Log analysis system
By building a log analysis system for the event migration network model, early warning of abnormal events of semiconductor machines is solved, and the problem of inability to early warning in the existing technology is solved, and production efficiency and equipment reliability are improved.
Patent Information
- Application Number
- CN202411714054.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-27
- Publication Date
- 2025-03-18
AI Technical Summary
The existing semiconductor machine log analysis system cannot warning for abnormal events in advance, resulting in reduced production efficiency, equipment shutdown and failure.
Design a log analysis system, including data acquisition module, data processing module, model construction module, model training module and detection and early warning module. By building an event migration network model, based on the semantic similarity and occurrence time of event sequences, the model is trained to calculate possible future alarm events and generate early warnings.
It realizes early warning before alarm events occur, improves equipment operation efficiency, reduces downtime, optimizes production processes, and reduces the occurrence of semiconductor machine failures.
Smart Images
Figure CN119645793A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of semiconductor equipment, and specifically provides a log analysis system. Background Art
[0002] The semiconductor manufacturing process has achieved automated production, with computer control systems controlling the operation of equipment and the execution of processes. In the automated production process, it is necessary to monitor and record the operating status and process parameters of the equipment in real time in order to detect and handle abnormal situations in a timely manner.
[0003] The existing semiconductor machine log analysis system can collect data from various production equipment in real time, generate event logs and alarm logs, monitor the operating status of the equipment in real time, capture abnormal events and issue alarms.
[0004] However, issuing an alarm only after an abnormal event occurs is delayed and cannot avoid the hazards of reduced production efficiency, equipment shutdown, or even equipment failure and damage when an abnormal event occurs. Therefore, it has gradually failed to meet the production needs of semiconductor manufacturing.
[0005] Accordingly, the art needs a new log analysis system solution to solve the above problems. Summary of the invention
[0006] The present invention aims to solve the above technical problem, that is, to solve the problem that abnormal events of existing semiconductor machines cannot be warned in advance.
[0007] The present invention provides a log analysis system, which includes a data acquisition module, a data processing module, a model building module, a model training module and a detection and early warning module;
[0008] The data collection module is configured to collect event logs and alarm logs of the semiconductor tool as event data, wherein the event data includes common events from the event log and alarm events from the alarm log;
[0009] The data processing module is configured to divide the event data into a plurality of event sequences, each event sequence including one or more common events and one alarm event;
[0010] The model building module is configured to build an event migration network model for the probability of occurrence of all events in the event sequence based on the occurrence time and semantic similarity of all events in the event sequence;
[0011] The model training module is configured to perform parameter training on the event migration network model based on the event data, and find a parameter set that maximizes the probability of all events occurring;
[0012] The detection and warning module is configured to calculate possible alarm events in the future and generate warnings based on the trained event migration network model and real-time data of event logs.
[0013] In a technical solution of the above-mentioned log analysis system, the data processing module includes a vectorization unit, which is configured to vectorize the text description of each event in the event data in units of words, and average all vectors corresponding to the event to obtain an event vector.
[0014] In a technical solution of the above-mentioned log analysis system, the data processing module includes an event sequence segmentation unit configured to divide the event data into a plurality of event sequences with the alarm event as a node.
[0015] In a technical solution of the above-mentioned log analysis system, a time threshold window is preset in the event sequence segmentation unit. If there are multiple alarm events within a time threshold window, only the last alarm event is retained as a node.
[0016] In a technical solution of the above-mentioned log analysis system, the model building module includes a distance unit configured to obtain a vector distance d between two event vectors to characterize the semantic similarity between the events.
[0017] In a technical solution of the above log analysis system, the model building module analyzes all events in the event sequence to generate a migration matrix A, and the element a in the migration matrix A is i,j is the migration coefficient, representing event E i After the event E j Probability of occurrence;
[0018] Based on the event E i The occurrence time t i Event E j The occurrence time t j , and event E i and event E j Vector distance d i,j , define the likelihood function f of all events in the event sequence, where the likelihood function f is a function of t and A.
[0019] In a technical solution of the above-mentioned log analysis system, the data acquisition module is configured to collect Trace data of the semiconductor machine, and obtain the occurrence time of the event based on the Trace data and / or event log, and the alarm log.
