewer reports with lower rankings. In the contrasting example, when the number of reports generated by the reporting service 104 is high on a particular day (e.g., a "fast" news day), the organization service 108 distributes more and higher-ranked reports. This urgency-based operation of the organization service 108 can also be used to distribute a consistent number of reports over a given period (e.g., 100 reports per day, etc.), causing the organization service 108 to adjust the ranking threshold to reach the required number of reports. The urgency-based operation of the organization service 108 can also be used to adjust the ranking threshold so that only high-ranking reports (e.g., 95 out of 100, etc.) are published during a certain period (e.g., dates when administrators plan to take vacation, etc.).

[0041] Still referencing Figure 1In some embodiments, the user-specific report set 110 may be adapted to receive reports from the organization service 108 and organize the reports into lists (e.g., feeds) that are kept up-to-date and made available to users and / or user groups via user device 118. For example, according to aspects of this disclosure, the user-specific report set 110 may be a database. In some embodiments, the user-specific report set 110 provides feeds indicating new reports that user device 118 has not yet accessed and / or reports that user device 118 has not yet displayed. In some embodiments, the general report set 112 may be adapted to receive reports from the organization service 108 and present them in a manner that allows them to be browsed via user device 118.

[0042] For example, according to aspects of this disclosure, in some embodiments, the general report set 112 may be a database. In some embodiments, the general report set 112 organizes reports in a manner that supports navigation of reports via user equipment 118. In some embodiments, the general report set 112 organizes reports such that reports with higher general relevance to the industrial process compared to other reports are stored in such a way that those reports are displayed in a more prominent position when accessed and displayed via user equipment 118.

[0043] Reference again Figure 1 In some embodiments, the reminder service 114 may be adapted to receive reports from the organization service 108 and transmit the received reports to the user device 118 in real time. For example, in some embodiments, the reminder service 114 may transmit reports to the user device 118 in the form of email, text messages, mobile device notifications (e.g., user interface notifications), pager notifications, etc. In some embodiments, the reminder service 114 includes processor-executable instructions implemented on a storage memory device to provide the reminder service 114 via a software environment. For example, in some embodiments, the reminder service 114 may be provided as processor-executable instructions that include procedures, functions, routines, methods, and / or subroutines used independently by the computing device 103 or in conjunction with additional aspects of the system 100 according to another embodiment. Further details of the reminder service 114 are provided herein. In embodiments, reminders from the reminder service 114 are more important than reports.

[0044] In some embodiments, Figure 1The search service 116 may be adapted to allow searching of reports stored in database 106 via user device 118. In some embodiments, the search service 116 may be adapted to search for reports containing specific content in database 106. In another embodiment, the search service 116 may be adapted to search for reports in database 106 by relation to a history recorder entity involved in the report. In some embodiments, the search service 116 may include processor-executable instructions implemented on a storage memory device to provide the search service 116 via a software environment. For example, in some embodiments, the search service 116 may be provided as processor-executable instructions including procedures, functions, routines, methods, and / or subroutines used independently by computing device 103 or in conjunction with additional aspects of system 100 according to another embodiment. Further details of the search service 116 are provided herein.

[0045] In some embodiments, Figure 1 User equipment 118 may be adapted to receive data from user-specific report set 110, general report set 112, alert service 114 and / or search service 116 and transfer data to user-specific report set 110. In some embodiments, user equipment 118 may be adapted to provide feedback to organization service 108 regarding the usage characteristics of user equipment 118. In some embodiments, user equipment 118 includes, but is not limited to, personal computers, laptops, tablet computers, mobile communication devices, smartphones, etc.

[0046] Figure 2 The diagram illustrates the architecture of a computing device 103 programmed to provide various aspects of an operational history recorder data pattern detection and communication service system 100 via a software environment. In this embodiment, the computing device 103 includes a processor 702, a memory 703, a memory 704, and an input / output (I / O) interface 706 that interfaces with an I / O component 708. In some embodiments, the memory 704 includes an operational history recorder interface 102', a reporting service 104, a report database interface 106', a sorting service 108, a user-specific report set 110, a general report set 112, an alert service 114, and a search service 116, each implemented in processor-executable instructions for execution by the processor 702.

