System and method for interpreting alarms caused by machine learning model of industrial automation system

Abstract

Embodiments of the present disclosure relate to systems and methods for interpreting alarms caused by a machine learning model of an industrial automation system. An interpreter system (100) for interpreting alarms induced by a machine learning model (152) of an industrial automation system is provided. The interpreter system is configured to: receive a model output from a machine learning model trained to predict anomalous behavior in the industrial automation system and initiate an alert; processing the model output using at least one predictive interpretation technique to identify at least one affecting feature contributing to the model output; extracting contextual information from at least one machine-readable information source (106, 108, 110, 114, 118) associated with the industrial automation system using the identified at least one affecting feature; and preparing the extracted contextual information for display to an operator of the industrial automation system to enable the operator to select an appropriate action to take in response to the alert to ensure appropriate functionality of the industrial automation system.

Description

Technical Field

[0001] The present invention relates to systems and methods for interpreting alarms raised by machine learning models of industrial automation systems. Background Art

[0002] Current industrial automation systems are designed to raise alarms to indicate safety or performance issues related to ongoing industrial processes, as well as other issues. Machine learning-driven systems enhance this capability by being trained to predict abnormal behavior more quickly, resulting in a surge in alarms. Human operators analyze alarms to determine the appropriate actions to take based on their experience. Depending on the operator's expertise, the analysis may take a considerable amount of time. In addition, the operator may not be able to determine the appropriate actions to take in response to the alarm. Delayed or inappropriate responses may result in catastrophic conditions or plant shutdowns. On the other hand, over-response to alarms may result in resources being wasted on non-critical issues. Summary of the invention

[0003] To better address one or more of these issues, in a first aspect, an interpreter system for interpreting alerts triggered by a machine learning model of an industrial automation system is provided, the interpreter system being configured to:

[0004] receiving a model output from a machine learning model trained to predict abnormal behavior in an industrial automation system and raise an alarm;

[0005] processing the model output using at least one predictive explanation technique to identify at least one influential feature that contributes to the model output;

[0006] extracting contextual information from at least one machine-readable information source related to the industrial automation system using the identified at least one influential feature; and

[0007] The extracted contextual information is prepared for display to an operator of the industrial automation system to enable the operator to select appropriate actions to take in response to the alarm to ensure proper function of the industrial automation system.

[0008] In this way, operators are provided with enhanced information about the status and functionality of the industrial automation system for contextualizing alarms, based on which operators can make more informed decisions about interacting with the industrial automation system to ensure its proper functionality, and in particular to avoid technical failures.

[0009] In one example, processing the model output using at least one predictive explanation technique includes identifying at least one influential feature using a LIME technique. Additionally or alternatively, processing the model output using at least one predictive explanation technique may include identifying at least one influential feature using a SHAP technique. It should be understood that in other examples, other such techniques may also be used. In the context of this technique, "influential features" may alternatively be described as "important features" or "contributing features," i.e., features or inputs that contribute most to the model output. In the case where the predictive explanation technique assigns feature importance or weights to multiple features or inputs, only those features or inputs whose metrics are above a predetermined threshold may be identified as influential features.

[0010] Extracting contextual information from at least one machine-readable information source may include extracting information from one or more databases and / or from one or more knowledge bases. In particular, the machine-readable information source may be provided by a historical database, an operator log, an audit trail, and / or an ontology (e.g., a knowledge graph), such as those described herein. The extraction of information may be performed by an information extractor, such as a past event identifier, a knowledge graph manager, or a P&ID annotator described herein. As described herein, the extracted information may therefore include one or more of the following: process data (e.g., time series data) similar to past events; metadata (e.g., time series data) of similar past events; past operator actions taken in response to similar past events; fault diagnostic data of similar past events; process variables associated with or occurring in conjunction with at least one influential process variable during a similar past event; process equipment and / or instruments involved in an alarm or affected by an alarm.

[0011] Extracting contextual information from at least one machine-readable information source may include extracting information related to at least one past event that is similar to an event associated with the alarm to be interpreted. Hereinafter, for the sake of brevity, the event associated with the alarm to be interpreted may be referred to as a "current event". Similar past events may be viewed as historical events involving events of the same type, that is, events involving at least some of the same signals or process variables as the current event, and / or similar measurable changes observed about these signals or process variables. The extracted information related to at least one past event may then be prepared for display to an operator as contextual information. In this way, the operator is able to learn from similar past events in order to respond more effectively to the current event.

