Computer-implemented method for detecting anomalies in industrial processes

Abstract

The invention relates to a computer-implemented method for detecting anomalies in industrial processes, wherein the industrial process is carried out by an industrial system, the method comprising the following steps: - Acquiring and providing a data time series (S10) by a sensor; - Dividing the data time series into several sections (S12); - Generating a feature vector for each section (S14); - Determining an anomaly value for each section (S16) from the respective feature vector using a machine learning algorithm; and - Determining an anomaly value (S18) for the data time series by aggregating the anomaly values ​​of all sections of the data time series.

Description

The invention relates to the monitoring of industrial processes, in particular in manufacturing installations or manufacturing lines.Anomaly detection is a method of data analysis, in which specific instances or patterns are detected that do not correspond to the norm or the statistically expected behavior. The aim here is to determine, by the analysis of data, whether a data point deviates from the normal or intended pattern or behavior. For this purpose, a reference must first exist, by which it is determined which behavior can be considered normal.For abnormality detection, a wide variety of methods are used, which have in common that they can detect outliers from large amounts of data. These typically use historical data of a machine or an entire installation.There are currently two approaches to detecting anomalies in repeatable time-series data, such as is detected in the production or machining of industrial workpieces.In rule-based approaches, those skilled in the art manually set thresholds, either for the time series itself or for an extracted feature, where observations above (or below) this threshold are deemed abnormal.In tabulation, tabular features are extracted from the time series. An anomaly detection algorithm for tabular data is applied to the resulting features to detect anomalies or changes in state. Machine learning algorithms are frequently used for this purpose.However, whenever the data changes, the time-series anomaly detection algorithms must be retrained to take into account the new data. This can take place gradually, for example because the production installations deteriorate slowly or age and wear, or suddenly, for example because deteriorated production installations are replaced.There are other time-series specific approaches that deal with the detection of anomalies in non-repeatable time-series such as stock prices, weather data, etc.All these anomaly detection algorithms typically require simultaneous analysis of an entire dataset. This is often computationally intensive and does not detect any changes in the data over time.The object of the invention is thus to find an approach with which anomalies can be detected more efficiently and with fewer resources.The object is achieved by the subject matters of the independent claims.Disclosure of the InventionAccording to a first aspect of the invention, this object is achieved by a computer-implemented method for detecting anomalies in industrial processes, wherein the industrial process is executed by an industrial system, wherein the method comprises the following steps:detecting and providing a data time series by a sensor;dividing the data time series into a plurality of sections;generating a feature vector for each section;determining an anomaly value for each section from the respective feature vector using a machine learning algorithm; anddetermining an anomaly value for the data time series by aggregating the anomaly values of all sections of the data time series.An anomaly can be, in particular, a change in state in the industrial process or identify a fault or an irregularity in the industrial process. The change of state may also be intended or unintended.An industrial process may be any commercially applicable process for which at least one machine is used. A system within the scope of this invention denotes a combination of at least one machine, preferably a plurality of machines. Machines can perform all possible industrial processes. Among the industrial processes, there may be, but are not limited to, conveyance, cutting, drilling, milling, grinding, punching, casting, and injection molding, mounting, welding, painting, packaging, positioning, etc.The term "industrial system" can therefore include individual machines, such as robot arms, production lines over the full circumference, and the range between them.The data time series describes or characterizes a process parameter or a process size of the industrial process.A process parameter describes a manipulated variable or an input value for the industrial system. Manipulated variables can be all parameters of a machine or of a system which characterize the working process. During conveying, this can be, for example, the conveying speed or target coordinates; during cutting, the process parameter can be the geometry of the cut to be produced or the force of the cutting tool on the workpiece. During drilling, a process parameter could relate to the diameter and / or the depth of a borehole, but also to the torque of the drill, etc.The process parameter can, however, also be an indirect manipulated variable. In order to operate a conveyor belt, a drive unit, for example an electric motor, is generally used. The current and voltage at which such a motor is operated could also be process parameters. The same applies to all conceivable industrial systems.Overall, a process parameter can be defined as an input value for the industrial system, on which the execution of the industrial process depends. Furthermore, an industrial process may depend on a plurality of process parameters. In particular for industrial systems comprising a plurality of machines and devices, a plurality of process parameters are regularly required. A process parameter is detectable with a sensor, for example, when it is input as an input signal to the industrial system in order to control, activate, etc. the industrial process.A process variable can basically correspond to the value of a process parameter. The process variable differs from a process parameter in that it represents an