[0047] In some embodiments, the processor 702, memories 703, 704, and I / O interface 706 are communicatively connected and / or electrically coupled to each other. In some embodiments, the I / O interface 706 may be communicatively and / or electrically connected to I / O component 708. In some embodiments, the processor 702 may be adapted to execute processor-executable instructions stored in memory 704 for implementing an operable history recorder interface 102', a report service 104, a report database interface 106', an organization service 108, a user-specific report set 110, a general report set 112, an alert service 114, and / or a search service 116. Figure 2 The I / O interface 706 provides a physical data connection between the computing device 103 and the I / O component 708. In some embodiments, the I / O interface 706 is a network interface card (NIC) or a modem, and the I / O component 708 is a telecommunications network.

[0048] In some embodiments, Figure 2 The operable history recorder interface 102' may be adapted to provide a connection between the computing device 103 and the operable history recorder 102. In some embodiments, the operable history recorder interface 102' retrieves and / or receives data from the operable history recorder 102 via I / O interface 706, as further described herein. Figure 2 The report database interface 106' may be adapted to provide connectivity between the computing device 103 and a computer-readable storage medium for storing the report database 106. In some embodiments, the report database interface 106' may facilitate the publication of reports from the report service 104 to the report database 106 via the I / O interface 706, as further described herein. In another embodiment, the report database interface 106' may facilitate access to the report database 106 via the I / O interface 706 through the organization service 108 and the search service 116, as further described herein.

[0049] Figure 3 The illustration shows the activation according to some embodiments of the present invention. Figure 2The computer system 210 of the computer device 103. For example, in some embodiments, the computer system 210 may operate and / or process computer-executable code of one or more software modules of the system described above. Additionally, in some embodiments, the computer system 210 may operate and / or display information within one or more graphical user interfaces. In some embodiments, the system 210 may include at least one computing device 230, which includes at least one processor 232. In some embodiments, the at least one processor 232 may include a processor residing in or coupled to one or more server platforms. In some embodiments, the system 210 may include a network interface 235a and an application interface 235b coupled to at least one processor 232 capable of processing at least one operating system 234. Additionally, in some embodiments, the interfaces 235a, 235b coupled to at least one processor 232 may be configured to process one or more software modules 238 (e.g., enterprise applications). In some embodiments, the software module 238 may include server-based software and may operate to host at least one user account and / or at least one client account, and operate using at least one processor 232 to transfer data between one or more of these accounts.

[0050] Considering the above embodiments, it should be understood that the present invention can employ various computer-implemented operations involving data stored in a computer system. Furthermore, the databases and models described throughout can store analytical models and other data on computer-readable storage media within system 210 and on computer-readable storage media coupled to system 210. Additionally, the above-described applications of the system can be stored on computer-readable storage media within system 210 and on computer-readable storage media coupled to system 210. These operations require physical manipulation of physical quantities. Typically, although not required, these quantities take the form of electrical, electromagnetic, or magnetic signals, or optical or magneto-optical forms that can be stored, transmitted, combined, compared, and otherwise manipulated. In some embodiments of the invention, system 210 may include at least one computer-readable medium 236 coupled to at least one data source 237a and / or at least one data storage device 237b and / or at least one input / output device 237c. In some embodiments, the invention can be implemented as computer-readable code on computer-readable medium 236. In some embodiments, computer-readable medium 236 can be any data storage device capable of storing data that can subsequently be read by a computer system (such as system 210). In some embodiments, the computer-readable medium 236 may be any physical or material medium that can be used to tangibly store desired information or data or instructions and that can be accessed by a computer or processor 232. In some embodiments, the computer-readable medium 236 may include a hard disk drive, a network-attached storage device (NAS), a read-only memory, a random access memory, a FLASH-based memory, a CD-ROM, a CD-R, a CD-RW, a DVD, magnetic tape, or other optical and non-optical data storage devices. In some embodiments, various other forms of computer-readable medium 236 may transmit or carry instructions to at least one computer 240 and / or at least one user 231, including routers, private or public networks, or other wired and wireless transmission devices or channels. In some embodiments, software module 238 may be configured to send and receive data from a database (e.g., from the computer-readable medium 236 including a data source 237a and a data storage device 237b that may include the database), and the data may be received by software module 238 from at least one other source. In some embodiments, at least one of the software modules 238 may be configured within the system to output data to at least one user 231 via at least one graphical user interface rendered on at least one digital display.