[0012] Extracting information related to at least one past event may include first identifying at least one past event similar to the current event. Identifying at least one past event may include applying at least one similarity function and / or distance function to determine the similarity and / or distance between the current event and at least one candidate past event stored in a database of past events. The database of past events may include a historical database. The database and / or its content is therefore used to provide the above-mentioned machine-readable information source. In one example, a z-normalized Euclidean distance function is used to measure the distance between the current event and at least one candidate past event stored in the database. Other possible alternative distance functions include dynamic time warping (if the lengths of the segments are different). A similarity function or a distance function may attribute a similarity index or a distance index to each of a plurality of candidate events, respectively, thereby selecting at least one similar past event to be extracted. A plurality of candidate events may be sorted or filtered based on the similarity or distance index of the plurality of candidate events. For example, the candidate past events may be sorted, and one or more of the candidates with the highest sorting may be selected. Additionally or alternatively, only those candidates having a similarity index higher than a predetermined threshold or a distance index lower than a predetermined threshold, respectively, may be selected for extraction.

[0013] In order to retrieve at least one similar past event from the database, information extraction may include employing a search algorithm to locate at least one similar past event. Employing the search algorithm may include formulating a search query based on data characterizing the current event. For example, formulating the search query may include acquiring at least one process data having an influencing feature, and using the acquired process data to formulate the search query. Formulating the search query may include constraining the acquired process data to a time window. The time window may be determined, for example, using an interquartile range method (e.g., using a box plot) with the current event as the median. The time window of the current event may be determined based on a prediction provided by a machine learning model. Alternatively, the time window may be described as an interpretation window. The time window may have a start time and an end time. The time window may be defined relative to a fixed reference point, such as the beginning of a day. The start time and the end time may be determined by an operator by cutting a trend representing the event.

[0014] Extracting information related to at least one similar past event may include extracting process data collected in conjunction with at least one past event. In one example, where the identified at least one influential feature is associated with a process variable of an industrial process performed by an industrial automation system (i.e., an influential process variable), the extracted process data may include process data of the influential process variable. Additionally or alternatively, extracting information may include identifying at least one relevant process variable that appears in at least one machine-readable information source in conjunction with at least one influential feature, where the extracted process data includes process data of the relevant process variable. The extracted process data may include, for example, time series data. For at least one influential feature associated with the current event, the extracted time series data may be constrained to a time period whose duration is equal to the duration of the time series data. To this end, as described above, a time window may be determined for the current event, and the time window is used to constrain the process data extracted from at least one machine-readable information source. In one example, the time window is determined using an interquartile range method. The process data may be extracted from a database storing such data, such as a historical database described herein. Although the present disclosure uses the term "process variable", it should be understood that in some industrial automation contexts, this is alternatively described as a "signal".

[0015] Extracting information related to at least one similar past event may include identifying at least one past operator action taken in conjunction with the at least one similar past event. Identifying at least one past operator action may include searching an audit trail that records past operator actions taken in conjunction with past events. The audit trail used as a machine-readable information source may form part of an industrial automation system and / or an interpreter system. Once identified, at least one similar past event may be associated with one or more timestamps. Similarly, past operator actions recorded in the audit trail may be associated with corresponding timestamps. Therefore, at least one past operator action taken in conjunction with at least one similar past event may be identified based on these timestamps.

[0016] Extracting information related to at least one similar past event may include obtaining at least one diagnostic detail related to at least one similar past event. Additionally or alternatively, extracting information related to at least one similar past event may include obtaining at least one operator note related to at least one similar past event. The diagnostic details and / or operator notes may be obtained by searching a database storing an operator log, which may form part of the industrial automation system and / or the interpreter system. The operator log may be searched using a timestamp-based approach, as discussed elsewhere herein.

[0017] Extracting contextual information from at least one machine-readable information source may include extracting information from an ontology (i.e., an ontology model) that describes an industrial automation system and / or an industrial process performed thereby. Thus, the ontology is used to provide at least one of the above-mentioned machine-readable information sources. Extracting information from the ontology may include identifying at least one entity in the ontology that is linked or associated with at least one influential feature. In this sense, the ontology may be used as a data link directory. As described herein, in the case where at least one relevant process variable (which appears in at least one information source in combination with at least one influential feature or influential process variable) is identified, extracting information from the ontology may also include identifying at least one entity linked or associated with at least one relevant process variable in the ontology. In any case, any entity so identified in the ontology may relate to process equipment and / or instruments for regulating and / or measuring the process variable in question. The extracted information may include asset information related to the entity. Examples of asset information that can be extracted from the ontology include device ID, device category, physical location, and an adjacency matrix of connected devices. In one example, the ontology may include a knowledge graph. Information extraction from an ontology or a knowledge graph may be referred to as knowledge extraction from a knowledge base. Contextual information extracted from the ontology in this manner may enable a holistic view of abnormal behavior to be provided.

[0018] Extracting contextual information from at least one machine-readable information source may include extracting information from at least one piping and instrumentation diagram (P&ID) associated with an industrial automation system. The P&ID illustrates the interconnection of process devices and instruments used to control a process. Extracting information from at least one P&ID may include identifying at least one instance of process devices and / or instruments associated with at least one influential feature, such as a field device having a tag or identification corresponding to a tag or identifier of an influential process variable.