initial or measured value obtained from the industrial process being carried out.If the process parameter of a conveyor belt is, for example, the conveying speed, a process variable can likewise be the conveying speed. In this case, the process parameter describes the input value, i.e. a setpoint value. However, the process variable is intended to quantify the process and therefore describes an actual value, namely how quickly the conveyor belt was actually operated. Process parameters and process variable do not always have to be the desired value and actual value of a process. If the process is, for example, repositioning a workpiece using a robot arm, the process variable can be ascertained on the basis of a position of the workpiece, while the process parameters can describe the temporal profile of the setting angles in the joints of the robot arm or current and voltage at the respective servomotors.Furthermore, a process variable can also be determined on a workpiece produced or processed using the industrial process. For example, a sensor can measure the workpiece, it then being possible to detect anomalies on the basis of the measured property of the workpiece. An example may illustrate this.The industrial process may include, for example, drilling a wellbore into a workpiece. The process parameters can be the diameter and the depth of the hole to be drilled and the material of the workpiece. The weight of the workpiece could be the process size in this case. By determining the diameter and depth, the volume of the ejection material can be determined. Each measured weight of the workpieces may then represent a data point in the time series.It is therefore noted that a process size represents a value for quantification of an industrial process that is determined. An industrial process may also be quantifiable by one or more process variables.In particular in fully automated industrial systems, monitoring the process parameters can be just as useful as monitoring the process variables.A feature vector is extracted from the data time series. The feature vector can in particular comprise information about a smoothed trajectory and statistics or otherwise designated features about the section. The features may be predefined by a user. For example, these features may include the average distance of the data time series from its smoothed trajectory, the proportion of the positive increments, the average slope, the signal-to-noise ratio, local and global minima and maxima or other statistically evaluable parameters.A "smoothed trajectory" in the context of monitoring data time series refers to a clean-up or smoothing of an original, possibly noisy or highly fluctuating data sequence. This smoothing is typically done using various mathematical techniques or algorithms to reduce short term variations or noise in the data and to make the underlying trends or patterns more visible.The smoothed trajectory may include information about how trends and the general shape of the curve, in other words, features on larger scales. Other features, on the other hand, can describe effects on smaller scales, for example smaller fluctuations, vibrations or even noise.The techniques for ascertaining a smoothed trajectory include, for example, the calculation of the rolling means. A rolling mean is a method in which a moving average (average value) is calculated for each time point in a time series over a certain predefined period of time. This means that the mean value is calculated continuously for successive periods of time, the period of time for the calculation always remaining the same while the time to which the mean value is applied moves (slides) step by step, and thus a smooth, smoothed representation of the data is generated. Rolling mean is one form of smoothing technique used to reduce short-term variations in the data and emphasize long-term trends or patterns in the data time series.Once the feature vectors are generated for each portion of the data time series, an anomaly value is determined for each portion.A machine learning algorithm is used for determining the anomaly values.A machine learning algorithm may take various forms, such as linear models, decision trees, support vector machines, neural networks, and many others. It is optimized by learning from the training data by recognizing patterns and rules to make the best possible predictions or classifications for new data.The effectiveness of a machine learning algorithm depends on various factors, including the quality and amount of training data, the choice of algorithm, the model configuration, and the evaluation of the model based on evaluation metrics. The model can be continuously improved and optimized to maximize accuracy and performance.The linear regression model assumes a linear relationship between a dependent variable and one or more independent variables and is used to make continuous value predictions.Support Vector Machines (SVM) is a model that is frequently used for classification or regression and recognizes patterns in the data. It searches for the optimal separation between different classes or tries to adapt a continuous function to the data.Decision trees are a model that creates decision rules in the form of a tree diagram. It divides the data based on features and allows predictions or classifications.A probabilistic model is Naive Bayes, which is based on the Bayes Theorem and is used for classification. It is assumed that features are independent of each other, and calculates the probability of a certain class based on the given features.Neural networks relate to models that are preferably used for processing images or other grid-based data. Preferably, a neural network is used as the machine learning algorithm for the invention.The neural network architecture includes multiple nodes, neurons, or nodes arranged in layers. A plurality of layers may also be formed as sub-networks. Sub-networks may further share one or more layers to accomplish their tasks with the same output values. Thereafter, each sub-network may have its own layers, which only serve to solve the specific task of the sub-network.The anomaly value indicates a probability that an anomaly is present in the data time series.The anomaly value can be determined, for example, by ascertaining distances of the aggregated