[0051] In some embodiments of the invention, the computer-readable medium 236 may be distributed over a conventional computer network via a network interface 235a, wherein a system implemented by computer-readable code may be stored and executed in a distributed manner. For example, in some embodiments, one or more components of system 210 may be coupled to send and / or receive data via a local area network (“LAN”) 239a and / or an internet-coupled network 239b (e.g., such as a wireless internet). In some other embodiments, networks 239a, 239b may include a wide area network (“WAN”), a direct connection (e.g., via a universal serial bus port) or other forms of computer-readable medium 236, or any combination thereof.

[0052] In some embodiments, components of networks 239a, 239b may include any number of user devices, such as personal computers, including, for example, desktop and / or laptop computers, or any stationary, non-mobile internet device generally coupled via LAN 239a. For example, some embodiments include one or more computers 240 coupled via LAN 239a, which may be configured for any type of user, including administrators. Other embodiments may include personal computers coupled via network 239b. In some additional embodiments, one or more components of system 210 may be coupled to send or receive data over an internet network (e.g., such as network 239b). For example, some embodiments include at least one user 231 who is wirelessly coupled and accesses one or more software modules including at least one application 238 via input and output (“I / O”) device 237c. In some other embodiments, system 210 may enable at least one user 231 to be coupled via LAN 239a via I / O device 237c to access application 238. In some embodiments, user 231 may include user 231a coupled to system 210 using a desktop computer and / or laptop computer or any fixed, generally non-mobile internet device coupled via internet 239b. In some other embodiments, user 231 may include mobile user 231b coupled to system 210. In some embodiments, user 231b may use any mobile computing device 231c to wirelessly couple to system 210, including but not limited to personal digital assistants and / or cellular phones, mobile phones or smartphones and / or pagers, and / or digital tablets and / or fixed or mobile internet devices.

[0053] In some embodiments, the system 100 described above can analyze data stored in an operational history recorder to facilitate the automatic selection of labels for modeling and anomaly detection. For example, Figure 4The illustration depicts a process flow 400 according to some embodiments of the present invention, which may include a method for automatically identifying physical system relationships using raw time-series data and tag metadata stored in an operational history recorder (e.g., such as the operational history recorder described above). In some embodiments, the system and method may be used to automatically locate systems in the operational history recorder. In other embodiments, the system and method may be used to compare one or more pairs of tags. In some embodiments of the invention, the method may use a “sliding window” to reduce the analysis time to O(n) instead of O(n^2). In some further embodiments, the system may be used to prepare a network graph for system relationships instead of finding clusters. In some embodiments, tags may be provided to the user as systems rather than individually, through a fast algorithm for identifying systems.

[0054] In a non-limiting embodiment, assuming a large system has 100,000 or more label names and associated signals, process 400 may include sorting the signals by name. Signals that are close together in the system tend to be close together when sorted by name. This is especially true when names use hierarchical encoding, such as the label name "area1.line1.tank1.inlet". In the given example, the label names "area1.line1.tank1.outlet" and "area1.line1.tank1.level" will be relatively close in the sorting list, while "area17.lin2.tank3.level" will be loosely associated and tend to be farther apart in the sorting list.

[0055] Some embodiments include calculating a ten-minute time-weighted average for the signal within the data range (410). In some embodiments, each signal may be selected from three different two-day time periods sampled from the training set (420). Some embodiments include a ten-minute averaging interval. In some embodiments, the number of time periods and the duration of the time periods may be modified according to different data requirements. In some embodiments, each label may perform a linear regression on three different sampling time periods to find the slope and intercept for each time period (430). In some embodiments, each time period may calculate an expected value for each point based on linear regression. In some embodiments, each time period may calculate a residual value by subtracting this expected value from the actual value for each point. In some embodiments, each time period may provide the residual for each sampling time period. In some embodiments, each time period may normalize each residual signal by subtracting its mean from all samples and dividing each sample by its residual standard deviation (440).

