Monitoring device and method for anomaly detection

Abstract

Monitoring device for anomaly detection from sensor data (102, z) determined in time succession of a technical system (100), comprising: an input interface (201) configured to receive a new sensor data point (102, z) of the technical system (100); an analysis unit (202) configured to determine, for the new sensor data point (102, z), a minimum reachable distance (minRD) with respect to a selection of neighboring training data points (x1, x2, x3) and to determine, for the new sensor data point (102, z), a minimum position (xi) in a sequence of training data points in a reachable graph (312) created by means of a density-based clustering function using predetermined training data points as input values, to insert the new sensor data point (102, z) in the reachable graph after the minimum position (xi) and before a training data point having a greater reachable distance than the determined minimum reachable distance (minRD), to assign the new sensor data point (102, z) to a determined cluster according to its position in the supplemented reachable graph and as a normal or abnormal condition according to the minimum reachable distance (minRD); and an output interface (203) configured to output the determined assignment for the new sensor data point (102, z) as a result of anomaly detection.

Description

TECHNICAL FIELD

[0001] The present invention relates to a monitoring device and a method for anomaly detection by means of a density-based clustering function on the basis of sensor data of a technical system which are determined continuously in time. BACKGROUND

[0002] For monitoring a technical system, parameters which are relevant for the state of the system are usually measured continuously in time by means of sensors. For example, in the case of a pump, measurements of the motor current, the motor temperature, the ground pressure and the head pressure are carried out. Other technical systems can be machines, such as turbomachines, electric machines of any kind, but also devices in an industrial plant, such as field devices, etc. On the basis of such sensor data, it is possible to identify anomalies of the technical system at an early stage and thereby achieve great cost savings. By means of continuous anomaly detection, a malfunction of the system can be identified at an early stage and repaired in time, so that a complete failure can be avoided.

[0003] Characteristic for such a monitoring scenario is that the recorded data is time-dependent and is measured and analyzed dynamically, i.e. at regular or irregular time intervals. The classification of such data points as normal or abnormal, i.e. the data point corresponds to a system in a normal state or the value of the data point indicates an abnormal state, in particular an error state, of the system, should be determined quickly, as far as possible even in real time, in the monitoring system.

[0004] Often, more than one parameter is monitored simultaneously, so that a sensor data point comprises a plurality of individual values for different measured parameters of the system. On the basis of artificial intelligence methods (AI), such time series of sensor data, for example also measured on different components of the system at a given time in advance, can be analyzed and measures to find the cause of the abnormal behavior can be introduced.

[0005] It is known to use artificial intelligence methods, such as classification or clustering methods, for anomaly detection.

[0006] Different methods for AI-based anomaly detection are known. Here, in particular, a distinction is made between methods which take into account the time dependency in the data and such methods which do not. An example of a method which takes into account the time dependency in the data is a prediction model which is trained from past data and on the basis of which the next value is predicted. If this prediction deviates greatly from the observed value, it can be assumed that there is an anomaly.

[0007] The clustering method OPTICS, German for "Order Points To Identify the Clustering Structure", is used to identify damages in rolling bearings and in energy facilities in real time or for predictive process monitoring as described in the publications of H. HOTAIT et al.: "Monitoring of Ball Bearing Based on Improved Real-Time OPTICS Clustering" (JOURNAL OF SIGNAL PROCESSING SYSTEMS, July 30, 2020), BENMAHDI D et al.: "RT-OPTICS: real-time classification based on OPTICS method to monitor bearings faults" (JOURNAL OF INTELLIGENT MANUFACTURING, Vol. 30, No. 5, November 27, 2017), ZHANG QIANG et al.: "An OPTICS Clustering-Based Anomalous Data Filtering Algorithm for Condition Monitoring of Power Equipment" (December 15, 2015) and FRANCESCOMARINO CHIARA 01 et al.: "Clustering-Based Predictive Process Monitoring" (IEEE TRANSACTIONS ON SERVICES COMPUTING, Vol. 12, No. 6, November 1, 2019).