[0019] Any feature, variable, signal, or measurement, and associated process equipment or instrumentation (such as a field device, control device, or sensor) as described herein may be described using a standardized identifier or tag that uniquely identifies the entity in question in the industrial process.

[0020] In the case where the context information includes process data, preparing the extracted context information for display to an operator may include preparing a graph showing the process data over time, such as over a time window determined as described herein. In the case where process data for multiple process variables is extracted, multiple corresponding variables may be plotted side by side for ready comparison. Preparing the extracted context information for display may include preparing one or more text fields that include, for example, text extracted from an operator log, an audit trail, or an ontology. In the case where the context information includes information extracted from at least one P&ID, preparing the extracted context information for display may include annotating the P&ID to indicate the context information included therein, such as by highlighting. For example, symbols, labels, and / or identifiers appearing in the P&ID may be annotated, such as by highlighting.

[0021] After preparing for display, the context information may be displayed to the operator. It should be understood that the context information may be displayed by a display device external to the interpreter system, such as an HMI monitor of an industrial automation system, i.e., a control room operator interface. In this sense, the act of preparing the extracted context information for display may be understood to include placing the context information in a form in which it may be transmitted to an external display device for display thereby.

[0022] The interpreter system may also include a feedback collector configured to collect feedback from an operator about the context information and use the feedback to improve subsequent interpretations. For example, where the context information includes data related to similar past events, the operator may provide an indication of the usefulness of the event as feedback, which is stored in a corresponding database in conjunction with the similar past events. The indication of usefulness may include, for example, an indicator, such as a value selected from a set of such values, such as an ordered value. In a subsequent interpretation process, the interpreter system may then filter or sort similar past events retrieved from the database based on their usefulness.

[0023] According to a second aspect, there is provided a method for interpreting an alarm raised by a machine learning model of an industrial automation system, the method comprising:

[0024] receiving a model output from a machine learning model trained to predict abnormal behavior in an industrial automation system and raise an alarm;

[0025] processing the model output using at least one predictive explanation technique to identify at least one influential feature that contributes to the model output;

[0026] extracting contextual information from at least one machine-readable information source related to the industrial automation system using the identified at least one influential feature; and

[0027] The extracted contextual information is prepared for display to an operator of the industrial automation system to enable the operator to select appropriate actions to take in response to the alarm to ensure proper function of the industrial automation system.

[0028] Optional features and sub-aspects of the first aspect may form part of the second aspect (mutatis mutandis).

[0029] The method of the second aspect may be computer-implemented.

[0030] According to a third aspect, there is provided a computing system configured to perform the method of the second aspect.

[0031] According to a fourth aspect, there is provided a computer program (product) comprising instructions which, when executed by a computing system, enable the computing system to perform or cause the computing system to perform the method of the second aspect.

[0032] According to a fifth aspect, there is provided a computer readable (storage) medium comprising instructions which, when executed by a computing system, enable or cause the computing system to perform the method of the second aspect. The computer readable medium may be transient or non-transient, volatile or non-volatile.

[0033] The present invention may include one or more aspects, examples or features, either alone or in combination, whether specifically disclosed in this combination or disclosed alone.Any optional features or sub-aspects of one of the above aspects are appropriately applied to any of the other aspects.

[0034] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiments described hereinafter.

[0035] The present disclosure provides a system and method for providing actionable explanations to model-driven recommendations. The system and method provide operator-friendly explanations and possible user actions for responding to model-driven predictions to enhance operator decisions. In particular, the present disclosure relates to an interpreter system that enhances alarms or abnormal conditions identified by a machine learning component with the reasons behind alarm generation. The explanation (which can appear directly on the HMI monitor / operator screen as a new view) enriches the explanation of signal-based machine learning with historical context. Annotated P&IDs can be provided to put the explanation into the context of the plant topology / connection diagram. The explanation can indicate which signals are related to the prediction (e.g., anomalies, faults). Therefore, the operator can easily determine whether there is a possible causal relationship between the signals. The operator can provide direct feedback on the explanation in context. The operator can give implicit positive feedback on their interest in the insights provided by the explanation by clicking on the details of the explanation.

[0036] In industrial automation, field devices and control devices are provided that are capable of detecting measurable changes occurring in an ongoing industrial process, i.e., transients during device operation. Such devices can generate events in response to the detection of such changes. The term "event" is used herein to describe both an alarm generated by a device in response to the detection of a measurable change and the measurable change itself. The alarm generated by the device can be associated with one or more attributes, including a timestamp indicating when the event occurred, a priority indicating whether the event is serious, an indication of the condition that triggered the event, the plant equipment associated with the event, the event category, etc. If the detected change involves an equipment failure, a process deviation, or an abnormal condition that requires an operator response, the event can be classified as an alarm, i.e., a process alarm or a fault alarm. The term "alarm" is used to represent an event that requires an operator response.

