Detection of anomalies in a technical system through monitoring with multiple sensors

Abstract

Method (100) for detecting anomalies in a technical system (1) whose behavior is monitored by an arrangement of n sensors, comprising the steps: • for each sensor k = 1, ...,n, a time series Rkt of N observations of this sensor is recorded for time points t = 1, ..., N (110); • for each time point t = 1, ..., N, as well as for the indices i = 1, ..., n and j = 1, ...,n, a characteristic Ki,jt, which characterizes a pairwise conditional probability distribution PD(i | j) of observations of sensors i and j, is determined (120); • a tensor K* of all characteristic Ki,jt is mapped by a trained machine learning model (2) to a classification (3) to determine whether the behavior of the technical system (1) is normal or abnormal (130).

Description

The present invention relates to the sensory monitoring of technical systems for detecting known and also unknown anomalies.Prior ArtComplex technical systems, such as vehicles or industrial plants, are monitored by a plurality of sensors to detect anomalies in operation. In this case, it tends to be difficult to distinguish anomalies in the monitored technical system from the unavoidable disturbances in the sensory monitoring. Thus, the measurement signals detected by the sensors are frequently subject to noise, and their transmission via a network can be time-delayed. Also, as the number of sensors increases, it becomes more likely that the function of individual sensors is disturbed. In order to recognize anomalies on the basis of specific rules and to mask out the stated influences in this case, the measurement data would have to be smoothed very strongly, with very much information being lost.US 2021 / 0 182 693 A1 discloses a method for detecting anomalies in a physical system based on a set of physical rules and a process graph.US 2021 / 0 349 772 A1 discloses a method for predicting gradual performance degradations with non-linear characteristics.US 2022 / 0 018 731 A1 discloses an apparatus and a method for detecting and mitigation of oscillating in systems with turbulent behaviour.US 2017 / 0 140 244 A1 discloses a method and apparatus for visually analyzing a plurality of sensor data using machine learning.Disclosure of the InventionThe invention provides a method for detecting anomalies in a technical system whose behavior is monitored by an arrangement of n sensors.Within the scope of the method, a time series of N observations of this sensor for points in time t=1,..., N is recorded for each sensor k=1,..., n. For each time t=1,..., N and for the indices i=1,..., n and j=1,..., n, a characteristic variable is determined which characterizes a probability distribution P D( i|j) of observations of the sensors i and j, which probability distribution is caused in pairs. P D( i | j) thus describes probabilities that sensor i delivers specific observations starting from a given situation in which sensor j delivers a specific observation. For example, as the average value of a distribution of observations of the sensor i can be determined for all time steps at which the observation of the sensor j has the same value as in time step t. Since the observations are real valued, no two observations may be exactly the same, so that the requirement of the "same value" can be softened, in particular, for example, to "in an interval of ±ε around the value in time step t". Alternatively or in combination therewith, the characteristic variable can also relate to any other desired properties of the probability distribution P D( i | j) conditional in pairs and can comprise, for example, a characteristic variable of the descriptive statistics of P D( i | j), such as a standard deviation if P D( i | j) is a Gaussian distribution. The distribution P D( i | j) can also be determined or approximated in any other desired manner, and the characteristic variable can then be determined from this.A tensor K* of all characteristic variables is thus a "fingerprint" of the behavior of the technical system, which records the inherent correlations between the individual sensor modalities.Precisely this "fingerprint" K* is mapped by a trained machine learning model onto a classification as to whether the behavior of the technical system is normal or abnormal. This classification can have any form. It may be binary, for example, or may include one or more real valued scores relating to certain aspects of operation.It has been recognized that the physical configuration of many technical systems defines physical interactions between the measured variables detected by different sensors and thus causes temporal correlations between these measured variables. If, for example, a flow of a fluid medium is registered at one end of a pipeline, this is correlated with a changed temperature being registered at the other end of the pipeline a little later. The presence of such a correlation can then be evaluated as a signal for whether the technical system is functioning normally. For example, if the tubing is leaked or torn off and the medium