[0008] For example, clustering methods belong to methods that do not take into account a time reference, which are able to identify outliers (also called outliers) themselves and to label such outliers. The advantage of these clustering methods is that different types of normal states in the data can be adjusted. These normal states are then represented as different clusters. Only when it is known beforehand which types of normal states exist, can a prediction model model the different types of normal states. Then, for example, a model of its own has to be trained for each normal state.

[0009] Thus, clustering methods can advantageously be used for the monitoring of technical systems for which multiple normal states can exist. However, this has the disadvantage that these methods do not take into account temporal correlations. For each newly added data point, the entire model with all data points including the new data point has to be calculated and it has to be checked whether the new data point is identified as an outlier. The classification of one or more data points as normal or abnormal is referred to hereinafter as anomaly detection. SUMMARY

[0010] It is therefore the task of the present application to provide an AI-based anomaly detection method which can model multiple normal states and is able to quickly classify newly added sensor data points at time intervals as belonging to a normal state or as just indicating an abnormal state.

[0011] This task is solved by the measures described in the independent claims. Advantageous refinements of the application are presented in the dependent claims.

[0012] A first aspect of the application relates to a monitoring device for anomaly detection in a technical system (100) in which parameters relevant for the state of the system are measured continuously over time by means of sensors, comprising:

[0013] an input interface configured to receive a new sensor data point of the technical system,

[0014] an analysis unit configured to

[0015] determine a minimum reachable distance of the new sensor data point with respect to a selection of neighboring training data points, and

[0016] determine a minimum position of the new sensor data point in a sequence of training data points in a reachable graph, the reachable graph being created by means of a density-based clustering function which uses predetermined training data points as input values, and in which the sequence of training data points is sorted in ascending order according to the processing order of the training data points and in which for each training data point a reachable distance is specified,

[0017] insert the new sensor data point in the reachable graph after the training data point with the minimum position and before the training data point with a greater reachable distance than the determined minimum reachable distance,

[0018] assign the new sensor data point to a determined cluster according to its position in the supplemented reachable graph and to a condition as normal or abnormal according to the minimum reachable distance, wherein each cluster is assigned to a different operating state of the technical system 100; and

[0019] An output interface is configured to output, as a result of the anomaly detection, the assigned condition and / or the assigned cluster with respect to the operating mode and an explanation of the condition as normal or abnormal, and to trigger an alarm function based on the result of the anomaly recognition.

[0020] The density-based clustering function of the analysis unit has the advantage that it works with dynamic sensor data points which are not available from the outset for evaluation by the density-based clustering function, but further sensor data points are added gradually. Thus, the analysis of whether a new sensor data point is an outlier and thus indicates an abnormal state of the technical system being monitored can be determined with less computing effort and thus also more quickly. In particular, the assignment of the condition and the cluster of the new sensor data point depending on the position of the new sensor data point in the event graph being supplemented allows a very quick first estimate and anomaly detection. The training data points are sensor data points which characterize a normal state of the technical system. The training data can be measured at the technical system to be monitored or at a similar technical system. However, the training data can also be artificially generated.

[0021] In an advantageous embodiment, the density-based clustering function is the "Ordering Points To Identify the Clustering Structure" method, abbreviated as OPTICS method. Thus, a clustering method which is already known can be used as a basis and only an adaptation of the OPTICS method is required.

[0022] In an advantageous embodiment, the monitoring device is configured to apply the density-based clustering function to the reachability graph being supplemented with the new sensor data point and to assign the new sensor data point to the cluster determined therefor.

[0023] By the reachability graph being supplemented, the density-based clustering function is already given a starting order for processing the training data points and the new sensor data point. The number of processing steps to be performed is thereby reduced and thus also the processing duration by the density-based clustering function. By applying the density-based clustering function, the probability of a correct assignment to a cluster becomes greater and thus more reliable.

[0024] In an advantageous embodiment, the selection of neighboring training data points contains all training data points having a predefined interval, for example the value ε_max, from the new sensor data point. The number of neighboring training data points to be considered is determined by the predefined interval ε_max and thus can be limited to a small number of training data points with a small ε_max value or set to a larger number of neighboring training data points with a large predefined interval ε_max. Thus, the analysis can be flexibly adjusted depending on the density of the data points. The processing time or duration of the analysis is thereby determined and thus can be flexibly adjusted.