[0037] Any component of the interpreter system disclosed herein may be appropriately described as a "module", "(sub)system", "engine", "tool" or "administrator". Any of these components may be implemented using hardware, firmware and / or software configured to perform any of the operations described herein. The software or firmware may be embodied as a package, code, instructions, instruction set and / or data recorded on at least one transient or non-transient computer-readable storage medium.

[0038] The term "acquire" as used herein may include, for example, receiving from another system, device, or process; receiving via interaction with a user; loading or retrieving from storage or memory; measuring or capturing using a sensor or other data acquisition device.

[0039] As used herein, the term "determining" includes a wide variety of actions and may include, for example, computing, calculating, processing, deriving, investigating, looking up (e.g., looking up in a table, a database, or another data structure), confirming, etc. Furthermore, "determining" may include receiving (e.g., receiving information), accessing (e.g., accessing data in a memory), etc. Furthermore, "determining" may include resolving, selecting, choosing, establishing, etc.

[0040] The indefinite article "a" or "an" does not exclude a plurality. Furthermore, the terms "a" and "an" as used herein should generally be interpreted as "one or more" unless specified otherwise or the context clearly dictates a singular form.

[0041] Unless otherwise specified or clear from the context, the phrases "one or more of A, B, and C," "at least one of A, B, and C," and "A, B, and / or C" as used herein are intended to mean all possible permutations of one or more of the listed items. That is, the phrase "A and / or B" means (A), (B), or (A and B), and the phrase "A, B, and / or C" means (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C).

[0042] The term "comprising" does not exclude other elements or steps. In addition, the terms "comprising", "including", "having" and the like can be used interchangeably in this document. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] A detailed description will now be given, by way of example only, with reference to the accompanying drawings, in which:

[0044] Figure 1 schematically illustrates an interpreter system according to the present disclosure;

[0045] Figure 2 The interpreter method according to the present disclosure is shown, which can be Figure 1 The interpreter system executes; and

[0046] Figure 3 A computing system that can be used in accordance with the systems and methods disclosed herein is shown. DETAILED DESCRIPTION

[0047] Figure 1An interpreter system 100 according to the present disclosure is schematically shown. The interpreter system 100 is configured to contextualize alarms triggered by a machine learning system 150 of an industrial automation system (not shown). The machine learning system 150 includes a machine learning model 152 that is trained to predict abnormal behaviors or states that are prevalent within the industrial automation system, such as safety-critical or performance issues. In a non-limiting example, the machine learning model 152 runs on the Genix platform. The output from the machine learning model 152 is used by the model to the alarm trigger 154 to trigger an alarm indicating the predicted abnormal behavior. The alarm is delivered to the monitor of the industrial automation system for review and operation by a human operator. In order to help the operator complete these tasks, the interpreter system 100 is configured to present contextual information related to abnormal behavior in the industrial automation system to the operator so that the operator can operate the industrial automation system correctly, and in particular prompt the operator to interact with the industrial automation system to avoid technical failures.

[0048] The interpreter system 100 includes a feature identifier 102 configured to receive an alert raised by a machine learning system 150. The interpreter system 100 is configured to also receive an output from a machine learning model 152 and identify at least one feature as being (most) important or (most) influential in determining the model output. The feature identifier 102 is alternatively described as a predictive interpreter 102. Thus, the feature identifier 102 interacts with the machine learning system 150 to derive traceability from the machine learning model 152. Traceability can be derived from the model 152 using techniques known in the art. For example, an interpretability method of feature importance can be used to identify the features or variables that are most important in determining the model output. Additionally or alternatively, given a particular input, an influential sample method can be used to identify the training samples that are most influential in determining the model output. More specifically, LIME (as described in "Why Should I Trust You?"-Explaining the Predictions of AnyClassifier, Ribeiro.MTet al, 2016) or SHAP (as described in "A Unified Approach toInterpreting ModelPredictions", Lundberg SMet al, 2017) can be used to derive feature sets associated with predictions that lead to alarms. In a non-limiting example, the feature set identified as important or influential to the model output is represented as {PV1, ..., PV n}, where PV indicates a process variable of an industrial process carried by the automation system.

[0049] In addition, the feature identifier 102 optionally also uses, for example, the interquartile range method to identify the time window of the current event. The time window can be represented by <t s ,t d > indicates that t s is the start time of the current event, t d is its end time. In one such non-limiting example, the feature identifier 102 is thus <t s ,t d ,{PV1,...,PV n The prediction-related information is provided in the form of}>.

[0050] The interpreter system 100 also includes a past event identifier 104 configured to identify one or more past events similar to the current event. To this end, the past event identifier 104 is configured to form a query to a search engine based on the output received from the feature identifier 102. In a non-limiting example, the past event identifier 104 obtains a feature set {PV1, ..., PV n}, as described above, the feature set includes relevant (i.e., important or influential) features identified using an interpretable model for the prediction (such as LIME or SHAP) and based on the time window <t s ,t d > Cut the time series data of those features. One or more cut subsequences will become the search query.