[0056] Referring to process 450, some embodiments include calculating scores, calculating dot products, calculating absolute values, and finding the lowest value among three samples. For example, some embodiments include three sampling periods. In some embodiments, each period may calculate scores for all label pairs within 1000 entries in a sorted list. In some embodiments, each period may maintain the highest score for each label. In some embodiments, each label may be equal to (x). In some embodiments, each of the three periods may be calculated. In some embodiments, each of the 1000 labels may be sorted by name (y). Some embodiments include calculating the absolute value (450) of the dot product of the normalized residual of the label and the residual of each of the next 1000 labels (sorted by name). In some embodiments, the lowest dot product among the three dot products may have scores for both x and y.

[0057] In some embodiments, for each label y, the system can view all labels x. In some embodiments, the system can select the five best scores at or above the 90th percentile (which can be varied). For example, some embodiments include a record of the top five scores and associated label names, which can be done for both x and y labels (460). In some embodiments, each label can have five closely related labels and score values. In some embodiments, labels with higher scores can have a closer relationship.

[0058] Some embodiments include simple correlation. In some embodiments, when simple correlation is performed, one or more labels with a consistent slope may show perfect correlation. In some embodiments, the actual slope of the label is irrelevant; the waviness of the label is important. In some embodiments, matches are more likely to have a close systematic relationship.

[0059] For the purposes of this disclosure, the term "server" should be understood as a point of service that provides processing, database, and communication facilities. A computing device may be capable of transmitting or receiving signals, such as via wired or wireless networks, or of processing or storing signals (such as as a physical memory state in memory), and therefore can operate as a server. Thus, a device capable of operating as a server may include, for example, a dedicated rack server, a desktop computer, a laptop computer, a set-top box, an integrated device combining various features (such as two or more features of the aforementioned devices), etc. By way of example and not limitation, the term "server" may refer to a single physical processor having associated communication and data storage and database facilities, or may refer to a network or cluster of processors and their associated network and storage devices, as well as operating software supporting the services provided by the server and one or more database systems and application software. The configuration or capabilities of servers can vary considerably, but generally a server may include one or more central processing units and memory. A server may also include one or more mass storage devices, one or more power supplies, one or more wired or wireless network interfaces, one or more input / output interfaces, or one or more operating systems (such as...). Server, Mac OS X, Unix, Linux and / or any other conventional operating system). and It is a registered trademark of Microsoft Corporation, located in Redmond, Washington.

[0060] For the purposes of this disclosure, "network" should be understood as a network that can couple devices to enable the exchange of communications, such as between server and client devices, peer-to-peer communication, or other types of devices, including wireless devices coupled via a wireless network. For example, a network can also include mass storage, such as network-attached storage (NAS), storage area network (SAN), or other forms of computer or machine-readable media. A network can include the Internet, one or more local area networks (LANs), one or more wide area networks (WANs), wired connections, wireless connections, cellular connections, or any combination thereof. Similarly, subnets with different architectures or that conform to or are compatible with different protocols can interoperate within a larger network. For example, various types of devices can be used to provide interoperability for different architectures or protocols. As an illustrative example, a router can provide a link between otherwise separate and independent LANs. Communication links or channels may include, for example, analog telephone lines, such as twisted-pair cables, coaxial cables, full or partial digital lines including T1, T2, T3, or T4 type lines, Integrated Services Digital Network (ISDN), Digital Subscriber Line (DSL), wireless links including satellite links, or other communication links or channels, as known to those skilled in the art. Furthermore, for example, computing devices or other related electronic equipment may be remotely coupled to the network, such as via telephone lines or links.

[0061] For the purposes of this disclosure, "wireless network" should be understood as coupling user or client devices to a network. Wireless networks can employ standalone self-organizing networks, mesh networks, wireless LAN (WLAN) networks, cellular networks, etc. Wireless networks can also include systems of terminals, gateways, routers, etc., coupled via wireless radio links, which can move freely, randomly, or arbitrarily organize themselves, allowing the network topology to change, sometimes even rapidly. Wireless networks can also employ various network access technologies, including Long Term Evolution (LTE), WLAN, Wireless Router (WR) mesh networks, or second-, third-, fourth-, or fifth-generation (2G, 3G, 4G, or 5G) cellular technologies. Network access technologies can enable wide-area coverage for devices, such as client devices with varying degrees of mobility. For example, the network can be connected via one or more network access technologies (such as Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), General Packet Radio Service (GPRS), Enhanced Data GSM Environment (EDGE), 3GPP LTE, LTE Advanced, and Wideband Code Division Multiple Access (WCDMA)). 802.11b / g / n, etc., are used to enable RF or wireless communication. Wireless networks can actually include any type of wireless communication mechanism that allows signals to be transmitted between or within a network between devices such as client devices or computing devices.

