Detection of anomalies in a technical system by way of monitoring using a plurality of sensors

Abstract

Method (100) for detecting anomalies in a technical system (1), the behaviour of which is monitored by an arrangement comprising n sensors, having the following steps: • for each sensor k = 1, ..., n, a time series of N observations of this sensor for times t = 1, ..., N is recorded (110); • for each time t = 1, ..., N and for the indices i = 1, ..., n and j = 1, ..., n, characteristic variables Kj*, which characterize paired probability distributions PD(i \ j) of observations of the sensors i and j, are determined (120); a tensor K* of all characteristic variables K^j is mapped (130) by a trained machine learning model (2) to a classification (3) as to whether the behaviour of the technical system (1) is normal or abnormal.

Description

[0001] Description

[0002] Title:

[0003] Detection of anomalies in a technical system through monitoring with multiple sensors

[0004] The present invention relates to the sensory monitoring of technical systems for the detection of known and unknown anomalies.

[0005] State of the art

[0006] Complex technical systems, such as vehicles or industrial plants, are monitored by a multitude of sensors to detect operational anomalies. It tends to be difficult to distinguish anomalies in the monitored technical system from the inevitable disturbances caused by sensor monitoring. The measurement signals acquired by the sensors are often noisy, and their transmission over a network can be delayed. Furthermore, as the number of sensors increases, it becomes increasingly likely that individual sensors will malfunction. To detect anomalies based on specific rules and thereby eliminate these influences, the measurement data would have to be significantly smoothed, which would result in a significant loss of information.

[0007] Disclosure of the invention

[0008] The invention provides a method for detecting anomalies in a technical system whose behavior is monitored by an array of n sensors. Within the framework of the method, for each sensor k = 1, ...,n, a time series of N observations of this sensor for times t = 1, ..., N are recorded. For each time t = 1, ... , N as well as for the indices i = 1, ... , n and j = 1, ... , n, a parameter KP is determined, which is a pairwise conditional probability distribution P D (i | j) characterized by observations from sensors i and j P D(i | j) describes, based on a given situation in which sensor j provides a specific observation, probabilities that sensor i provides certain specific observations. For example, KP can be determined as the mean of a distribution of observations from sensor i for all time steps at which the observation from sensor j has the same value as in time t. Since the observations are real-valued, no two observations may be exactly the same, so that the requirement of the “same value” can be softened, for example, to “in an interval of ± ε around the value in time t”. Alternatively or in combination with this, the parameter can also refer to any other properties of the pairwise conditional probability distribution P D (i | j) and, for example, a descriptive statistic of P D(i | j), such as a standard deviation when P D (i | j) is a Gaussian distribution. The distribution P D (i | j) can also be determined or approximated in any other way, and from this the parameter KP can then be determined.

[0009] A tensor K* of all parameters KP is thus a “fingerprint” of the behavior of the technical system, which captures the inherent correlations between the individual sensor modalities.

[0010] This "fingerprint" K* is mapped by a trained machine learning model into a classification that determines whether the behavior of the technical system is normal or abnormal. This classification can take any form. For example, it can be binary or contain one or more real-valued scores related to specific aspects of operation.

[0011] It has been recognized that the physical configuration of many technical systems defines physical interactions between the measured variables recorded by different sensors and thus gives rise to temporal correlations between these measured variables. For example, if the flow of a fluid medium is registered at one end of a pipeline, this is correlated with the fact that a changed temperature is registered a short time later at the other end of the pipeline. The presence of such a correlation can then be interpreted as a signal indicating whether the technical system is functioning normally. If, for example, the pipeline leaks or breaks and the medium flowing through at one end does not reach the other end but instead pours into the factory hall, the correlation between the changed temperature and the flow is suddenly missing.

[0012] Therefore, it is advantageous to select at least two sensors for measured variables between which the physical configuration of the technical system in the nominal state of this system mediates a physical interaction.

[0013] In particular, one measured variable can, for example, be a measure of the amount of energy supplied to or present in the technical system, and the other measured variable can then be a measure of the amount of energy present or the energy released by the technical system. In the above example with the pipeline, a warm fluid supplied to one end of the pipeline introduces energy into the pipeline, and when the pipeline is heated as a result, it in turn radiates energy. Also, for example, an increased motor current of an electrical machine will manifest itself in an increased amplitude of vibrations of this machine. Since energy is a physically conserved quantity, in many technical systems there are temporal correlations between measured values ​​provided by different sensors. These correlations do not have to be explicitly analyzed and formulated in order to use them to monitor the technical system for normal function.It is sufficient that the correlations are simply physically present during normal operation so that they can be learned by the machine learning model.