[0051] The interpreter system 100 is also configured to access a historical database 106 that stores time series data of process variables used by the industrial automation system over a period of time. The database is maintained by the industrial automation system and grows over time.

[0052] The past event identifier 104 is configured to search the history database 106 through a search engine to identify one or more similar past events. The search engine is configured to execute a search algorithm to run a query on the time series data in the history database 106 to identify one or more similar past events. In a specific non-limiting example, the search algorithm includes a multivariate similarity search algorithm. More specifically, the multivariate similarity search algorithm can be configured to use a z-normalized Euclidean distance function to measure the distance between the time series and the query. However, it should be understood that other search methods can also be used, such as those involving splitting continuous time series data into (overlapping) windows and searching based on an index or hierarchical structure of the data (e.g., obtained by clustering). Other possible alternative distance indicators include dynamic time warping (if the length of the segments is different) or Euclidean distance obtained from the embedded representation of the new network. In any case, the search engine is configured to retrieve one or more similar past events, such as past events whose distance indicators from the current event included in the search results are below a threshold.

[0053] The past event identifier 104 is optionally further configured to search the operator log 108 to retrieve contextual information of one or more similar past events. The distributed control system of the industrial automation system can be configured to record information obtained from the operator in conjunction with the past events in the operator log 108. For example, the operator log 108 may include operator notes, shift reports (e.g., including highlights of the shift that need to be communicated to the next shift operator), diagnostic information, indications of related process variables, and / or other free text documents recorded in conjunction with past events. Since process variables are typically defined by relevant industrial standards, such as using P for pressure, F for flow, etc., a regular expression (regex) search can be used to retrieve related process variables of one or more past events from the operator log 108. Another search method can use named entity recognition from natural language processing or a specially trained deep learning model to perform the search.

[0054] The past event identifier 104 is optionally further configured to search the DCS audit trail 110 to retrieve additional contextual information for one or more similar past events. The distributed control system (DCS) of the industrial automation system may also be configured to store details of the operator action in the DCS audit trail 110. The DCS audit trail 110 may be configured to store one or more timestamps and operator action event type information for previous operator actions. The past event identifier 104 may be configured to search the DCS audit trail 110 for the operator action using the timestamps of the identified similar past events to retrieve the corresponding operator action event type.

[0055] In this manner, the past event identifier 104 is configured to obtain, for a current event, an identification of at least one similar past event, and optionally also obtain contextual information of at least one similar past event. The contextual information may include one or more of the following: an identification of at least one operator action taken in conjunction with at least one similar past event; at least one other process variable associated with at least one similar past event (i.e., an identification of a PV different from the PV that has been identified by the feature identifier 102 as being significant to the model output); at least one diagnostic detail associated with at least one similar past event.

[0056] The interpreter system 100 is also configured to interact with a knowledge graph manager 112 to obtain additional contextual information about the features identified by the feature identifier 102. Most industrial processes have a data item ontology 114, which is usually in the form of a knowledge graph that provides a formal description of the entities involved in the process (such as process equipment, instruments, etc.), and their attributes (such as type, location, value range, related processes, volume, fluid properties, size, etc.). The knowledge graph 114 provides information about the process flow and the process variables involved. The interpreter system 100 is also configured to retrieve asset information related to one or more of the process variables identified by the feature identifier 102 and / or by the past event identifier 104 for subsequent presentation to the operator as part of the contextual information, thereby providing the operator with a holistic view of the process variables related to the current prediction.

[0057] The interpreter system 100 is also provided with a P&ID annotator 116 configured to annotate one or more P&IDs 118 describing an industrial process. In particular, the P&ID annotator 116 can be configured to annotate the one or more P&IDs 118 to highlight one or more of the process variables identified by the feature identifiers 102 as being important to the current prediction, and / or to highlight one or more of the related process variables identified by the past event identifiers 104, so as to provide an operator with additional contextual information about the impact of the prediction. One non-limiting example of highlighting equipment in a P&ID involves overlaying the P&ID with a color to attract the operator's attention. Thus, the P&ID annotator 116 provides insights into the influencing factors of the prediction from past and current predictions, for example by highlighting important features related to the current event and / or other features that affected similar past events.