[0062] For the purposes of this disclosure, client (or consumer or user) devices may include computing devices capable of transmitting or receiving signals, such as via wired or wireless networks. Client devices may include, for example, desktop computers or portable devices such as cellular phones, smartphones, display pagers, radio frequency (RF) devices, infrared (IR) devices, near field communication (NFC) devices, personal digital assistants (PDAs), handheld computers, tablet computers, tablet phones, laptop computers, set-top boxes, wearable computers, integrated devices combining various features (such as those of the devices described above), etc.

[0063] Client devices can vary in capabilities or characteristics, and the subject matter claimed is intended to cover a wide range of potential variations. Web-enabled fixed or mobile devices can include browser applications configured to receive and send web pages, web-based messaging, etc. Browser applications can be configured to receive and display graphics, text, multimedia, etc., using virtually any conventional web-based language.

[0064] Any operations described herein that form part of this invention are useful machine operations. The invention also relates to devices or apparatuses for performing these operations. Apparatus can be specially configured for a desired purpose, such as a dedicated computer. When defined as a dedicated computer, the computer can also perform other processing, program execution, or routines that are not part of the dedicated purpose, while still being able to operate for that dedicated purpose. Alternatively, operations can be processed by a general-purpose computer selectively activated or configured by one or more computer programs stored in computer memory, cache, or obtained via a network. When data is obtained via a network, the data can be processed by other computers on the network (e.g., a cloud of computing resources).

[0065] Embodiments of the present invention can also be defined as a machine that transforms data from one state to another. The data can represent an item, which can be represented as an electronic signal and the data processed electronically. In some cases, the transformed data can be visually depicted on a display, thereby representing a physical object resulting from the transformation of the data. The transformed data can be stored in a storage device, either generally or in a specific format that enables the construction or depiction of physical and tangible objects. In some embodiments, this manipulation can be performed by a processor. In such examples, the processor thus transforms the data from one thing to another. Furthermore, some embodiments include methods that can be processed by one or more machines or processors that can be connected via a network. Each machine can transform data from one state or thing to another, and can also process the data, store the data in a storage device, transmit the data over a network, display the results, or transmit the results to another machine. As used herein, computer-readable storage medium refers to a physical or tangible storage device (as opposed to a signal), and includes, but is not limited to, volatile and non-volatile, removable and non-removable storage media implemented in any method or technology for the tangible storage of information such as computer-readable instructions, data structures, program modules, or other data.

[0066] While the method of operation can be described in a specific order, it should be understood that other internal management operations can be performed between operations, or operations can be adjusted so that they occur at slightly different times, or they can be distributed throughout the system that allows processing operations to occur at various intervals associated with processing, as long as the processing of the overriding operation is performed in the desired manner.

[0067] Those skilled in the art will recognize that while the invention has been described above with reference to specific embodiments and examples, the invention is not necessarily limited thereto, and many other embodiments, examples, uses, modifications, and deviations from the embodiments are intended to be covered by the claims appended herein. The full disclosure of each patent and publication cited herein is incorporated by reference as if each such patent or publication were individually incorporated herein by reference. Various features and advantages of the invention are set forth in the following claims.