[0014] In a further advantageous embodiment, at least two additional sensors are selected for additional measured variables, between which the physical configuration of the technical system in its nominal state precludes any physical interaction. For example, pressures in unconnected areas or containers should not be correlated. However, if such a correlation does exist, this may indicate an undesirable leak between the areas or containers.

[0015] Therefore, in particular, the additional sensors can be arranged on different sides of a barrier, which prevents the physical interaction between the additional measured variables in the nominal state of the technical system.

[0016] In particular, the machine learning module can, for example, learn the normal behavior of the technical system and then classify anything that is "somehow different" as an anomaly, even if the anomaly only affects a small portion of one or more of the measured signals captured by the sensors. This is somewhat analogous to how a burglar alarm system fails to trigger an alarm if the legitimate occupant of a house hammers a nail into the wall, while simultaneously recognizing the working noises caused by manually working on the door lock with unlocking tools as a burglar attempt and triggering an alarm.

[0017] The technical system can in particular be, for example, a vehicle or an industrial plant that processes one or more reactants through one or more processing steps into one or more products. In both vehicles and industrial plants, a large number of measured values ​​are currently recorded by sensors and can be better evaluated with regard to possible anomalies using the method proposed here. A vehicle in particular conveys a large number of correlations via its body, in and on which the sensors are distributed in a relatively small space, which can be used to detect anomalies. In an industrial plant, such correlations are conveyed, for example, by material flows of reactants and / or products through the plant. Control units in vehicles, as well as "plant historians" in industrial plants, also automatically log a large number of measured values.These protocols can be used, for example, in conjunction with the knowledge that anomalies have or have not occurred at certain times, to obtain labeled training data for both the normal and the abnormal states. With this labeled training data, the machine learning model can be trained in a supervised manner. In particular, pairwise conditional probability distributions P can be calculated. D (i | j) can be determined and / or approximated using training data. How far back a machine learning model can look is determined by the chosen architectural parameters, such as the widths of filter kernels in convolutional layers.

[0018] In a further advantageous embodiment, a control signal is generated from the classification provided by the machine learning model. The technical system is controlled by this control signal. For example, in response to an anomaly being detected in a vehicle, the maximum speed can be reduced, the execution of certain risky driving maneuvers (such as overtaking maneuvers) can be prevented, or the vehicle can be brought to a stop on a pre-planned emergency stop trajectory. An industrial plant, for example, can be switched to a safe mode in which the plant's throughput is reduced to a minimum. In this safe mode, the plant can then also be operated manually, for example, in the event of a failure of the automatic control system.

[0019] As mentioned previously, the machine learning model can be trained using labeled training examples of tensors K*. However, specifically labeled training examples for anomalies are often scarce, as technical systems usually perform so well that anomalies are rare.

[0020] Therefore, the invention provides a method for training a machine learning model for use in the method described above, which requires only a few labeled training examples.

[0021] In this procedure, training examples for tensors K* of parameters KP , which represent pairwise conditional probability distributions P D (i | j) of observations from sensors i and j are provided. For these training examples, it is not yet necessary to know whether they refer to normal or abnormal behavior of the technical system.

[0022] A distribution of perturbations p is provided which are known to modify a tensor K* only in a way that can also occur during normal operation of the technical system.

[0023] An example of such disturbances p is additive normally distributed noise, which can also be contained in the observations provided by the sensors.

[0024] Further examples are a stochastic zeroing of off-diagonal elements of the tensor K*, a replacement of elements on the level t by elements at levels t + 1 or t - 1, and / or a permutation of levels t, t' of the tensor K*. These perturbations simulate errors that can occur during sensory acquisition and the transmission of measurement data over a network. Thus, a mixing of elements at level t with elements at levels t + 1 or t - 1 can be caused, for example, by inaccurate time synchronization between sensors. Poor time synchronization or problems transmitting measurement data over a network can, for example, lead to the swapping of planes t and t'. Sporadic sensor errors can manifest themselves, for example, in missing off-diagonal elements in the tensor K*.

[0025] Using the perturbations p, so-called positive and negative pairs can be created for the process of contrastive learning. Contrastive learning is self-supervised learning based on positive and negative examples that are known to be similar or dissimilar to each other.

[0026] Positive couples of variations and are made by Applying two disturbances p1 and p2 sampled from the distribution to one and the same training example K* produces the result. The modifications and in These pairs differ only with respect to disturbances that also occur during normal operation of the technical system and sensor monitoring. Therefore, the machine learning model should recognize these variations as similar to each other.