[0058] The interpreter system 100 also includes a visualizer configured to present the event to an operator along with at least a portion of the contextual information associated therewith. In one non-limiting example, the visualizer 120 is connected to an HMI monitor that an operator typically uses to oversee an industrial process. In particular, the visualizer 100 is configured to merge the alarms raised by the machine learning system 150 with the output of one or more of the past event identifiers 104, the knowledge graph manager 112, and the P&ID annotator 116 to provide an overall view of the prediction. For example, the visualizer 120 may present an explanation related to the current prediction along with one or more actionable recommendations from similar past events. In one non-limiting example, the visualizer 100 generates an HMI screen that includes two portions: one portion depicting a situation from the past and a second portion depicting an active P&ID. However, in general, the visualization generated by the visualizer 120 may include one or more of the following contextual information:

[0059] Identifiers of one or more similar events from past situations;

[0060] · visualization of time series data of one or more related process variables captured during one or more similar past events, where multiple such similar past events can be navigated via "previous" and "next" buttons (as described above, the time series data can be clipped to a time window that is equal to or comparable in length to the time window of the current event);

[0061] Metadata about past events, such as date and time;

[0062] One or more similarity scores for identifying past events;

[0063] One or more operator actions taken in conjunction with past events that caused the operator to

[0064] The user can compare current and past situations and take appropriate action;

[0065] Operator notes about past events; and

[0066] ·Diagnostic information about relevant past events.

[0067] A text summary based on the retrieved text information and the similarity between the selected situation and the current scenario. In one non-limiting example, the text summary includes a concatenation of text from operator annotations and other text sources mentioned herein. Any known text summarization technique may be used for this purpose.

[0068] One or more annotated P&IDs that highlight the process equipment and / or instruments that are affected by the forecast in current conditions and / or past conditions.

[0069] Where the current forecast is the first forecast of its kind, the interpreter system 100 may present only details about the current forecast, such as a cut of the time series data for the current forecast and / or annotated active P&IDs of process variables involved in the current forecast.

[0070] The interpreter system 100 may also include a feedback collector 122 configured to collect feedback from an operator about the displayed visualization. The feedback collector may prompt the operator via the GUI to indicate whether and / or to what extent the provided contextual information is useful, such as previous events retrieved from the history database 106. In a non-limiting example, the operator may select a usefulness indicator from a set of ordered values. When the operator selects one of these values ​​for each past event to indicate its relevance, the feedback collector 122 may update the relevance score of the corresponding event in the history database 106 to improve future search results.

[0071] Figure 2 A process flow 200 performed by the interpreter system 100 is shown.

[0072] The process begins at step 202 when an operator interacts with the GUI 250 displayed by the HMI monitor by clicking a button labeled “EXPLAIN” that appears on the GUI 250 in conjunction with an alert. As described elsewhere herein, the alert is raised by the machine learning system 150 in response to abnormal behavior detected by the machine learning model 152 monitoring the industrial process.

[0073] At step 204, feature identifier 104 receives the output from model 152 and identifies a set of features that are relevant to the current prediction. For each relevant feature, feature identifier 104 also retrieves the signal value for the corresponding I / O signal and the time window that is determined to be relevant. Figure 2 In the non-limiting example shown, flow rate signal FT 305 and pressure signal PT 408 are identified as important features associated with the results.

[0074] At step 206, the past event identifier 104 uses a search engine to search machine-readable information sources to retrieve similar past events and contextual information related thereto. The sources in this example include the historical database 106, the operator log 108, the DCS audit trail 110, the knowledge graph 114, and the P&ID 118, but it should be understood that in other cases, not all of these sources may be relied upon. Figure 2In the non-limiting example shown, the search engine assigns context information to each relevant event included in the search results, the context information comprising event metadata in the form of the following tuple: <event ID, start date, end date, duration, relevant features, similarity score>.

[0075] In particular, at step 206, a multivariate search algorithm using a z-normalized Euclidean function is used to search for similar past events from the historical database 106. A dimension matching method is used. The features from the previous step are cut as a multivariate query Q. Given a multidimensional query Q with p dimensions (the number of features), the multivariate search algorithm searches for similar patterns in each univariate time series separately. A z-normalized Euclidean distance index is calculated for each dimension p. The distance index is then sorted in ascending order, and the top k nearest neighbors (NN) for each dimension p are identified. Events are identified based on overlapping subsequences of dimension p that occur within the same time window, such as a time window with a duration equal to the duration of the current event, although the period in question may vary. Similarly, overlapping subsequences are identified as events, and an average distance index is calculated. These events are then sorted based on the average distance index, and the best match is identified as an event with an average distance index below a threshold value θ. The distance index can then be merged into the above tuple as a "similarity score".

[0076] Additionally, at step 206, other relevant process variables (if any) associated with similar past events are retrieved from the operator notes. The operator log 108 contains the timestamp of the past event, event type information (such as fault, exception, etc.), and the relevant process variable values. The timestamp of each past event is used to retrieve the log information. A regular expression function is then used to identify the relevant process variables from the log information at that particular timestamp. These process variables can then be incorporated into the above tuple as "relevant features".

[0077] Step 206 may also include retrieving diagnostic details from operator notes and / or shift reports. The operator log 108 may also include a description of the fault, such as air blockage, air leak, pump trip, etc., which is retrieved as diagnostic information.

[0078] Step 206 may also include retrieving the operator action from the DCS audit trail 110, which contains the timestamps of previous operator actions and the operator action event types. Using the timestamps of each similar past event, the audit trail 110 is searched to identify the corresponding operator action.