[0025] In an advantageous embodiment, the monitoring device is configured to assign the core distance with the value infinity to the new sensor data point if the number of neighboring training data points is less than a predefined number.

[0026] It can thereby be ensured that new sensor data points that are far away from other training data points are also taken into account. As for the first data point in the actual traversal of the density-based clustering method, a core distance is then assumed for this point. The reach distance can thereby be determined again.

[0027] In an advantageous embodiment, the monitoring device is configured to determine the reach distance to the new sensor data point for each training data point of the selection of training data points and to assign the shortest reach distance of the determined reach distances to the new sensor data point as the minimum reach distance. Thus, the assignment of the new sensor data point as an outlier and thus as abnormal, or as a normal condition, can be estimated with little computational effort.

[0028] In an advantageous embodiment, the monitoring device is configured to determine the position of the training data point with the determined shortest reach distance in the selection of training data points as the predecessor position in the reach graph and to determine the next position as the minimum position of the new sensor data point. Thus, the position of the new sensor data point can be determined in the reach graph and the new sensor data point can be assigned to a cluster.

[0029] In an advantageous embodiment, the monitoring device is configured to insert the new sensor data point at the end of the reach graph if the reach distance of any training point arranged after the predecessor position in the sequence is less than the minimum reach distance of the new sensor data point.

[0030] In an advantageous embodiment, the monitoring device is configured to perform the steps performed in the analysis unit for all new sensor data points received in a time window with a predefined duration, or for a predefined minimum number of new sensor data points successive in time, and to output as an anomaly only when the determined assignment complies with a predefined rule.

[0031] This enables the inclusion of a temporal change process when evaluating anomalies and thus the identification of individual outliers in the case of otherwise other sensor data points classified as normal.

[0032] In an advantageous embodiment, the rule is a minimum number of new sensor data points detected as normal.

[0033] In an advantageous embodiment, the rule is an increasing number of new sensor data points detected as abnormal in successive time windows.

[0034] In an advantageous embodiment, the monitoring device has a user interface which is configured to receive a duration of the time window, a minimum number of new sensor data points or a type of the rule. This enables a flexible adaptation of the analysis unit for the evaluation of the new sensor data points and the anomaly detection. Further parameters of the clustering function can also be input by an expert via the user interface.

[0035] In an advantageous embodiment, the technical system is one or more machines of an energy distribution, energy generation or energy transport facility or one or more devices of an automation facility.

[0036] A second aspect of the present application relates to a method for anomaly detection by a monitoring device for a technical system (100) in which parameters relevant for a state of the system are measured continuously in time by means of sensors, the method comprising the following steps:

[0037] - receiving a new sensor data point of the technical system,

[0038] - determining, for the new sensor data point, a minimum reachable distance with respect to a selection of adjacent training data points, and

[0039] - determining, for the new sensor data point, a minimum position in a sequence of training data points in a reachable graph, the reachable graph being created by means of a density-based clustering function, the clustering function using predetermined training data points as input values, and the sequence of training data points being sorted in ascending order according to a processing order of the training data points, and the reachable distances being stated for each training data point in the reachable graph,

[0040] - inserting the new sensor data point in the reachable graph after the training data point with the minimum position and before the training data point with a greater reachable distance than the determined minimum reachable distance,

[0041] - assigning to the new sensor data point a cluster determined as a function of the position of the new sensor data point as a graph and as a function of the minimum reachable distance a condition as normal or abnormal, wherein each cluster is assigned to a different operating state of the technical system (100), and

[0042] - outputting the assigned condition and / or the assigned cluster as a result of the anomaly detection, and

[0043] - triggering an alarm function based on the result of the anomaly recognition.

[0044] By this method it is possible to evaluate very quickly new sensor data points which are measured in a time series at a technical system to be monitored. Here, it is not only possible to evaluate whether a new sensor data point indicates a normal or an abnormal state of the technical system, but also to assign a cluster, for example corresponding to a working mode of the technical system. Thus, the property of the density-based clustering function, i.e. assigning a certain cluster to a point or identifying the point as an outlier, can be extended to new sensor data points added in chronological order. Here, each data point is considered first individually and without time correlation. Preferably in a subsequent step a decision is made whether an anomaly or a random change is involved taking into account, for example, a predefined minimum number of new sensor data points.

