Anomaly detection in manufacturing network

Abstract

A method for detecting anomalies using alarm data from a manufacturing network for manufacturing products in batches includes obtaining alarm data indicating time-series alarm state information for each alarm among a plurality of alarms of one or more types among a plurality of types of alarms over a plurality of batches. Each type of alarm indicates a different type of problem. The plurality of alarms includes a first alarm and a second alarm. For each batch, a probability that the second alarm occurs within a specified time period after the first alarm is calculated based on the alarm data. A cumulative sum of mean deviations (CUSUM) of the probability computed for each batch is calculated progressively, and a batch with a maximum absolute value of the CUSUM is identified as a changepoint batch exhibiting a potential anomaly indicating an issue for investigation or repair in the manufacturing network.

Description

ANOMALY DETECTION IN MANUFACTURING NETWORK FIELD OF THE DISCLOSURE

[0001] The present disclosure relates generally to monitoring and maintenance of interconnected machines, such as in manufacturing networks. More specifically, the present disclosure relates to anomaly detection in a manufacturing network. BACKGROUND OF THE DISCLOSURE

[0002] Machines used in certain scenarios and applications interact with other machines. In a manufacturing network, for example, different machines may perform different functions at different stages of the manufacturing process. The machines may be outfitted with a variety of sensors that can monitor various aspects related to the machine to detect various issues related to the machine. For example, sensors can monitor components that are provided to the machine and detect if / when there is an issue with the provided components (e.g., a clog in a filling line). As another example, sensors can monitor moving components of the machine for proper operation (e.g., to detect if / when a grabbing or gripping device did not open, close, etc.). Each sensor may trigger an alarm associated with a detected condition. Based on the number of sensors and machines involved in a given scenario, the alarm data generated (e.g., during manufacturing of a batch of a product) can be substantial. For example, a single assembly line may include over 3000 unique types of alarms, and over 13 million alarm records may be generated during a manufacturing interval (e.g., during the manufacture of a batch of components). SUMMARY

[0003] According to an exemplary embodiment, a method for detecting anomalies using alarm data from a manufacturing network for manufacturing products in batches includes obtaining alarm data indicating time-series alarm state information for each alarm among a plurality of alarms over a plurality of batches of manufacture. Each type of alarm indicates a different problem within the manufacturing network. The plurality of alarms includes a first alarm and a second alarm. For each batch of the plurality of batches, a probability that the second alarm will occur within a specified time period after the first alarm is calculated based on the alarm data. A cumulative sum of mean deviations (CUSUM) of the probability computed for each of the plurality of batches is calculated progressively, and a

[0004] batch among the plurality of batches with a maximum absolute value of the CUSUM is identified as a changepoint batch exhibiting a potential anomaly indicating an issue for investigation or repair in the manufacturing network.

[0005] According to another exemplary embodiment, a system for detecting anomalies using alarm data from a manufacturing network includes memory configured to store alarm data indicating time-series alarm state information for each alarm among a plurality of alarms over a plurality of batches of manufacture of products. Each alarm indicates a different problem within the manufacturing network. The plurality of alarms includes a first alarm and a second alarm. A processor calculates, for each batch of the plurality of batches, based on the alarm data, a probability that the second alarm will occur after the first alarm. The processor also calculates a cumulative sum of mean deviations (CUSUM) of the probability computed for each of the plurality of batches progressively. A batch among the plurality of batches with a maximum absolute value of CUSUM is identified as a changepoint batch exhibiting a potential anomaly indicating an issue for investigation or repair in the manufacturing network.

[0006] According to yet another exemplary embodiment, a method of managing a manufacturing network includes obtaining a number of activations of an alarm or set of alarms for each batch in a set of manufacturing batches, and obtaining a first probability distribution function (pdf) pertaining to a first frequency of the alarm or the set of alarms for a first set of batches within the set of batches. The method also includes obtaining a second probability distribution function (pdf) pertaining to a second frequency of the alarm or the set of alarms for a second set of batches within the set of batches, and determining whether the first frequency and the second frequency are different.

[0007] It is noted that techniques for implementing anomaly detection in a manufacturing network having various different features are disclosed herein and these features may be combined in various different configurations, including configurations not specifically illustrated or discussed. Although several different combinations of such features are described herein, a person having ordinary skill in the art will realize that further such combinations not explicitly described herein are also possible and enabled by the present disclosure and are within the scope of the present application. Additionally, although various techniques are disclosed herein for attaining the disclosed features, a person having ordinary skill in the art will realize that some modifications to the disclosed techniques may be possible and within the scope of the disclosed techniques. It is also to be understood that thephraseology and terminology employed herein are for the purpose of description and should not be regarded as limiting. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Various aspects, techniques, and embodiments of the present technology disclosed herein are described below with reference to the accompanying drawings. It should be appreciated that the figures are not necessarily drawn to scale. Items appearing in multiple figures may be indicated by the same reference numeral. For purposes of clarity, not every component may be labeled in every figure. Features of the present technology will become more apparent, and techniques for how to attain the features of the present technology, will be better understood by reference to the following detailed description considered in conjunction with the accompanying drawings, wherein:

[0009] FIG.1 is a block diagram of a manufacturing system according to one or more embodiments.