[0079] At step 208, the knowledge graph 114 is searched for asset information related to the process variables identified as being important to the current prediction. That is, the search may identify other related equipment that has not yet been identified as an important feature of the current event.

[0080] At step 210 , device details for the device identified in step 208 are retrieved from the knowledge graph 114 .

[0081] At step 212 , the P&ID annotator 116 annotates the relevant P&ID to highlight the equipment and sensors identified in steps 208 and 210 .

[0082] At step 214, the visualizer 120 presents a visualization 252 on the GUI of contextual information related to the alert raised in step 202. Figure 2 In the non-limiting example shown, for each similar past event, visualization 252 includes metadata for the event (i.e., its start date, end date, and time / duration), its similarity score, time series data plots of important signals FT 305 and PT 408, time series data plots of one related process variable PT 417, operator notes, diagnostic details, and corresponding operator actions. The operator can scroll through the list of similar past events using GUI buttons labeled "Previous" and "Next." The annotated P&ID for each similar past event is presented next to the event data and metadata.

[0083] In other examples, the interpreter system 100 may use textual data from other sources, such as alarm descriptions, maintenance reports available in the historian 106, to enhance model predictions.

[0084] Thus, the present disclosure describes a method for providing user-friendly explanations and / or recommendations associated with predictions provided by a machine learning model. In the context of an automated industrial plant, when a machine learning model provides an advance alert to an operator, the systems and methods disclosed herein provide an explanation behind the alert generated by the model. In addition, the system and method searches the history of similar events in the past, merging information related to the history with information related to the current scenario to provide a holistic view of the current system state by providing: i) visual details of the process equipment and / or instruments responsible for the alert through an annotated P&ID diagram; ii) details of the affected process equipment and / or instruments from a knowledge graph; and iii) operator actions that could be taken when similar events occurred in the past.

[0085] Thus, the systems and methods disclosed herein provide operators with sufficient information about internal states prevalent in industrial automation systems, optionally including actionable recommendations for possible interventions, so as to enable the operator to interact with the system to ensure its correct operation, and in particular to avoid technical failures.

[0086] Figure 3An exemplary computing system 800 that can be used in accordance with the systems and methods disclosed herein is shown. The computing system 800 can form part of or include any desktop, laptop, server, or cloud-based computing system. The computing system 800 includes at least one processor 802 that executes instructions stored in a memory 804. For example, the instructions can be instructions for implementing functions described as being performed by one or more components described herein, or instructions for implementing one or more of the methods described herein. The processor 802 can access the memory 804 via a system bus 806. In addition to storing executable instructions, the memory 804 can also store session inputs, scores assigned to session inputs, and the like.

[0087] The computing system 800 also includes a data store 808 accessible by the processor 802 via the system bus 806. The data store 808 may include executable instructions, log data, etc. The computing system 800 also includes an input interface 810 that allows external devices to communicate with the computing system 800. For example, the input interface 810 may be used to receive instructions from an external computer device, a user, etc. The computing system 800 also includes an output interface 812 that interfaces the computing system 800 with one or more external devices. For example, the computing system 800 may display text, images, etc. via the output interface 812.

[0088] It is contemplated that external devices communicating with the computing system 800 via the input interface 810 and the output interface 812 may be included in an environment providing substantially any type of user interface with which a user may interact. Examples of user interface types include graphical user interfaces, natural user interfaces, and the like. For example, a graphical user interface may accept input from a user using (multiple) input devices such as a keyboard, a mouse, a remote controller, and provide output on an output device such as a display. In addition, a natural user interface may enable a user to interact with the computing system 800 in a manner that is not subject to constraints imposed by input devices such as a keyboard, a mouse, a remote controller, and the like. In contrast, a natural user interface may rely on speech recognition, touch and stylus recognition, gesture recognition on and near the screen, air gestures, head and eye tracking, speech and sound, vision, touch, gestures, machine intelligence, and the like.

[0089] Furthermore, although shown as a single system, it should be understood that the computing system 800 may be a distributed system. Thus, for example, several devices may communicate via a network connection and may jointly perform the tasks described as being performed by the computing system 800.

[0090] The various functions described herein can be implemented with hardware, software or any combination thereof. If implemented with software, these functions can be stored on a computer-readable medium or transmitted by a computer-readable medium as one or more instructions or codes. Computer-readable media include computer-readable storage media. Computer-readable storage media can be any available storage medium that a computer can access. As an example and not limitation, such computer-readable storage media can include FLASH storage media, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer. Disks and optical disks as used herein include compact disks (CDs), laser disks, optical disks, digital versatile disks (DVDs), floppy disks and blue optical disks (BDs), wherein disks usually reproduce data magnetically, and optical disks usually reproduce data optically with lasers. In addition, propagated signals can be included in the scope of computer-readable storage media. Computer-readable media also include communication media, which include any media that helps to transmit a computer program from one place to another. For example, a connection can be a communication medium. For example, if the software is transmitted from a website, server or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies (such as infrared, radio and microwave), then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies (such as infrared, radio and microwave) are included in the definition of communication media. Combinations of the above should also be included within the scope of computer-readable media.