[0027] Negative pairs of modifications and by applying two disturbances p1 and p2 sampled from the distribution on two different training examples K*' and K*". The modifications And these pairs are not just different from the aforementioned common perturbations, but rather from variations of two completely different examples. Therefore, the machine learning model should recognize these variations as dissimilar to each other.

[0028] In order to train the machine learning model precisely for this, the machine learning model to be trained is created from the modifications and K*" are processing products and This does not necessarily have to be the respective final output of the machine learning model, which allows the classification regarding the normal or abnormal state to be recognized. Rather, the machine learning model can, for example, comprise a feature extractor that extracts features from the tensor K* and a classification head that maps these features to the desired classification of the behavior of the technical system. The feature extractor can, in particular, comprise a sequence of several convolutional layers that convert their respective input into a dimensionally reduced feature map by applying one or more filter kernels. The processing products and can then be formed by the feature extractor.

[0029] In contrastive learning, parameters that characterize the behavior of the machine learning model are optimized with the aim of

[0030] • a similarity of processed products and the refers to positive pairs, is maximized and

[0031] • a similarity of processed products and the on negative pairs refers to, is minimized.

[0032] That is, the feature extractor of the machine learning model is trained to extract processing products in the latent space of its output and which are based on positive pairs, close to each other At the same time, it is trained to place processing products and negative pairs in this latent space return, far away from each other. The processed product can therefore be returned to a point z i correspond in latent space, and that Processing product to the same positive pair can lead to a point Zj in the latent space. An example cost function that measures whether the points z ; and z, are close to each other, the NT-Xent loss C, normalized temperature-scaled cross entropy): where the function ψ measures the similarity and τ is a temperature parameter. The temperature parameter τ can be varied, for example, according to an annealing plan, as a function of the number of epochs.

[0033] The machine learning model can therefore complete a large part of its training in this self-supervised manner, without having to use labeled training examples.

[0034] For example, the classification head can then be trained under supervision using training examples K* labeled with target classifications. Since the classification head represents only a small portion of the machine learning model, especially with regard to the number of parameters to be optimized, a comparatively small number of labeled training examples is sufficient for this training. In this context, it is also particularly advantageous that the classification head receives a well-presorted processing product as input as a result of self-supervised training. The classification head therefore does not have to correct something that was previously neglected through increased training effort.

[0035] The invention provides yet another method for training a machine learning method for use in the method described above. In contrast to the contrastive learning described above, this method uses normal supervised training. Within the framework of this method, training examples for tensors K* of parameters are provided that represent pairwise conditional probability distributions P D (i | j) of observations from sensors i and j. These training examples K* refer to normal behavior of the technical system.

[0036] A distribution of disturbances p* is now provided that is known to modify a tensor K* in a way that is not expected during normal operation of the technical system. An example of such disturbances is uniformly distributed noise.

[0037] By applying perturbations p* sampled from the distribution to training examples K*, variations K* are generated. The machine learning model is trained in a supervised manner using the training examples K* for normal behavior of the technical system on the one hand, and the variations K* as training examples for abnormal behavior of the technical system on the other.

[0038] Using this method, the machine learning model can be trained directly on the desired classification task in one step, provided a suitable distribution of perturbations p* is available for the respective application. However, if such a distribution of perturbations p* is unavailable or difficult to model, the contrastive learning approach described above can be used. An important advantage of contrastive learning is that it does not rely on modeling the perturbations p*.

[0039] Optionally, within the scope of this method, the training examples K* can be augmented to further modifications by applying the disturbances p discussed in connection with contrastive learning, which can then be used as further training examples for normal behavior within the scope of supervised learning. Further measures improving the invention are presented in more detail below, together with the description of the preferred embodiments of the invention, with reference to figures.

[0040] Examples of implementation

[0041] It shows:

[0042] Figure 1 embodiment of the method 100 for detecting anomalies in a technical system 1;

[0043] Figure 2 Illustration of a tensor K* of parameters

[0044] Figure 3 Embodiment of the method 200 for training a machine learning model 2;

[0045] Figure 4 Embodiment of the method 300 for training a machine learning model 2.

[0046] Figure 1 is a schematic flow diagram of an embodiment of the method 100 for detecting anomalies in a technical system 1. The behavior of this system 1 is monitored by an arrangement of n sensors.

[0047] In step 110, for each sensor k = 1, ... , n, a time series of N Observations of this sensor for times t = 1, ..., N.