Claims

1. A computer-implemented method for automatically selecting labels for modeling and anomaly detection, comprising: Provide a server system that includes at least one processor; At least one non-transitory computer-readable storage medium is provided for data communication with the at least one processor. The at least one non-transitory computer-readable storage medium includes program logic that, when executed by the at least one processor, causes the server system to operate to automatically associate system tags within a definition process in such a way as follows: Access multiple tags and associated signals, including multiple data values ​​over time, which indicate the physical properties, behavior, or measurement of components in the process; as well as For each of the multiple signals, calculate the time-weighted average value over a specific time period; For each signal, a specific number of different date periods are selected to sample the multiple tags and the associated multiple signals; For each of the plurality of labels, the slope and intercept are calculated by performing a linear regression of the plurality of signals within each of the specific number of different date periods; The residual value of each data value of the plurality of signals in each of the plurality of signals in each of the plurality of signals in the particular number of different date periods is calculated by subtracting the expected value calculated from the linear regression from the actual value of each data value of the plurality of signals in each of the period in the particular number of different date periods; The normalized value of the residual value of each data value of the plurality of signals in each time period of the specific number of different date periods is calculated by subtracting the mean of the residual values ​​in each time period of the specific number of different date periods from the residual value of each data value of the plurality of signals in each time period of the specific number of different date periods, and dividing the residual value of each data value of the plurality of signals in each time period of the specific number of different date periods by its residual standard deviation. Calculate the absolute value of the dot product between the normalized residual value and the residual values ​​of the subsequent labels among the plurality of labels; Assign the minimum dot product of the dot products calculated for each of the specified number of different date periods as a fraction; as well as Record the highest multiple scores and associated tag names, so that each tag includes the highest multiple most closely associated tags and scores.

2. The method of claim 1, wherein the specific time period is ten minutes.

3. The method of claim 1, wherein the specific number of different date periods is three.

4. The method of claim 1, wherein each of the particular number of different date periods comprises a two-day period.

5. The method of claim 1, wherein the highest plurality of scores include the top five scores, and the top five closely associated labels and scores include systems within the system.

6. The method of claim 1, wherein the subsequent plurality of tags in the plurality of tags equals one thousand tags.

7. A server system for automatically selecting labels for modeling and anomaly detection, comprising: At least one processor is configured to be coupled to an industrial process; A non-transitory computer-readable storage medium for tangibly storing program logic thereon for execution by the processor, the program logic comprising: The at least one processor may execute logic for receiving at least one data communication from at least one industrial control system of an industrial process, the at least one data communication comprising a plurality of signals, the plurality of signals comprising a plurality of data values ​​received from the industrial process over time and a plurality of associated tags; The automatic association logic, executable by the at least one processor, defines the labels of systems within an industrial process, wherein at least a portion of the program logic executable by the at least one processor operates in the following manner: For each of the multiple signals, calculate the time-weighted average value over a specific time period; Select a specific number of different date periods to sample the multiple tags and associated multiple signals; For each of the plurality of labels, perform linear regression of the plurality of signals within each of the specific number of different date periods; Calculate the slope and intercept of the linear regression; The residual value of each data value of the plurality of signals in each of the plurality of signals in each of the plurality of signals in the particular number of different date periods is calculated by subtracting the expected value calculated from the linear regression from the actual value of each data value of the plurality of signals in each of the period in the particular number of different date periods; The normalized value of the residual value of each data value of the plurality of signals in each time period of the specific number of different date periods is calculated by subtracting the mean of the residual values ​​in each time period of the specific number of different date periods from the residual value of each data value of the plurality of signals in each time period of the specific number of different date periods, and dividing the residual value of each data value of the plurality of signals in each time period of the specific number of different date periods by its residual standard deviation. Calculate the absolute value of the dot product between the normalized residual value and the residual values ​​of the subsequent labels among the plurality of labels; Assign the minimum dot product of the dot products calculated for each of the specified number of different date periods as a fraction; and The system is defined by recording the highest multiple scores and associated label names, such that each label includes the highest multiple most closely associated labels and scores.

8. The server system of claim 7, wherein the specific time period is between five and ten minutes.

9. The server system of claim 7, wherein the specific time period is greater than ten minutes.

10. The server system of claim 7, wherein the specific number of different date periods is three.

11. The server system of claim 7, wherein each of the particular number of different date periods comprises a two-day period.

12. The server system of claim 7, wherein the highest plurality of scores comprises the top five scores, and the top five closely associated labels and scores define the system.

13. The server system of claim 7, wherein the subsequent plurality of tags in the plurality of tags equals one thousand tags.

14. The server system of claim 7, wherein the tags among the plurality of tags within the specified number of different date periods are ordered by name.

15. The server system of claim 7, wherein a score is calculated for all tag pairs within the subsequent plurality of tags of the plurality of tags.

16. The server system of claim 7, wherein the highest multiple scores and associated label names are calculated for the x-axis labels and y-axis labels.

Images