flowing through at one end does not arrive at the other end, but instead pours into the factory hall, the correlation of the changed temperature with the flow is suddenly lacking.Therefore, at least two sensors for measured variables are advantageously selected, between which the physical configuration of the technical system in the nominal state of this system mediates a physical interaction.The one measured variable can be, in particular, for example, a measure for an amount of energy supplied to the technical system or present therein, and the other measured variable can then be a measure for the amount of energy present or an energy output by the technical system. In the example mentioned with the pipeline, a warm fluid supplied at one end of the pipeline introduces energy into the pipeline, and when the pipeline is thereby heated, it again radiates energy. An increased motor current of an electric machine will also manifest itself, for example, in an increased amplitude of vibrations of this machine. Since the energy is a physical conservation variable, in many technical systems there are temporal correlations between measurement values that deliver different sensors. These correlations do not have to be explicitly analyzed and formulated in order to monitor the technical system for normal function with them. It is sufficient that the correlations in normal operation are simply physically present, so that they can be learned by the machine learning model.In a further advantageous embodiment, at least two further sensors are selected for further measurement variables, between which the physical configuration of the technical system excludes a physical interaction in the nominal state of this system. Thus, for example, pressures in regions or containers that are not connected to one another should not be correlated with one another. However, if such a correlation exists, this can indicate that there is an undesired leak between the regions or containers.Therefore, in particular, for example, the further sensors can be arranged on different sides of a barrier which prevents the physical interaction between the further measurement variables in the nominal state of the technical system.The machine learning module can in particular learn, for example, the normal behavior of the technical system and then classify everything which is "otherwise" as an anomaly, namely even if the anomaly relates only to a small signal component of one or more measurement signals detected with the sensors. This is far analogous to the fact that a break-in detection system does not trigger an alarm when the legal house occupant strikes a nail into the wall with a hammer, while at the same time he recognizes the working noises caused by manual processing of the door lock with locking tools as a break-in attempt and triggers an alarm.The technical system can be, in particular, for example a vehicle or an industrial plant which processes one or more educts by one or more processing steps to form one or more products. Both in vehicles and in industrial plants, a multiplicity of measurement values is currently already detected by sensors and can be better evaluated with regard to possible anomalies using the method proposed here. In particular, a vehicle provides a plurality of correlations over its body, in and on which the sensors are distributed in a comparatively narrow space, which correlations can be used for detecting anomalies. In an industrial plant, such correlations are mediated, for example, by material flows of educts and / or products through the plant. Control units in vehicles, and "plant historians" in industrial plants, additionally automatically log a large number of measured values. These protocols may be used, for example, to obtain labeled training data for both the normal state and the abnormal state, in conjunction with knowing that there have been anomalies or not at any particular time. The machine learning model can be trained with these labeled training data in a monitored manner. For example, probability distributions P D( i | j) caused in pairs can be determined and / or approximated using training data. How far a machine learning model can look into the past is determined by the selected architectural parameters, such as the widths of filter cores in convolutional layers.In a further advantageous embodiment, a control signal is formed from the classification supplied by the machine learning model. The technical system is controlled with this control signal. For example, in response to an anomaly being detected in a vehicle, the maximum speed may be reduced, execution of certain risky driving maneuvers (such as overtaking maneuvers) may be prohibited, or the vehicle may be stopped on a pre-scheduled emergency stop trajectory. An industrial plant can be switched, for example, into a safe mode in which the throughput of the plant is reduced to a minimum. In this secured mode, the installation can then also be driven manually, for example in the event of a failure of the automatic control.As mentioned above, the machine learning model may be