[0010] FIG.2 shows historical records of manufacturing data and alarm data, as well as a probability distribution function determined for a first set of batches according to an exemplary embodiment.

[0011] FIG.3 shows the historical records of FIG.2, as well as a probability distribution function determined for a second set of batches according to an exemplary embodiment.

[0012] FIG.4 illustrates exemplary alarm patterns identified according to one or more embodiments.

[0013] FIG.5 is a process flow of a method of performing alarm pattern anomaly detection according to one or more embodiments.

[0014] FIG.6 illustrates a process flow of a method of determining confidence in a changepoint determination according to one or more embodiments.

[0015] FIG.7 is a block diagram detailing aspects of the controller that performs anomaly detection according to exemplary one or more embodiments. DETAILED DESCRIPTION OF THE INVENTION

[0016] Provided herein are techniques for analyzing alarms that monitor different aspects of a manufacturing network to detect one or more anomalies. The techniques facilitate triage of the various alarms within the manufacturing network. That is, the anomalies can be used to identify which alarms may indicate an issue that is more urgent toaddress than other alarms. The analysis can be used, for example, to identify a change in frequency of a given alarm. The change in frequency of the alarm may indicate an anomaly in a related aspect of the manufacturing network for further investigation. The techniques can also be used to analyze alarms based on identifying or hypothesizing a correlation between two or more alarms that results in a pattern of alarms (e.g., alarm A typically occurs shortly after alarm B). The analysis can be used to determine a change in an alarm pattern (i.e., an anomaly) that facilitates alarm triage (i.e., identification of the related alarms for investigation). As noted, sensors associated with a network of machines may generate a large number of alarm records based on detected activity during a period of time. Analyzing each alarm record within each period of operation of the network may, therefore, be time and / or resource-prohibitive. The inventors have recognized and appreciated the need to triage alarms for further investigation through anomaly detection. In particular, the inventors have appreciated a need to identify which alarms (of the many) may be associated with issue(s) that may need to be remedied in order to improve operation of the network.

[0017] The inventors have developed various techniques that can be used to triage alarms that are generated by networked machines. In some embodiments, the techniques can triage alarms by detecting anomalies in the occurrences of alarms and / or alarm patterns over time. The inventors have appreciated that historical alarm data and / or alarm records can be used to perform anomaly detection. Anomalies may be manifested in the form of, for example, a change in frequency of a given alarm. The inventors have developed techniques to identify a changepoint for alarm frequency (e.g., a manufacturing interval during which the change in alarm frequency occurred). The changepoint may be used to investigate the cause of the change in alarm frequency.

[0018] Anomalies may also be manifested in, for example, a change in a pattern of alarms. A pattern may indicate that, for example, a particular alarm may generally follow within a short time after another alarm (e.g., because the alarms are associated with related operations or other sensed features). The changepoint of such a pattern of correlated alarms may be, for example, the time when the pattern is not exhibited, such as when the particular alarm does not follow the other alarm. Such a changepoint may be used to identify those alarm(s) and / or the time period associated with the alarm pattern change for further investigation. Generally, the changepoint(s) identified according to various embodiments detailed herein may facilitate determining a particular alarm, machine, or period of time for further study and corrective action.

[0019] Following below are more detailed descriptions of various concepts related to, and embodiments of, techniques described above. It should be appreciated that various aspects described herein may be implemented in any of numerous ways. Examples of specific implementations are provided herein for illustrative purposes only. In addition, the various aspects described in the embodiments below may be used alone or in any combination and are not limited to the combinations explicitly described herein. In particular, although examples of the anomaly detection are described herein in connection with a manufacturing network, the techniques are not limited to machines in a manufacturing network. For example, the anomaly detection techniques described herein may also be used in connection with a network for inspecting, processing, sorting, or packaging items. Generally, the changepoint determination facilitates narrowing down the historical time period and the records that may be of most interest in determining a change in operation of the network.

[0020] FIG.1 is a block diagram of a manufacturing system 100 according to one or more embodiments. The manufacturing system 100 includes a manufacturing network 105. The exemplary manufacturing network 105 shown in FIG.1 includes machines 110-1 through 110-8 (generally referred to as machine (s)110) interconnected by conveyer belts 120a through 120g (generally referred to as conveyer belt(s) 120). For example, machines 110-1 and 110-2 are connected by conveyer belt 120a, and machines 110-7 and 110-8 are connected by conveyer belt 120g. The relative differences in length among the conveyer belts 120 are intended to convey that different conveyer belts 120 connecting different pairs of machines 100 may be of different lengths and / or may operate at different speeds.