[0020] In a technical solution of the above log analysis system, the model training module searches for a transition matrix A that maximizes the probability of all events occurring based on the following optimization process:
[0021] Where C is the set of event sequences.
[0022] In a technical solution of the above-mentioned log analysis system, the model training module performs model training based on 4 / 5 of the event data, and performs model testing and verification based on 1 / 5 of the event data.
[0023] In a technical solution of the above-mentioned log analysis system, the real-time monitoring and alarm prediction module obtains the possibility of an alarm event occurring based on a trained event migration network model and real-time data of the event log, and generates an early warning when the possibility is greater than a preset threshold.
[0024] When adopting the above technical solution, by constructing a log analysis system including a data acquisition module, a data processing module, a model building module, a model training module and a detection and warning module, the purpose of early warning before an alarm event occurs can be achieved, effectively improving the operating efficiency of the equipment, reducing downtime, optimizing the production process, and reducing the occurrence of semiconductor machine failures. BRIEF DESCRIPTION OF THE DRAWINGS
[0025] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings, in which:
[0026] Figure 1 is a schematic diagram of a log analysis system according to an embodiment of the present invention. DETAILED DESCRIPTION
[0027] Some embodiments of the present application are described below with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are only used to explain the technical principles of the present application and are not intended to limit the protection scope of the present application.
[0028] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme of the embodiments of the present application will be clearly and completely described below in conjunction with the drawings of the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the described embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0029] Unless otherwise defined, the technical terms or scientific terms used in this application should be understood by people with ordinary skills in the field to which this application belongs. "First", "second" and similar words used in this application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.
[0030] The present invention provides a log analysis system. Figure 1 is a schematic diagram of a log analysis system according to an embodiment of the present invention.
[0031] like Figure 1 As shown, the system includes a data acquisition module 11, a data processing module 12, a model building module 13, a model training module 14 and a detection and early warning module 15.
[0032] The data acquisition module 11 is configured to collect event logs and alarm logs of the semiconductor machine as event data, wherein the event data includes common events from the event log and alarm events from the alarm log. Alarm events can be regarded as a special event, and therefore are processed as event data together with common events.
[0033] In one embodiment, the data collection module is configured to collect Trace data of the semiconductor machine, and obtain the occurrence time of the event based on the Trace data and / or event log, and the alarm log.
[0034] In one embodiment, the log analysis system collects trace data, event logs or alarm logs of semiconductor machines through SECS / GEM protocol and file synchronization. SECS / GEM protocol is a communication standard in the semiconductor manufacturing industry, which is used for data exchange between equipment and manufacturing execution system (MES); trace data is various variable data recorded by the equipment during operation, including time series information.
[0035] The data processing module 12 is configured to divide the event data into a number of event sequences, each of which includes one or more common events and one alarm event.
[0036] In one embodiment, the data processing module 12 includes an event sequence segmentation unit configured to divide the event data into a number of event sequences using the alarm event as a node.
[0037] We mix the event log and the alarm log in chronological order and sort them to get a series of continuous event data. Here, all alarm events are defined as important events. All these alarm events split the entire event data into several segments, each of which can be considered as multiple ordinary events. After a series of migrations, the final alarm event is finally triggered.
[0038] In order to avoid the difficulty in analyzing the causal relationship between events caused by multiple continuous alarm logs, the present invention adopts a time threshold window to simplify the alarm log.
[0039] Furthermore, a time threshold window is preset in the event sequence segmentation unit, and if there are multiple alarm events in a time threshold window, only the last alarm event is retained as a node. Those skilled in the art can set the size of the event threshold window based on actual needs.
[0040] In one embodiment, the data processing module 12 includes a vectorization unit configured to vectorize the text description of each event in the event data in units of words, and average all vectors corresponding to the event to obtain an event vector.
[0041] Exemplarily, each event log contains an ID and a text description. The present invention first converts each word in the text description into a vector by means of Word2Vec, and then averages all the vectors in the text description to obtain a vector representing the description, which is the event vector corresponding to the event. Through this vector conversion process, the Euclidean distances of the vectors corresponding to semantically similar descriptions are also relatively close.