trained with labeled training examples of tensors K*. However, specially labeled training examples for anomalies are often tight, since the technical systems usually operate so well that anomalies are rare.Therefore, the invention provides a method for training a machine learning model for use in the method described above, which makes do with only a few labeled training examples.Within the scope of this method, training examples for tensors K* of characteristic variables characterizing pairwise probability distributions P D( i | j) of observations of sensors i and j are provided. For these training examples it does not yet have to be known whether they relate to normal or abnormal behaviour of the technical system.A distribution of disturbances p is provided, which is known to modify a tensor K* only in a manner as can also be done during normal operation of the technical system.An example of such disturbances p is additive normally distributed noise, as can also be included in the observations provided by the sensors.Further examples are stochastic zeroing of non-diagonal elements of the tensor K*, replacement of elements on the level t by elements on the levels t+1 or t-1, and / or interchanging of levels t, t' of the tensor K*. These disturbances simulate errors which can occur during the sensory detection and the transmission of the measurement data via a network. Thus, a mixing of elements at level t with elements at levels t+1 or t-1 can be caused, for example, by inaccurate time synchronization between sensors. Poor time synchronization or problems in the transmission of the measurement data via a network can lead, for example, to the interchange of levels t, t'. Sporadic sensor errors can manifest themselves, for example, in missing non-diagonal elements in tensor K*.With the disturbances p, so-called positive and negative pairs can be created for the process of contrasting learning. Contrasting learning is self-supervised learning using positive and negative examples that are known to be similar to each other.Positive pairs of variations are generated by applying two disturbances p 1 and p 2 sampled from the distribution to one and the same training example K*. The modifications in these pairs therefore only differ with regard to faults, as also occur during normal operation of the technical system and the sensory monitoring. Therefore, the machine learning model should recognize these modifications as being similar to each other.Negative pairs of modifications are generated by applying two disturbances p 1 and p 2 sampled from the distribution to two different training examples K*' and K*". The modifications in these pairs thus differ not only from the usual disturbances mentioned, but they are modifications of two completely different examples. Therefore, the machine learning model should recognize these modifications as being dissimilar to each other.In order to train the machine learning model exactly on this, the machine learning model to be trained is used to generate processing products from the modifications and in each case. This does not yet have to be the respective final output of the machine learning model, which reveals the classification with respect to the normal or abnormal state. Rather, the machine learning model can comprise, for example, a feature extractor which extracts features from the tensor K*, and a classification header which maps these features to the sought classification of the behavior of the technical system. The feature extractor may in particular comprise, for example, a sequence of a plurality of convolutional layers which convert their respective input into a dimensionally reduced feature map by applying one or more filter kernels. The processing products may then be formed by the feature extractor.In the context of contrasting learning, parameters characterizing the behavior of the machine learning model are now optimized with the aim that• A similarity of processing products relating to positive pairs is maximized, and• Similarity of processing products relating to negative pairs is minimized.That is, the feature extractor of the machine learning model is trained to place processing products and those that are due to positive pairs close to each other in the latent space of its output. At the same time, it is trained to place processing products that are due to negative pairs far away from one another in this latent space. Thus, the processing product may correspond to a point z i in the latent space and the processing product to the same positive pair may correspond to a point z j in the latent space. An example cost function that measures whether the points z i and z j are close to each other is the normalized temperature-scaled cross entropy (NT-Xent loss): wherein the function ψ measures the similarity and τ is a temperature parameter. The temperature parameter τ can be varied in particular, for example, according to an "annealing plan" as a function of the epoch number.The machine learning model can therefore self-monitor a major part of its training in this manner without the need to use