feature vectors to classes, the classes indicating whether, and if so, which anomaly or which anomaly type is present. The classes may have been previously determined during a training process.In the determination of the distances, Euclidean or non-Euclidean distances can be used, for example.By dividing and aggregating the feature vectors of the sections downstream, only a fraction of the data points of a data time series are always processed. As a result, the resource requirement for abnormality detection can be reduced. In particular, less memory is needed because the sections are always smaller than the full data time series. The method can thus also be carried out on devices with low resources, which achieves the object of the invention. In other words, it is sufficient to compare the new time series with the aggregated classes generated in training the machine learning algorithm, instead of directly comparing them with the training data.In one embodiment, the feature vectors of the sections and / or the entries of the feature vectors are weighted differently during aggregating. The weight of the feature vectors or of the entries of the vectors was determined in particular in advance by training the machine learning algorithm.Advantageously, the precision of the detection of an anomaly can be detected by the different weighting of the feature vectors and / or the features in the feature vectors. Some features and / or portions may be more important than others for anomaly detection. For example, certain anomalies can only occur structurally after a certain time. In this case, later sections may be weighted more heavily than earlier sections.Furthermore, the weights for different classes can likewise be used for the determination of the anomaly value and a matching connected thereto with different anomaly classes.In an embodiment, the method further comprises triggering a reaction of the industrial system or portions thereof when the anomaly value indicates an anomaly.If the anomaly value exceeds or falls below a threshold value, for example, this can lead to a reaction of the industrial system being triggered. The threshold value can take into account, in particular, an error range in the detection of the data time series and / or the industrial process. If the threshold value is exceeded or below, depending on the configuration and the monitored process variable, an anomaly is present which requires a reaction of the industrial system. For example, a temperature may slowly increase or decrease beyond a certain variation, such that the industrial system may, for example, react accordingly with more or less input power.The response of the system may depend on the industrial system itself and / or the monitored data time series. An abnormality may not always mean negative development for an industrial system. Positive effects are also possible. For example, when a new machine is started and a data time series detects vibration of the machine, the vibrations may decrease with time until the machine has entered and, for example, the lubricant in its parts is sufficiently distributed for normal operation. In another case, the anomaly may indicate an expected process change or progress so that the industrial system may proceed to another phase of the industrial process.In another aspect, the invention relates to a computer-implemented method for training a machine learning algorithm for abnormality detection in industrial processes according to any one of the preceding claims, the method comprising:providing a training dataset comprising a plurality of data time series;dividing the data time series into n sections each;generating a feature vector for each section and aggregating the feature vectors;determining classes by clustering the sections;determining a loss function, wherein the loss function takes into account the precision of predicting the presence of an anomaly.The term "aggregating" refers to the process of aggregating multiple data points or values into a single dataset in data processing and analysis of data time series. This is typically done by applying a mathematical function or operation to the existing data to create a summary representation or to achieve a higher level of abstraction. The goal of aggregation is to reduce or simplify the data in order to be able to identify patterns, trends or statistics in the data more easily."Clustering" is an important operation in training a machine learning algorithm in the context of data processing, particularly in classification of events into data time series and anomaly detection.Depending on the requirements and type of data time series, different clustering algorithms can be used. Possible clustering algorithms include k-means, hierarchical clustering, density-based spatial clustering of applications with noise (DBSCAN), and many others. The selection depends on factors such as the data structure, the desired number of clusters, and the precise goals of anomaly detection.The goal is to organize similar data points into groups or clusters, with similar data points in the same cluster and different data points divided into different clusters.After the clustering process, the obtained clusters can be analyzed. This may include identifying cluster centers, calculating cluster statistics, and creating visual representations to assess the quality of clustering.In the context of anomaly detection, data points that do not fall within one of the identified clusters or are grouped into a separate "outlier" cluster may be considered potential "true" anomalies that have not been predicted. The identification of anomalies may be further based on various deviation metrics or thresholds.The entirety of the clustered feature vectors and features may be used to associate each data time series with a class of anomalies. Preferably, all data time series are labeled with respect to the class of anomaly. By a corresponding backpropagation, the machine learning algorithm can be adapted, so that the machine learning algorithm can be optimized with regard to the correct prediction of the anomaly. For optimization, a loss function is determined which reflects the quality of the machine learning algorithm.In one embodiment, training the machine learning algorithm further comprises the steps of:providing further data