[0042] In one embodiment, the model building module 13 is configured to build an event transition network model for the probability of occurrence of all events in the event sequence based on the occurrence time and semantic similarity of all events in the event sequence.
[0043] In one embodiment, the model building module 13 includes a distance unit configured to obtain a vector distance d between two event vectors to characterize the semantic similarity between the events. Exemplarily, the vector distance d is a Euclidean distance.
[0044] In other embodiments of the present invention, the model building module 13 may also obtain the semantic similarity of events in other ways, such as capturing the context and semantic relationship of the log text description by a model based on the attention mechanism, and evaluating the semantic similarity. If other methods are used to obtain semantic similarity, it is necessary to convert the semantic similarity between events into corresponding distance equivalents for model construction and optimization.
[0045] Furthermore, the model building module 13 analyzes all events in the event sequence to generate a migration matrix A, where the element a in the migration matrix A is i,j is the migration coefficient, representing event E i After the event E j Probability of occurrence;
[0046] Based on the event E i The occurrence time t i Event E j The occurrence time t j , and event E i and event E j Vector distance d i,j , define the likelihood function f of all events in the event sequence, where the likelihood function f is a function of t and A.
[0047] Specifically, for any event sequence (including the final alarm event):
[0048] Define f(t i |t j ; a j,i ) is event E i By event E j The likelihood of
[0049] If event E i Time of occurrence i Less than event E j Time of occurrence j , f(t i |t j ; a j,i )=0;
[0050] If event E i The time ti occurs is greater than event E j Time of occurrence j , f(t i |t j ; a j,i )=a j,i ×exp(-a j,i ×(t i -t j)×d j,i ).
[0051] This definition is used to express that the likelihood of two events transmitting is related to the time interval between the two events and the meaning of the two events. Among them, the likelihood of event transmission refers to the probability or possibility that one event triggers another event.
[0052] Therefore, event E i By E j The likelihood of causing, and not being caused by, other events is:
[0053] Among them, S(t i |t j ; α j，i )=1-F(t i |t j ; α j，i ) is event E i Not E j The likelihood that this will result.
[0054] Therefore, in a sequence of events, the likelihood of all events occurring is:
[0055] The migration matrix A is the sum of all parameters a j,i A collection of .
[0056] For the event log used for training, if it is divided into multiple sequences according to the alarm events, and this sequence set is defined as C, then the likelihood of all sequences occurring is:
[0057] In one embodiment, the model training module 14 is configured to perform parameter training on the event transition network model based on the event data, and to find a parameter set that maximizes the likelihood of all events occurring.
[0058] In one embodiment, the model training module searches for a transition matrix A that maximizes the likelihood of all events occurring based on the following optimization process:
[0059] Where C is the set of event sequences.
[0060] After the most likely transition matrix A is obtained through optimization, it is equivalent to i and E j , we all know the migration coefficient a that best fits the migration law of actual eventsj,i , and obtained a specific event migration network.
[0061] Exemplarily, the model training module performs model training based on 4 / 5 of the event data, and performs model testing and verification based on 1 / 5 of the event data.
[0062] In one embodiment, the event data used for training is historical data within a time period; in another embodiment, the log analysis system can continue to train the model and optimize parameters during use, and the event data used for training can be obtained from event logs and alarm logs obtained in real time.
[0063] In one embodiment, the detection and warning module 15 is configured to calculate possible alarm events that may occur in the future based on the trained event migration network model and real-time data of event logs, and generate warnings.
[0064] In one embodiment, the real-time monitoring and alarm prediction module obtains the possibility of an alarm event occurring based on a trained event migration network model and real-time data of an event log, and generates an alarm when the possibility is greater than a preset threshold.
[0065] For example, if E 5 It is an alarm event, and the current log records event E 2 , and a 5,2 >m, indicating event E 2 After the alarm event E occurs, 5 If it is about to happen, the log analysis system generates an early warning. Wherein m is the preset threshold, and those skilled in the art can set the preset threshold based on actual needs.
[0066] Furthermore, the log analysis system can not only identify one-step event migration, but also identify the causal chain between multiple events, so as to prevent the final alarm event in time.