labeled training examples for this purpose.The classification head can then be trained in a monitored manner, for example, with training examples K* labeled with desired classifications. Since the classification head makes up only a small proportion of the machine learning model, in particular with respect to the number of parameters to be optimized, a comparatively small number of labeled training examples is sufficient for this training. In this context, it is also particularly advantageous for the classification head to receive as input a processing product that has already been well presorted as a result of the self-supervised training. The classification header therefore does not have to direct something which has been previously missed by increased training expenditure.The invention provides yet another method for training a machine learning method for use in the method described at the beginning. Unlike the contrast learning described above, this method uses normal supervised training.Within the scope of this method, training examples for tensors K* of characteristic variables are provided which characterize probability distributions P D( i | j) of observations of the sensors i and j, which probability distributions are conditional in pairs. These training examples K* relate to a normal behavior of the technical system.A distribution of disturbances p* is now provided, which is known to modify a tensor K* in a manner which is not to be expected in the normal operation of the technical system. An example of such disturbances is uniformly distributed noise.By applying disturbances p* sampled from the distribution to training examples K*, variations K≅* are generated. The machine learning model is trained monitored with the training examples K* for a normal behavior of the technical system on the one hand and with the modifications K≅* as training examples for an abnormal behavior of the technical system on the other hand.With this method, the machine learning model can be trained directly on the desired classification task in one stage, provided that an appropriate distribution of disturbances p* is available for the respective application. If, on the other hand, such a distribution of disturbances p* is not available or difficult to model, the previously described approach via contrasting learning can be used. An important advantage of contrasting learning is that it does not rely on modelling of the disturbances p*.Optionally, within the scope of this method, the training examples K* can be augmented to further modifications by applying the disturbances p discussed in connection with the contrasting learning, which can then be used within the scope of the monitored learning as further training examples for normal behavior.Further measures which improve the invention are described in more detail below together with the description of the preferred exemplary embodiments of the invention on the basis of figures.Exemplary EmbodimentsIt shows: FIG. 1 shows an exemplary embodiment of the method 100 for detecting anomalies in a technical system 1; FIG. 2 shows an illustration of a tensor K* of characteristic variables FIG. 3 shows an exemplary embodiment of the method 200 for training a machine learning model 2; FIG. 4 shows an exemplary embodiment of the method 300 for training a machine learning model 2.FIG. 1 is a schematic flow diagram of an embodiment of the method 100 for detecting anomalies in a technical system 1.In step 110, a time series of N observations of this sensor for points in time t=1,..., N is recorded for each sensor k=1,..., n.In this case, according to block 111, at least two sensors for measurement variables can be selected, between which the physical configuration of the technical system 1 in the nominal state of this system 1 mediates a physical interaction. According to block 111 a, at least two further sensors for further measured variables can then optionally also be selected, between which the physical configuration of the technical system 1 excludes a physical interaction in the nominal state of this system 1.In step 120, for each time t=1,..., N and for the indices i=1,..., n and j=1,..., n characteristic variables, the probability distributions P D( i|j) of observations of the sensors i and j, which probability distributions are caused in pairs, are determined (120).In step 130, a tensor K* of all characteristic variables is mapped from a trained machine learning model 2 to the sought classification 3 to determine whether the behavior of the technical system 1 is normal or abnormal.In step 140, a control signal 4 is formed from the classification 3 supplied by the machine learning model 2.In step 150, the technical system 1 is controlled with the control signal 4.FIG. 2 illustrates the formation of the tensor K* using a simple example with three time-dependent observations x(t), y(t) and z(t). For each time t, assuming that one of the three values x(t), y(t) and z(t) is given, conditional probabilities can be given for the values of all variables (t), y(t) and z(t). Characteristics characterizing the distributions