[0045] A third aspect of the present application relates to a computer program product comprising a non-transitory computer readable medium directly loadable into the memory of a digital computer, the non-transitory computer readable medium comprising program code portions adapted for performing the steps of the method.

[0046] Unless otherwise indicated in the following description, the terms "determining", "inserting", "outputting" and the like preferably relate to actions and / or processes and / or processing steps that change and / or generate data and transform the data into other data, wherein the data can be present or exist, inter alia, as physical variables, for example as electrical pulses. In connection with the present application, a monitoring device can be understood, for example, as one or more processors and / or a storage unit for storing program instructions. The device can be an independent device or part of a device.

[0047] A corresponding "unit", for example an analysis unit, can be implemented in hardware technology and / or also in software technology. In the case of implementation in hardware technology, the corresponding unit can be constructed as a device or as part of a device, for example as a computer or as a microprocessor or as a control computer. In the case of implementation in software technology, the corresponding unit can be constructed as a part of a computer program product, a function, a routine, a program code or an executable object. The embodiments and features described for the proposed monitoring device apply correspondingly to the proposed method. BRIEF DESCRIPTION OF DRAWINGS

[0048] Embodiments of the monitoring device according to the present application and the method according to the present application are exemplarily presented in the drawings and explained in more detail by means of the following description.

[0049] Figure 1 An embodiment of the monitoring device according to the present application is illustrated in a block diagram;

[0050] Figure 2schematic diagram showing the determination of cores and reach distances conventionally according to a density-based clustering function;

[0051] Figure 3 schematic diagram showing training data points and a reach graph determined therefrom;

[0052] Figure 4 schematic diagram showing individual method steps of a method according to the application;

[0053] Figure 5 schematic diagram showing a method according to the application for determining a minimum position of a new sensor data point in a reach graph; and

[0054] Figure 6 One embodiment of a method according to the application is shown in the form of a flowchart.

[0055] Parts corresponding to one another are provided with the same reference numerals in all the figures. DETAILED DESCRIPTION

[0056] The technical system 100 and the monitoring device 200 are presented in Figure 1 The technical system 100 can be, for example, a device in one or more machines or automation installations in an energy distribution, energy generation or energy transport installation. Parameters of the technical system 100 are measured continuously via sensors and one or more of these parameter values are provided as sensor data points 102 to the monitoring device 200.

[0057] The monitoring device 200 comprises an input interface 201 which receives one or more sensor data points 102 from the technical system 100. The sensor data points can be received continuously at short time intervals, see for example the continuous sensor data point sequence 101, or individual data points can be received at longer time intervals, see the sensor data point 102.

[0058] In addition, the monitoring device 200 comprises an analysis unit 202 which executes a density-based clustering function 205 which uses the sensor data points as input values. Here, the new sensor data points 102 are assigned to a condition as normal or abnormal according to a clustering model, wherein the condition of the sensor data points 102 represents the state of the technical system 100 at the time at which the sensor data points 102 were recorded. The density-based clustering function 205 can assign the sensor data points 102 to different clusters, wherein each cluster is assigned to or corresponds to a different operating state of the technical system 100. The assignment of the clusters to operating modes and the specification of the condition of the sensor data points considered as normal or abnormal are output by the analysis unit 202 to an output interface 203 as a result of the anomaly detection. According to the result of the anomaly recognition, for example, an alarm function can be triggered.

[0059] Since individual sensor data points can be determined as outliers marking abnormal behavior of the technical system, although no abnormality actually exists, it is preferred to additionally analyze further new sensor data points and only export a sensor data point as an anomaly when the result of the anomaly identification within the considered time window (see data in the time window 103 of the input interface 201) complies with a predefined rule. Alternatively, instead of a time window with a predefined duration, a predefined minimum number of temporally successive new sensor data can be analyzed and an anomaly detection can be performed. Only when the result of this anomaly detection complies with a predefined rule, the sensor data point 102 is exported as an anomaly.