[0048] According to block 111, at least two sensors can be selected for measured variables, between which the physical configuration of the technical system 1 in the nominal state of this system 1 mediates a physical interaction. According to block 111a, at least two further sensors can then optionally be selected for further measured variables, between which the physical configuration of the technical system 1 in the nominal state of this system 1 excludes a physical interaction.

[0049] In step 120, for each time t = 1, ... , N as well as for the indices i =

[0050] 1, ...,n and j = 1, ...,n parameters the pairwise conditional probability- ity distributions from observations of sensors i and j (120).

[0051] In step 130, a tensor K* of all parameters is calculated from a trained Machine learning model 2 is mapped to the desired classification 3 as to whether the behavior of the technical system 1 is normal or abnormal.

[0052] In step 140, a control signal 4 is formed from the classification 3 provided by the machine learning model 2.

[0053] In step 150, the technical system 1 is controlled with the control signal 4.

[0054] Figure 2 illustrates the formation of the tensor K* using a simple example with three time-dependent observations x(t), y(t), and z(t). For each time t, conditional probabilities can be calculated, assuming that one of the three values ​​x(t), y(t), and z(t) is given. indices for the values ​​of all variables (t), y(t) and z(t). Parameters the distributions of these pairwise conditional probabilities are collected in a two-dimensional matrix. All such matrices for all times t together form the tensor K*.

[0055] Figure 3 is a schematic flow diagram of an embodiment of the method 200 for training a machine learning model 2 for use in the method 100 described in connection with Figure 1. The method 200 is based on contrastive learning. In step 210, training examples for tensors K* of parameters the pairwise conditional probability distributions P D (i | j) from observations of sensors i and j.

[0056] In step 220, a distribution of disturbances p is provided which are known to modify a tensor K* only in a way that can also occur during normal operation of the technical system.

[0057] In step 230, positive pairs of variations and by applying two perturbations p1 and p2 sampled from the distribution to one and the same training example K*. These modifications thus differ only by perturbations p, which also occur during normal behavior of the technical system 1 and the sensory data acquisition.

[0058] In step 240, negative pairs of variations by applying two perturbations p1 and p2 sampled from the distribution to two different training examples K*' and K*". These variations thus differ by more than just "normal" perturbations p.

[0059] In step 250, the machine learning model (2) to be trained is used to create the modifications each processing product and generated.

[0060] According to block 251, the machine learning model 2 may include a feature extractor

[0061] 21 , which extracts features from the tensor K*, and a classification head

[0062] 22, which maps these characteristics to the desired classification of the behavior of the technical system.

[0063] In step 260, parameters 2a, which characterize the behavior of the machine learning model 2, are optimized with the aim of achieving maximum similarity between and at the same time minimal similarity between and These parameters may include, in particular, parameters 21 a of the feature extractor 21. The fully optimized state of the parameters 2a, 21a is denoted by the reference symbol 2a*, 21a*. In step 270, the classification head 22 is trained in a supervised manner using training examples K* labeled with target classifications. This means that the parameters 22a, which characterize the behavior of the classification head 22, are optimized with the goal of mapping the training examples K* from the machine learning model 2 to the respective target classifications. The fully optimized state of these parameters is denoted by the reference symbol 22a*.

[0064] Figure 4 is a schematic flow diagram of an embodiment of the method 300 for training a machine learning model 2 for use in the method 100 described in connection with Figure 1. In contrast to the method 200, this method is based on supervised training.

[0065] In step 310, training examples for tensors K* of parameters the pairwise conditional probability distributions P D (i | j) of observations from sensors i and j. These training examples K* refer to normal behavior of the technical system 1 .

[0066] In step 320, a distribution of perturbations p* is provided which are known to modify a tensor K* in a manner that is not expected during normal operation of the technical system.

[0067] In step 330, variations K* are generated by applying perturbations p* sampled from the distribution to training examples K*.

[0068] In step 340, the machine learning model 2 is tested with the training examples K* for a normal behavior of the technical system 1 on the one hand and with the modifications * as training examples for an abnormal behavior of the technical system 1 on the other hand, are trained in a supervised manner. This means that the parameters 2a, which characterize the behavior of the machine learning model 2, are directly optimized with the aim of classifying the training examples K* as normal and the modifications as Classification as abnormal.