time series that are not part of the training data set;dividing the further data time series into n sections;generating a feature vector for each portion of the further data time series;determining further classes by clustering the sections of the further data time series;determining a weight for each class;deleting the classes whose weight falls below a threshold value.If the machine learning algorithm learns with unseen data, the method for online anomaly detection can be used.Online anomaly detection offers the advantage that the method can be applied to new industrial processes independently of the model. In this case, the training method may be faced with new classes and / or clusters which have to be detected or taken into account in the abnormality prediction. In addition, it is determined whether further classes are present. Preferably, during clustering it is also monitored whether further clusters are present.If new classes and / or clusters are present, old or known classes or clusters can optionally be removed or deleted from the machine learning algorithm. Over time, the machine learning algorithm can thus adapt to new data time series, new processes or changed boundary conditions such as increasing wear or aging of the industrial system.In a further aspect, the invention relates to a computer program having program code for carrying out a method as described above when the computer program is executed on a computer.In a further aspect, the invention relates to a computer-readable data carrier having program code of a computer program for carrying out a method as described above when the computer program is executed on a computer.In a further aspect, the invention relates to a system for detecting anomalies in industrial processes, wherein the system is designed to carry out a method as described above.In a further aspect, the invention relates to a production line for producing a workpiece, wherein the workpiece is produced using an industrial process, wherein the production line is designed to monitor the industrial process using the method as described above.In a further aspect, the invention relates to a workpiece which has been produced with a production line as described above, wherein the production line produces the workpiece using a computer-implemented method as described above.In summary, the present invention provides a method for detecting anomalies in industrial processes, a method for training a machine learning algorithm, a system for executing the aforementioned methods, a computer program and a computer-readable data carrier, a production line and a workpiece.The described embodiments and developments can be combined with one another as desired.Further possible embodiments, developments and implementations of the invention also include combinations of features of the invention described above or below with respect to the exemplary embodiments, which combinations are not explicitly mentioned.Brief Description of the DrawingsThe accompanying drawings are intended to provide a further understanding of the embodiments of the invention. They illustrate embodiments and, in conjunction with the description, serve to explain principles and concepts of the invention.Other embodiments and many of the advantages mentioned are evident with reference to the drawings. The elements of the drawings shown are not necessarily shown true to scale with respect to one another.The following are shown: FIG. 1 schematically illustrates the flow of the method for detecting anomalies according to an embodiment; and FIG. 2 schematically illustrates the flow of a method for training a machine learning algorithm according to an embodiment.In the figures of the drawings, identical reference numerals designate identical or functionally identical elements, components or components, unless indicated to the contrary.FIG. 1 schematically shows the sequence of a method for detecting anomalies in industrial processes.In a first step S 10, a plurality of data time series are detected and provided. The data time series can be recorded, for example, using a sensor or a measuring device. Furthermore, the acquisition of the data time series can comprise a plurality of sensors and / or measuring devices, wherein a data time series is then determined from the measured data, for example by calculation, averaging or the like.Each acquired data time series is divided into a plurality of sections in step S 12. The number of sections can be adjusted to the type of industrial process and / or the type of data time series. For example, the data time series may be divided into 5, 8, 10, or more sections. The more sections are created, the lower the resource consumption during processing of the data time series or the sections. This is because the more segments are created, the fewer data points a segment contains. In contrast, a section must contain so many data points that classification or detection of an anomaly is still possible. The number of sections must therefore not be too high.In the next step S 14, feature vectors are generated for each section. The feature vectors may include analytically or stochastically detectable features of each section such as the mean, standard deviation, slope, integral, or other parameters. The features are suitable for detecting an abnormality that may be present therefrom.In step S 16, all feature vectors are used to generate an anomaly value for each section. For this purpose, in particular a machine learning algorithm is used. The sections and / or the features of the sections can be weighted to different extents in order to determine the anomaly values. For example, in sections at the beginning of the data time series, the slope may be weighted more heavily than the mean of the data time series in the corresponding section. In later sections, i.e. sections that are located more at the end of the data time series, the ratio can be reversed.Furthermore, sections may also be rather unsuitable for classification, so that these sections are less weighted overall. Other sections in which an anomaly is easier to detect or in which an anomaly is possibly even expected can be weighted more strongly.How strong the weights are formed is determined by training the machine learning algorithm.In step S 18, an abnormality value is obtained from the