[0060] The rule here, for example, is that a minimum number of the considered new sensor data points 102 have been detected as anomalies. For example, the number of new sensor points 102 detected as outliers in successive time windows 103 increases. Not only the duration of the time window, but also the minimum number of data points required for exporting an anomaly assigned as an anomaly and the type of rule to be applied can be input by means of the user interface 204. A specific rule can be, for example, that the number of new sensor data points marked as outliers in successive time windows increases over time, wherein a minimum number of ten new sensor data points is contained in each time window. These rules can be adapted to the behavior of the new sensor data points and thus to the state of the technical system 100. These inputs are preferably specified by a domain expert.

[0061] Density-based clustering methods are particularly suitable for identifying various types of normal states and assigning sensor data points to different clusters accordingly. As an example, the method "Ordering Points to Identify the Clustering Structure" in short OPTICS method is described below: how this method can be used and modified in order to be able to quickly perform anomaly detection for new sensor data points 102.

[0062] The result of the OPTICS method is visualized as a reachability plot 312, see Figure 3 In this case, the reachability distance RD is provided on the y-axis. The data points xi are plotted along the x-axis in the order sorted by OPTICS. The "valleys" in the reachability plot 312 correspond to the clusters Cl, C2, C3 identified in the data set 311, the depth of the valleys indicating the density of the cluster, see Figure 3 .

[0063] By means of Figure 2 and Figure 3 the determination of this reachability plot in the actual traversal of the OPTICS method is now described. Based thereon, the extension of the method according to the application is described in Figure 4 and Figure 5 .

[0064] Two measures are computed for each data point which are decisive for the clustering method: the core distance CD and the reach distance RD. In Figure 2 this is presented for a data point o. The OPTICS clustering method has three parameters here. First, the maximum ε distance ε_max. This maximum ε distance ε_max specifies the radius around the point o which is considered in the processing. The second parameter is the minimum number MinPts of points. With this definition: how many points N ε (o) must lie within the ε_max radius in order for the point o to be considered a core point. Furthermore, the parameter ε_max is decisive for determining the core distance of the point o. The third parameter is the ε value for which the clusters are created. This value can also be changed after the calculation of the cluster structure and thus different density clusters can be extracted without large computing effort.

[0065] The core distance is generally defined by:

[0066]

[0067] The reach distance is generally defined by:

[0068]

[0069] The actual traversal of the OPTICS clustering method proceeds as follows:

[0070] First, an arbitrary data point is selected, for example the point x; in Figure 3 According to the definition, this data point has a reach distance "infinite" since the reach distance RD must always be defined via a previously processed point and in this case there is no predecessor. However, the core distance CD(o) of the point o can be determined.

[0071] Furthermore, all data points which lie in the ε_max radius around the point o are inserted into a list. The data points first temporarily obtain a reach distance RD as can be defined via the currently considered point o. The list is then sorted according to the reach distances RD of the points. The point with the smallest reach distance is then extracted from the list and is likewise processed as the next. Its points which lie in the ε_max radius are also added to the list with the reach distances from the current point. If a point should already lie in the list, the reach distance RD of the point is updated if necessary, as long as the reach distance would thereby become smaller. This is continued according to the scheme until the list is empty. If then all points have not been processed, an arbitrary not yet processed point is randomly selected. The reach distance RD can then be entered into the reach diagram (see Figure 3In this case, the points are arranged in the x-direction in the order of their processing. In the y-direction, the reach distances RD of the points are entered respectively. Exemplarily, a point xi from the data point set 311 is entered in the reach graph 312 in such a way that it is designated by xi.

[0072] The reach graph 312 is a visualization of the determined cluster hierarchy. The reach graph also makes the adjustment of the ε parameter, which is required for the extraction of clusters and the definition of outliers, easy, which are Figure 3 designated by the reference sign 313. In this case, it is noted that the core distances of the points are additionally taken into account when extracting the clusters Ci, C2, C3. Thus, the red lines in the reach graph 312 can give an intuitive representation of which clusters Ci, C2, C3 are formed. However, it must be assumed that individual points with a reach distance RD greater than the ε value are nevertheless assigned to a cluster Ci, C2, C3 on the basis of their small core distance.