[0091] Alternatively or additionally, the functions described herein may be performed at least in part by one or more hardware logic components. For example, but not limited to, illustrative types of hardware logic components that may be used include field programmable gate arrays (FPGAs), program-specific integrated circuits (ASICs), program-specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), etc.

[0092] Applicants hereby independently disclose each individual feature described herein and any combination of two or more such features, as long as such feature or combination can be implemented based on the common general knowledge of a person skilled in the art as a whole based on this specification, regardless of whether such feature or combination of features solves any problem disclosed herein, and is not limited to the scope of the claims. Applicants indicate that various aspects of the present invention may consist of any such individual feature or combination of features.

[0093] It must be noted that embodiments of the present invention are described with reference to different categories. In particular, some examples are described with reference to methods, while other examples are described with reference to devices. However, a person skilled in the art will appreciate from the description that, unless otherwise notified, any combination of features associated with different categories, in addition to any combination of features belonging to one category, is also considered to be disclosed by the present application. However, all features can be combined to provide synergistic effects, not just the simple sum of the features.

[0094] Although the present invention has been illustrated and described in detail in the drawings and the foregoing description, such illustration and description are to be considered as illustrative rather than restrictive. The present invention is not limited to the disclosed embodiments. Other variations of the disclosed embodiments may be understood and implemented by those skilled in the art through study of the drawings, the present disclosure, and the appended claims.

[0095] The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

[0096] Any reference signs in the claims should not be construed as limiting the scope.

Claims

1. An interpreter system (100) for interpreting an alert raised by a machine learning model (152) of an industrial automation system, the interpreter system being configured to: receiving a model output from the machine learning model, the machine learning model being trained to predict abnormal behavior in the industrial automation system and raise the alarm; processing the model output using at least one predictive explanation technique to identify at least one influential feature that contributes to the model output; extracting contextual information from at least one machine-readable information source (106, 108, 110, 114, 118) related to the industrial automation system using the identified at least one influential feature; as well as The extracted contextual information is prepared for display to an operator of the industrial automation system to enable the operator to select appropriate actions to take in response to the alarm to ensure proper function of the industrial automation system.

2. The interpreter system according to claim 1 is also configured to extract information related to at least one past event as part of the context information, wherein the at least one past event is similar to an event associated with the alarm to be interpreted, wherein the event associated with the alarm to be interpreted includes a current event.

3. The interpreter system of claim 2, further configured to employ a search algorithm to locate at least one similar past event in a database, and to formulate a search query for the search algorithm based on the data characterizing the current event.

4. The interpreter system according to claim 3, further configured to: formulating the search query by acquiring process data for the at least one influential feature, and formulating the search query using the acquired process data as the data characterizing the current event; and The acquired process data is constrained to a predetermined time window when formulating the search query.

5. The interpreter system according to claim 4 is further configured to determine the time window using an interquartile range method with the current event as a median.

6. The interpreter system of any one of claims 2 to 5, further configured to identify at least one past operator action taken in conjunction with the at least one similar past event.

7. The interpreter system according to any of the preceding claims, further configured to extract information from an ontology describing the industrial automation system as part of the context information.

8. The interpreter system of claim 7, further configured to identify at least one entity in the ontology, the at least one entity being linked or associated with the at least one influential feature.

9. The interpreter system of claim 8, wherein the extracted information includes asset information associated with the identified entity.

10. The interpreter system of any of the preceding claims, further configured to extract information from at least one piping and instrumentation diagram associated with the industrial automation system as part of the context information.

11. The interpreter system of claim 10, configured to prepare the extracted context information for display by annotating the at least one pipeline and instrumentation diagram to indicate the context information included therein.

12. An interpreter system according to any one of the preceding claims, wherein the context information comprises process data, and wherein the interpreter system is configured to prepare the extracted context information for display to an operator by preparing a graph showing the process data over time.

13. The interpreter system according to any of the preceding claims, further comprising a feedback collector configured to collect feedback from the operator regarding the context information and use the feedback to improve subsequent interpretations.

14. A method for interpreting an alert raised by a machine learning model of an industrial automation system, the method comprising: receiving a model output from the machine learning model, the machine learning model being trained to predict abnormal behavior in the industrial automation system and raise the alarm; processing the model output using at least one predictive explanation technique to identify at least one influential feature that contributes to the model output; extracting contextual information from at least one machine-readable information source related to the industrial automation system using the identified at least one influential feature; as well as The extracted contextual information is prepared for display to an operator of the industrial automation system to enable the operator to select appropriate actions to take in response to the alarm to ensure proper function of the industrial automation system.

15. A computer program product comprising instructions which, when executed by a computing system, cause the computing system to perform the method according to claim 14.

Images