abnormality values of the individual sections. This can be done, for example, by determining a distance from the classes of the recognizable anomalies for the feature vectors. The distance may be Euclidean or non-Euclidean.The shortest distance determines which class the data time series is assigned to. By comparing with other distances, a probability for the classification into the corresponding class can also be determined.Alternatively, the assignment to a class can be effected, for example, via a decision tree. Individual features and / or feature groups are examined for the exceeding or falling below threshold values, depending on the examined parameter. If a feature or a feature group satisfies a prerequisite, the next feature or the next feature group is checked. This occurs until the data time series can be assigned to a class of anomalies.In addition to the classes for the possible anomalies, two classes can be used in particular during the assignment, of which one class is not assigned to an anomaly and the other is an impossible classification. A data time series can be classified as "non-classifiable", for example, if the distances to the other classes are the same or differ only slightly from one another.The anomaly value is therefore synonymous with an assignment to the presence of a class of anomalies, of which not every class actually needs to be assigned to an anomaly.FIG. 2 schematically shows the sequence of training a machine learning algorithm.In step S 20, a training data set is provided that comprises a plurality of labeled data time series. The labels indicate which anomaly is present in the respective data time series or whether an anomaly is present in the data time series.Each data time series is divided into an equal number n of sections in step S22. For each of the sections, a feature vector S 24 including the most important characteristics for abnormality examination is generated. The feature vectors of the portions of each data time series are aggregated in step S 26. A machine learning algorithm is used for this purpose. Preferably, the machine learning algorithm is an algorithm that is particularly suitable for classification tasks. This can be, for example, a support vector machine or a decision tree.In step S28, classes are determined by clustering. In this case, the aggregated feature vectors are compared with the labels. In some dimensions, groups will form in the parameter space, which can be used for the classification. The features of these same dimensions can be used particularly well for classification.Finally, in step S 30, a loss function is determined and the machine learning algorithm is adapted according to the loss function. This may include, in particular, adjusting the weights for aggregating the feature vectors for steps S 14 (FIG. 1 ) or S 26.If the loss function has reached a sufficiently low value, the machine learning algorithm is considered trained. The required value for the loss function can be defined by a user. It directly corresponds to the accuracy with which anomalies in the data time series can be detected.

Claims

A computer-implemented method for detecting anomalies in industrial processes, the industrial process being executed by an industrial system, the method comprising the steps of: - detecting and providing a data time series (S10) by a sensor; - dividing the data time series into a plurality of sections (S12); - generating a feature vector for each section (S14); - determining an anomaly value for each section (S16) from the respective feature vector using a machine learning algorithm; and - determining an anomaly value (S18) for the data time series by aggregating the anomaly values of all sections of the data time series.The computer-implemented method of claim 1, wherein the feature vectors of the sections or the features included in the feature vectors are weighted differently for aggregation.The computer-implemented method of any preceding claim, wherein the method further comprises triggering a response of the industrial system or portions thereof when the anomaly value indicates an anomaly.A computer-implemented method for training a machine learning algorithm for abnormality detection in industrial processes according to any one of the preceding claims, the method comprising: - providing a training dataset (S20) comprising a plurality of data time series; - dividing the data time series into n sections (S22) respectively; - generating a feature vector for each section (S24), and aggregating the feature vectors (S26) using the machine learning algorithm; - determining classes by clustering the sections (S28) using the machine learning algorithm; determining a loss function and adjusting the machine learning algorithm (S30) according to the loss function, the loss function taking into account the precision of predicting the presence of an abnormality.The computer-implemented method of claim 4, wherein training the machine learning algorithm further comprises: - providing further data timelines that are not part of the training dataset; - dividing the further data timelines into n sections; - generating a feature vector for each section of the further data timelines; - determining further classes by clustering the sections of the further data timelines; - determining a weight for each class; - deleting the classes whose weight falls below a threshold value.A computer program comprising program code for carrying out a method according to any one of claims 1 to 3 when said computer program is executed on a computer.Computer-readable data medium with program code of a computer program for carrying out a method according to one of Claims 1 to 3 when the computer program is executed on a computer.A system for detecting anomalies in industrial processes, the system being configured to carry out a method according to any one of claims 1 to 3.A manufacturing line for manufacturing a workpiece, wherein the workpiece is manufactured using an industrial process, wherein the manufacturing line is configured to monitor the industrial process with the method according to any one of claims 1 to 3.A workpiece produced with a production line according to claim 9, wherein the production line produces the workpiece using a computer-implemented method according to any one of claims 1 to 3.

Images