[0067] For the causal chain between multiple events, different thresholds may be set between common events and common events, and between common events and alarm events.
[0068] For example, for E 1 →E 2 →E 3 The causal chain of E 1 、E 2 For a normal event, if E 3 For alarm events, the preset threshold between common events and alarm events can be preset to be greater than the preset threshold between common events and common events, such as m 2，1 =90%, m 3，2 =80%, when a 2，1 >m2，1 And a 3，2 >m 3，2 A causal chain is formed.
[0069] After the log analysis system generates an early warning, those skilled in the art may perform operations to avoid abnormal events, or may focus on subsequent possible alarm events in order to optimize machine equipment.
[0070] Based on the above technical solution, by constructing a log analysis system including a data acquisition module, a data processing module, a model building module, a model training module and a detection and early warning module, the purpose of early warning can be achieved before an alarm event occurs, effectively improving the operating efficiency of the equipment, reducing downtime, optimizing the production process, and reducing the occurrence of semiconductor machine failures.
[0071] It should be pointed out that although the various steps in the above embodiments are described in a specific order, those skilled in the art can understand that in order to achieve the effect of the present application, different steps do not have to be executed in such an order. They can be executed simultaneously (in parallel) or in other orders. These changes are within the scope of protection of the present application.
[0072] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present application, which will not be described one by one here.
[0073] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.
[0074] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.
Claims
1. A log analysis system, characterized in that: The system includes a data acquisition module, a data processing module, a model building module, a model training module and a detection and early warning module; The data collection module is configured to collect event logs and alarm logs of the semiconductor tool as event data, wherein the event data includes common events from the event log and alarm events from the alarm log; The data processing module is configured to divide the event data into a plurality of event sequences, each event sequence including one or more common events and one alarm event; The model building module is configured to build an event migration network model for the probability of occurrence of all events in the event sequence based on the occurrence time and semantic similarity of all events in the event sequence; The model training module is configured to perform parameter training on the event migration network model based on the event data to find a parameter set that maximizes the probability of all events occurring; The detection and warning module is configured to calculate possible alarm events that may occur in the future and generate warnings based on the trained event migration network model and real-time data of event logs.
2. The log analysis system according to claim 1, characterized in that: The data processing module includes a vectorization unit configured to vectorize the text description of each event in the event data in units of words, and average all vectors corresponding to the event to obtain an event vector.
3. The log analysis system according to claim 1, characterized in that: The data processing module comprises an event sequence segmentation unit configured to divide the event data into a plurality of event sequences with the alarm event as a node.
4. The log analysis system according to claim 3, characterized in that: A time threshold window is preset in the event sequence segmentation unit. If there are multiple alarm events in one time threshold window, only the last alarm event is retained as a node.
5. The log analysis system according to claim 2, characterized in that: The model building module includes a distance unit configured to obtain a vector distance d between two event vectors to characterize the semantic similarity between the events.
6. The log analysis system according to claim 5, characterized in that: The model building module analyzes all events in the event sequence to generate a migration matrix A. The element a in the migration matrix A i,j is the migration coefficient, representing event E i After the event E j Probability of occurrence; Based on the event E i The occurrence time t i Event E j The occurrence time t j , and event E i and event E j Vector distance d i,j , define the likelihood function f of all events in the event sequence, where the likelihood function f is a function of t and A.
7. The log analysis system according to claim 6, characterized in that: The data collection module is configured to collect Trace data of a semiconductor machine, and obtain the occurrence time of an event based on the Trace data and / or event log, and the alarm log.
8. The log analysis system according to claim 6, characterized in that: The model training module seeks the migration matrix A that maximizes the probability of all events occurring based on the following optimization process: Where C is the set of event sequences.
9. The log analysis system according to claim 1, characterized in that: The model training module performs model training based on 4 / 5 of the event data, and performs model testing and verification based on 1 / 5 of the event data.
10. The log analysis system according to claim 1, characterized in that: The real-time monitoring and alarm prediction module obtains the possibility of an alarm event occurring based on the trained event migration network model and the real-time data of the event log, and generates an alarm when the possibility is greater than a preset threshold.