of these pairwise probabilities are collated in a two-dimensional matrix. All such matrices for all times t together form the tensor K*.FIG. 3 is a schematic flow diagram of an embodiment of the method 200 for training a machine learning model 2 for use in the method 100 described in connection with FIG. 1. The method 200 is based on contrasting learning.In step 210, training examples for tensors K* of characteristic variables characterizing pairwise probability distributions P D( i | j) of observations of sensors i and j are provided.In step 220, a distribution of disturbances p is provided, which is known to modify a tensor K* only in a manner that can also take place during normal operation of the technical system.In step 230, positive pairs of modifications are generated and by applying two interference sampled from the distribution p 1 and p 2 to one and the same training example K*. These modifications thus differ only by disturbances p, which also occur during normal behavior of the technical system 1 and the sensory data acquisition.In step 240, negative pairs of variations are generated by applying two sampled disturbance distribution p 1 and p 2 to two different training examples K*' and K*". These modifications thus differ by more than only "normal" disturbances p.In step 250, the machine learning model ( 2) to be trained is used to generate processing products from the modifications.According to block 251, the machine learning model 2 may include a feature extractor 21 that extracts features from the tensor K*, and a classification header 22 that maps these features to the sought classification of the behavior of the technical system.In step 260, parameters 2 athat characterize the behavior of the machine learning model 2 are optimized with the aim of maximum similarity between at the same time minimum similarity between These parameters can be in particular the parameters 21 aof the feature extractor 21. The completely optimized state of the parameters 2 a, 21 ais denoted by the reference symbol 2 a*, 21 a*.In step 270, the classification head 22 is trained monitored with training examples K* labeled with target classifications. That is, the parameters 22 athat characterize the behavior of the classification head 22 are optimized with the aim that the training examples K* are mapped by the machine learning model 2 to the respective desired classifications. The completely optimized state of these parameters is denoted by the reference sign 22 a*.FIG. 4 is a schematic flow diagram of an embodiment of the method 300 for training a machine learning model 2 for use in the method 100 described in connection with FIG. 1. In contrast to method 200, this method is based on monitored training.In step 310, training examples for tensors K* of characteristic variables characterizing pairwise probability distributions P D( i | j) of observations of sensors i and j are provided. These training examples K* relate to a normal behavior of the technical system 1.In step 320, a distribution of disturbances p* is provided, which is known to modify a tensor K* in a manner not to be expected in the normal operation of the technical system.In step 330, by applying disturbances p* sampled from the distribution to training examples K*, modifications K≅* are generated.In step 340, the machine learning model 2 is trained monitored with the training examples K* for a normal behavior of the technical system 1 on the one hand and with the modifications K≅* as training examples for an abnormal behavior of the technical system 1 on the other hand. That is, the parameters 2 athat characterize the behavior of the machine learning model 2 are directly optimized with the aim that the training examples K* are mapped to a classification as normal and the modifications K≅* are mapped to a classification as abnormal.

Claims

Method (100) for detecting anomalies in a technical system (1) whose behavior is monitored by an arrangement of n sensors, having the steps: • for each sensor k = 1,..., n, a time series R k t of N observations of this sensor for points in time t = 1,..., N is detected (110); • for each point in time t = 1,..., N and for the indices i = 1,..., n and j = 1,..., n, a characteristic variable K i, j t, which characterizes a probability distribution P D( i | j) of observations of the sensors i and j, caused in pairs, is determined (120); • a tensor K* of all characteristic variables K i, j t is mapped (130) by a trained machine learning model (2) to a classification (3) as to whether the behavior of the technical system (1) is normal or abnormal.Method (100) according to Claim 1, wherein at least two measured variable sensors are selected (111), between which the physical configuration of the technical system (1) in the nominal state of this system (1) mediates a physical interaction.Method (100) according to Claim 2, wherein the one measured variable is a measure of an amount of energy supplied to the technical system or present therein, and wherein the other measured variable is a measure of the amount of energy present or an amount of energy output by