[0073] For the technical system 100, a reach graph 312 has been trained on the basis of a plurality of training data, for example Figure 3 The drawn ε value 314 illustrates the maximum reach distance here. If the determined reach distance RD for one data point is greater than this maximum value 314, this data point is marked as an outlier 313 and is assigned to the abnormal state. Each new sensor data point z received by the input interface 201 of the monitoring device 200 should now be assigned by the analysis unit 202 or the density-based clustering function 205 to one of the existing clusters Ci, C2, C3 determined by the training data points xi or marked as an outlier.

[0074] For this, the new sensor data point z has to be inserted at the correct position in the reach graph 312. For this, a density-based clustering method, in particular the OPTICS method, can be applied to all points that have been used so far, i.e. the training data points and additionally the new sensor data point z. However, this solution has the disadvantage that it is poorly scalable, since the entire density-based clustering method has to be traversed anew for each new sensor data point z. Furthermore, if the new sensor data point z is randomly selected in the course of the method in order to start a new cluster, unnaturally large reach distances RD can occur. Furthermore, density-based clustering methods, like in particular the OPTICS, are order-dependent and thus do not guarantee that the reach distance RD is optimal for the point.

[0075] For this reason, the new sensor data point z is now added as described below by means of Figure 4 the method according to the application. Figure 4The new sensor data point z is shown in the diagram 401. First, all points x1, x2, x3 that are located in the ε_max radius around the new sensor data point z are determined. It is determined how many points there are. In the case presented in the diagram 401, this is the points x1, x2, x3. If there are more points than the pre-given number MinPts, then the new sensor data point z is a core point and its core distance CD(z) is determined according to the above-described method. If this is not the case, then its core distance CD(z) is set to be infinite.

[0076] Next, for each point in the ε_max radius, i.e. from each of the points x1, x2, x3, the reachable distance RD(x1, z), RD(x2, z), RD(x3, z) from the new sensor data point z is determined respectively. This is presented in the diagram 402. To this end, the core distance CD(x1), CD(x2), CD(x3) is presented around each of the training data points x1, x2, x3 and the reachable distance between x1 and z or x2 and z or x3 and z is determined according to the definition (2). Then, the point from the set of training points x1, x2, x3 is determined that provides the new sensor data point z with the smallest reachable distance minRD. This smallest reachable distance is noted as the smallest reachable distance minRD of the new sensor data point z. The training data point x1 via which the smallest reachable distance is defined is marked as the predecessor or the minimum position.

[0077] Next, the new sensor data point z is inserted at the respective place in the reachability graph. An enlarged part 322 of the reachability graph 312 created for the training data points of the technical system is presented.

[0078] The new sensor data point z is presented in the reachability graph 322 on the right as a strip with a height corresponding to its determined smallest reachable distance minRD.

[0079] If the new sensor data point z is not reachable from any other training data point, then the new sensor data point is inserted at the end of the reachability graph 312. Otherwise, the minimum position, i.e. the position of its predecessor, is determined. The predecessor, in the diagram 322 the training data point x1 and all training data points that were processed before this training data point, i.e. all training data points that are presented to the left of xi in order, are discarded. According to the definition, the new sensor data point must be inserted later. It is checked for all remaining training data points in the reachability graph 322 or 312 whether their reachable distance RD is greater than the smallest reachable distance minRD of the new sensor data point z. As soon as this is the case for one training data point, the new sensor data point is inserted before this training data point. If this is never the case until the end of the reachability graph 312, then the new sensor data point is inserted at the end.

[0080] The new sensor data point z can now be assigned to a determined cluster according to its position in the reached graph which now contains the new sensor data point in addition to the training data points. Thus, the new sensor data point is always assigned to the cluster to which also the predecessor, i.e. the training data point with the smallest position, belongs. According to the smallest reached distance minRD, a condition of normal or abnormal is assigned to the new sensor data point z. If the smallest reached distance minRD of the new sensor data point z is smaller than the limit reached distance 314 plotted in the reached graph 312, a condition normal is assigned to the new sensor data point z, if its smallest reached distance is larger than the limit reached distance 314, a condition abnormal is assigned to the new sensor data point.

[0081] Thus, the cluster and the condition can be assigned to the new sensor data point z by a small number of steps. In order to classify the new sensor data point z more precisely to a cluster or as normal or abnormal, a density-based clustering method can be applied to the new reached graph accordingly for cluster extraction with the order of data points and their reached distances.