Claims

Claims 1. Method (100) for detecting anomalies in a technical system (1) whose behavior is monitored by an arrangement of n sensors, comprising the steps: • For each sensor k = 1, ..., n, a time series of N observations is recorded. this sensor detects times t = 1, ..., N (110); • for each time point t = 1, ..., N as well as for the indices i = 1, ... , n and j = 1, ..., n becomes a parameter that is pairwise conditional Probability distribution P D (i | j) characterized by observations of sensors i and j, determined (120); • A tensor K* of all parameters is generated by a trained machine Learning model (2) mapped to a classification (3) to determine (130) whether the behavior of the technical system (1) is normal or abnormal.

2. Method (100) according to claim 1, wherein at least two sensors for measured quantities are selected (111) between which the physical configuration of the technical system (1) in the nominal state of this system (1) mediates a physical interaction.

3. Method (100) according to claim 2, wherein one measured quantity is a measure of an amount of energy supplied to or present in the technical system and wherein the other measured quantity is a measure of the amount of energy present or energy output by the technical system.

4. Method (100) according to one of claims 2 to 3, wherein at least two further sensors for further measured variables are selected (111 a), between which the physical configuration of the technical system (1) in the nominal state of this system (1) excludes a physical interaction.

5. Method (100) according to claim 4, wherein the further sensors are arranged on different sides of a barrier which prevents the physical interaction between the further measured variables in the nominal state of the technical system (1).

6. Method (100) according to any one of claims 1 to 5, wherein a vehicle or an industrial plant which processes one or more reactants into one or more products by one or more processing steps is selected as the technical system (1).

7. Method (100) according to any one of claims 1 to 6, wherein • a control signal (4) is formed from the classification (3) provided by the machine learning model (2) (140) and • the technical system (1) is controlled by the control signal (4) (150).

8. Method (200) for training a machine learning model (2) for use in the method (100) according to any one of claims 1 to 7 comprising the steps: • Training examples for tensors K* of characteristic values ​​are provided, which pairwise conditional probability distributions P D (i | j) characterize observations of sensors i and j, provided (210); • a distribution of disturbances p is provided (220) for which it is known that they modify a tensor K* only in a way that can also happen in the normal operation of the technical system; • Positive pairs of variations are identified by applying two perturbations p1 and p2 sampled from the distribution to one and the same training example K* generated (230); • Negative pairs of variations are formed by applying two perturbations p1 and p2 sampled from the distribution to two different training examples K*' and K*" (240); • The modifications are derived from the machine learning model (2) to be trained. each processed products generated (250); · Parameters (2a) that characterize the behavior of the machine learning model (2) are optimized (260) with the aim that o a similarity of processing products · and which focus on positive couples refers to, is maximized and o a similarity of processed products which focus on negative pairs 9. Method (200) according to claim 8, wherein the machine learning model (2) includes a feature extractor (21) that extracts features from the tensor ^ ∗ extracted, and includes a classification head (22) that maps these features to the desired classification of the behavior of the technical system (251), and the processing products from the feature extractor (21) (252).

10. Method (200) according to claim 9, wherein the classification head (22) is equipped with training examples K ∗ , which are labelled with target classifications, is monitored and trained (270).

11. Method (200) according to any one of claims 8 to 10, wherein the disturbances p are additive normally distributed noise, and / or stochastic zeroing of non-diagonal elements of the tensor K ∗ , and / or · a replacement of elements at level t by elements on the levels t + 1 and t − 1, and / or • an interchange of planes t, t′ of the tensor K ∗ 12. Method (300) for training a machine learning model (2) for use in the method (100) according to any one of claims 1 to 7 comprising the steps: • Training examples for tensors K* of key parameters are provided. pairwise conditional probability distributions P D (i | j) characterize observations of sensors i and j, provided (310), wherein these training examples K* refer to normal behavior of the technical system (1); • a distribution of disturbances p* is provided (320) which is known to modify a tensor K* in a way that is not expected in the normal operation of the technical system; • By applying perturbations p* sampled from the distribution to training examples K*, modifications are obtained. generated (330); • The machine learning model (2) is used with the training examples K* for normal behavior of the technical system (1) on the one hand, and with the modifications as training examples for abnormal behavior on the other. Behavior of the technical system (1) on the other hand monitored trained (340).

13. Computer program containing machine-readable instructions which, when executed on one or more computers and / or compute instances, cause the computer(s) or compute instance(s) to execute a method (100) according to any one of claims 1 to 12.

14. Machine-readable data carrier and / or download product containing the computer program according to claim 13.

15. One or more computers and / or compute instances with the computer program according to claim 13, and / or with the machine-readable data carrier and / or download product according to claim 14.

Images