the technical system.Method (100) according to one of Claims 2 to 3, wherein at least two further sensors are selected (111a) for further measurement variables, between which the physical configuration of the technical system (1) excludes a physical interaction in the nominal state of this system (1).Method (100) according to Claim 4, wherein the further sensors are arranged on different sides of a barrier which suppresses the physical interaction between the further measurement variables in the nominal state of the technical system (1).Method (100) according to one of Claims 1 to 5, wherein a vehicle or an industrial plant which processes one or more educts by one or more processing steps to form one or more products is selected as the technical system (1).Method (100) according to one of Claims 1 to 6, wherein • a control signal (4) is formed (140) from the classification (3) supplied by the machine learning model (2), and • the technical system (1) is controlled (150) with the control signal (4).Method (200) for training a machine learning model (2) for use in the method (100) according to one of Claims 1 to 7, having the steps: • training examples for tensors K* of characteristic variables K i, j t, which characterize probability distributions P D( i | j) of observations of the sensors i and j on account of pairs, are provided (210); • a distribution of disturbances p is provided (220) which is known to modify a tensor K* only in a manner which can also take place during normal operation of the technical system; • Positive pairs (K p 1 molar, K p 2 molar) of variants K p 1 molar and K p 2 molar are generated (230) by applying two disturbances p 1 and p 2 sampled from the distribution to one and the same training example K*; • Negative pairs (K p 1 ≥', K p 2 ≥") of variants K p 1 ≥' and K p 2 ≥", are created by applying two K*' and K*" training examples, which are amplified from the distribution of sampled disturbances p 1 and p 2 (240); • With the machine learning model (2) to be trained, processing products V (K p 1 ≥), V (K p 1 ≥") and V (K p 2 ≥") are generated (250) respectively from the modifications K p 1 molar, K p 2 molar, K p 2 molar, K p 1 molar") and V (K p 2 molar") ; • Parameters (2a) characterizing the behaviour of the machine learning model (2) are optimized (260) with the aim of maximizing o a similarity of processing products V (K p 1 ≥) and V (K p 2 ≥), which relates to positive pairs (K p 1 ≥, K p 2 ≥) and minimizing o a similarity of processing products V (K p 1 ≥") and V (K p 2 ≥"), which relates to negative pairs (K p 1 ≥", K p 2 ≥") .The method (200) according to claim 8, wherein • the machine learning model (2) comprises (251) a feature extractor (21) extracting features from the tensor K* and a classification header (22) mapping these features to the sought classification of the behavior of the technical system, and • the processing products V ( K p 1 molar ), V ( K p 2 molar ), V ( K p 1 molar ') and V ( K p 2 molar ') are formed (252) by the feature extractor (21).The method (200) of claim 9, wherein the classification header (22) is trained (270) monitored with training examples K* labeled with target classifications.Method (200) according to one of claims 8 to 10, wherein the disturbances p • comprise additive normally distributed noise, and / or • stochastic zeroing of non-diagonal elements of the tensor K*, and / or • replacement of elements K i, j t at the level t by elements K i, j t + 1, K i, j t - 1 at the levels t + 1 and t - 1, respectively, and / or • swapping of levels t, t' of the tensor K*.Method (300) for training a machine learning model (2) for use in the method (100) according to one of Claims 1 to 7, having the steps: • training examples for tensors K* of characteristic variables K i, j t which characterize probability distributions P D( i | j) of observations of the sensors i and j, conditional in pairs, are provided (310), these training examples K* relating to a normal behavior of the technical system (1); • a distribution of disturbances p* is provided (320) which is known to modify a tensor K* in a manner which is not to be expected in the normal operation of the technical system; • By applying disturbances p* sampled from the distribution to training examples K*, modifications K≅* are generated (330); • The machine learning model (2) is trained (340) with the training examples K* for a normal behavior of the technical system (1) on the one hand and with the modifications K≅* as training examples for an abnormal behavior of the technical system (1) on the other hand.A computer program comprising machine readable instructions which, when executed on one or more computers and / or compute instances, cause the computer or compute instances to perform a method (100) according to any of claims 1 to 12.Machine-readable data carrier and / or download product comprising the computer program according to Claim 13.One or more computers and / or compute instances comprising the computer program of claim 13, and / or comprising the machine readable medium and / or download product of claim 14.

Images