[0082] According to Figure 6 , the method according to the present application is outlined by means of a flow chart. In a first method step S1, a new sensor data point of a technical system is received. Next, a smallest reached distance is determined for the new sensor data point with respect to a selection of neighboring training data points, see method step S2. The selection of training data points corresponds to the training data points xi, x2, x3 in the diagram 401. Next, in a method step S3, a smallest position is determined for the new sensor data point in the order of training data points in the reached graph 312. As presented by means of the diagrams 402 and 403, a reached distance to the new sensor data point is determined for each training data point xi, x2, x3 of the selection of training data points and the shortest of the determined reached distances, see minRD in the diagram 403, is assigned to the new sensor data point z as the smallest reached distance. The position of the training data point of the selection of training data points with the determined shortest reached distance, i.e. the training data point xi in the diagram 403, is determined as the predecessor position and thus as the smallest position.

[0083] In a method step S4, the new sensor data point is now inserted in the reached graph 312 after the smallest position, here after the training point xi and before the training data point with a larger reached distance than the determined smallest reached distance. In the reached graph 312' which is supplemented with the new sensor data point, the training data point x5 is the training data point with a larger reached distance than the determined smallest reached distance minRD. Thus, the new sensor data point z is inserted at the position presented with the arrow.

[0084] Subsequently, in a method step S5, the new sensor data point is assigned a determined cluster according to its position in the supplemented reachability graph 312' and is assigned a status normal or abnormal according to the minimum reachability distance minRD with respect to the limit reachability distance 314. In a method step S6, the assigned status and / or the assigned cluster are output as a result of the anomaly monitoring. As already described for the monitoring device 200, the status as normal or abnormal can only be assigned in accordance with the described method when the anomaly detection is performed for a predetermined number of new sensor data points or a plurality of new sensor data points in a time window having a predetermined duration and the result of the anomaly detection complies with a determined rule.

[0085] The described method and the described monitoring device also enable the sensor data received dynamically, i.e. chronologically, to be classified in a short time with respect to the operating mode represented by the clusters and with respect to the status as normal or abnormal. In this case, not all data points must be available from the outset for the density-based clustering method, but further data points can be added gradually.

[0086] The described method is more robust with respect to the reachability distance than the conventional density-based clustering method OPTICS. The described method also solves the problem of the conventional OPTICS method in which too high a reachability distance is assigned in the case of a new sensor data point. This can occur in the case that a cluster is completely processed and a jump to a new cluster must be made and this jump takes place via the new sensor data point to be analyzed. The case can also be such that the parameters of the density-based clustering method are not optimally adjusted and the sensor data point to be analyzed anew forms a bridge between two clusters to some extent and is the next reachable point, which is not a big problem for normal clustering with OPTICS.

[0087] The application is not limited to the described embodiments.

Claims

1. A monitoring device for detecting anomalies in a technical system (100), in which parameters relevant to the state of the technical system are measured continuously over time by means of sensors, the monitoring device comprising: an input interface (201) configured to receive new sensor data points (102, z) of the technical system (100); An analysis unit (202), wherein the analysis unit is configured to: - determining for said new sensor data point (102, z) a minimum reachable distance (minRD) relative to a selected set of adjacent training data points (x1, x2, x3), and - determining for the new sensor data point (102, z) a minimum position (xi) in the sequence of training data points in a reachability graph (312), the reachability graph being created with the aid of a density-based clustering function that uses predetermined training data points as input values ​​and in which the sequence of training data points is sorted in ascending order according to the order in which the training data points were processed, and in which a reachability distance (RD) is specified for each training data point, - inserting the new sensor data point (102, z) in the reachability graph after the minimum position (xi) and before a training data point having a reachability distance greater than the determined minimum reachable distance (minRD), - assigning the new sensor data point (102, z) to a determined cluster according to its position in the supplemented reachability graph (312') and as a normal or abnormal condition according to the minimum reachable distance (minRD), wherein each cluster is assigned to a different operating state of the technical system (100), and An output interface (203) is configured to output the determined assignment of the operating mode to the new sensor data point (102, z) and a description of the normal or abnormal situation as a result of the anomaly detection, and to trigger an alarm function based on the result of the anomaly detection.

2. The monitoring device according to claim 1, wherein the density-based clustering function is the "Order Points to Identify Cluster Structure" method, abbreviated as OPTICS method.

3. A monitoring device according to claim 1 or 2, wherein the monitoring device is configured to apply the density-based clustering function to the reachability graph (312') supplemented with the new sensor data point (102, z) and assign the new sensor data point (102, z) the cluster and condition determined thereby for the new sensor data point.

4. A monitoring device according to claim 1 or 2, wherein the selected set of adjacent training data points (x1, x2, x3) contains all training data points that have a predetermined distance (ε_max) from the new sensor data point (102, z).

5. The monitoring device according to claim 4 is configured to assign a core distance having an infinite value to the new sensor data point (102, z) if the number of adjacent training data points (x1, x2, x3) is less than a predetermined number (MinPnt).

6. The monitoring device according to claim 4 is configured to determine a reachable distance to the new sensor data point (102, z) for each training data point in the selected set of training data points (x1, x2, x3), and assign the shortest reachable distance among the determined reachable distances to the new sensor data point (102, z) as a minimum reachable distance (minRD).

7. The monitoring device according to claim 6 is configured to determine the position of the training data point with the determined shortest reachable distance in the selected set of training data points (x1, x2, x3) as the previous position in the reachable graph (312) and determine the next position as the minimum position of the new sensor data point (102, z).

8. The monitoring device according to claim 6 is configured to insert the new sensor data point (102, z) at the end of the reachable graph (312) if the reachable distance of each training data point arranged sequentially after the predecessor position is less than the minimum reachable distance (minRD) of the new sensor data point (102, z).

9. A monitoring device according to claim 1 or 2, wherein the monitoring device is configured to execute the steps performed in the analysis unit (202) for all new sensor data points (102, z) received in a time window with a predetermined duration, or for a predetermined minimum number of temporally consecutive new sensor data points (102, z), and output as an anomaly only if the determined allocation complies with predetermined rules.

10. The monitoring device of claim 9, wherein the rule is a minimum number of new sensor data points (102, z) to be detected as anomalous.

11. The monitoring device of claim 9, wherein the rule is an increasing number of new sensor data points (102, z) detected as anomalous in successive time windows.

12. The monitoring device according to claim 9, further comprising a user interface (204) and configured to receive the duration of the time window, the minimum number of new sensor data points or the type of rule.

13. The monitoring device according to claim 1 or 2, wherein the technical system (100) is one or more machines or devices of an automation facility, an energy distribution facility or an energy generation or energy transmission facility.

14. A method for detecting anomalies in a technical system (100), wherein parameters relevant to the state of the technical system are measured continuously over time by means of sensors, the method being performed by a monitoring device, the method comprising the following steps: - receiving (S1) new sensor data points (102, z) of the technical system, - determining (S2) for said new sensor data point the minimum reachable distance (minRD) with respect to a selected set of adjacent training data points (x1, x2, x3), and - for the new sensor data point (102, z), determining (S3) a minimum position (xi) in the sequence of the training data points in a reachability graph (312), the reachability graph being created with the aid of a density-based clustering function that uses predetermined training data points as input values ​​and the sequence of training data points being sorted in ascending order according to the order in which the training data points were processed, and indicating a reachability distance (RD) for each training data point in the reachability graph, - inserting (S4) the new sensor data point (102, z) in the reachability graph (312) after the minimum position (xi) and before a training data point having a reachability distance greater than the determined minimum reachable distance (minRD), - assigning (S5) the new sensor data point (102, z) to a determined cluster based on its position in the supplemented reachability graph (312') and to a normal or abnormal situation based on the minimum reachability distance (minRD), wherein each cluster is assigned to a different operating state of the technical system (100), and - outputting (S6) the assigned condition and / or the assigned cluster as a result of the anomaly detection, and -Trigger alarm function based on the results of abnormal identification.

15. A computer program product comprising a non-volatile computer-readable medium directly loadable into a memory of a digital computer, the non-volatile computer-readable medium comprising program code portions adapted to execute the steps of the method according to claim 14.

Images