[0021] The exemplary illustration in FIG.1 is not intended to limit the numbers or arrangements of machines 110 that make up a manufacturing network 105. For example, machines 110-3, 110-5, 110-6, 110-8 are shown obtaining inputs of raw materials or components from outside the manufacturing network 105, while a product is shown output from machine 110-1. In alternate arrangements, other machines 110 in the manufacturing network 105 (e.g., machine 110-1, 110-2, 110-4, and / or 110-7) may also obtain input from outside the manufacturing network 105. In addition, while the flow of components to produce a product at machine 110-1 is indicated, an opposite flow, returning empty pucks that held those components in place, may also be part of the manufacturing network 105. The specific configuration of the manufacturing network 105 is not relevant to the embodiments detailing aspects of detecting alarm-related changepoints.

[0022] Exemplary sensors 125 are indicated in FIG.1. Sensors 125 are shown at an interface between a machine 110 and conveyor belt 120 and within some machines 110. Each sensor 125 may be associated with one or more alarms 126. For example, sensors 125 may be positioned to monitor operation of actuators and pushers within the manufacturing network 105. Sensors 125 may be positioned at different areas, referred to as stations, for example, within machines 110. These sensors 125 may activate an alarm if expected components are not at the station to facilitate further production. For example, a sensor 125 may indicate that a linear tracker at a given station within a given machine 110 is starved for components. It should be appreciated that these examples are only illustrative and not indicative of the numerous sensors 125 and associated alarms 126 that may be distributed throughout a given manufacturing network 105.

[0023] The manufacturing system 100 also includes a controller 130 that may perform the anomaly detection detailed herein to facilitate triage of alarms for further investigation. The controller 130 is further discussed with reference to FIG.7. The controller 130 may obtain historical records indicating which alarms were activated during a period of time. For explanatory purposes, alarm records may be discussed as being activated within batches (e.g., alarms activated during manufacture of a batch of a particular product). The organization of historical records for analysis is not limited to consideration of alarms within or among batches but may instead be organized according to a period of time or another type of segmentation of the records. Ultimately, identification of an anomaly in an alarm frequency or pattern and a changepoint within a batch or other subdivision of the records at which the anomaly occurred may facilitate triage of the various alarms 126 of the manufacturing network 105 to determine which alarm(s) 126 to investigate for possible action to improve operation of the manufacturing network 105.

[0024] FIGS.2 and 3 illustrate an approach to identifying a changepoint in the frequency of a given alarm 126 according to one or more embodiments. It should be appreciated that while FIGS.2-3 are discussed in the context of analyzing the frequency of a particular alarm 126, this is for exemplary purposes only and the techniques are not so limited. For example, the frequency of an alarm type generally, where there are multiple alarms of the same type, may be of interest and may be analyzed using the changepoint determination described herein. It should also be appreciated that some examples discussed in conjunction with FIGS.2-3 pertain to the use of historical records obtained during the manufacture of syringes over a set of batches. Each batch may represent, for example, a scheduled production period for a pre-specified number of syringes. As discussed inconjunction with the figures, the number of syringes per batch may differ. For example, a given batch or manufacturing interval may be implemented to produce a large number of syringes (or other product) over a period of days while another batch or manufacturing interval may be implemented to produce a smaller number of the same product within a day. However, it should be understood that the alarm frequency changepoint determination discussed with reference to FIGS.2 and 3 is not limited to the manufacture of any particular product or any particular number of batches or other intervals of historic data. For example, the intervals (e.g., batches) for which alarm data 205 is available are not intended to be limited by the examples in order to be analyzed for anomalies, as detailed herein.

[0025] FIG.2 shows historical records of manufacturing data 200 and alarm data 205, as well as a probability distribution function (pdf) p1(f) determined for a first set of batches 210a according to an exemplary embodiment. The manufacturing data 200 indicates the number of syringes (Ns) produced in twenty-nine batches (every third batch is labeled for readability). The alarm data 205 indicates the number of alarm activations (Na) for an alarm 126 of interest (e.g., at a particular station of a particular machine 110) during each of the same twenty-nine batches. Together, the number of syringes (Ns) indicated in the manufacturing data 200 and the number of alarm activations (Na) for an alarm 126 of interest indicated in the alarm data 205 are regarded as data d used to examine alarm frequency.

[0026] The pdf p1(f) indicates the probability p(f|d) (or likelihood) of the alarm 126 of interest being activated during the production of one syringe. Although the total number of activations of the alarm 126 of interest during production of the total number of syringes for the twenty-nine batches can be determined from the data d, the likelihood of activation of the alarm 126 of interest per syringe, frequency f, is unknown and is a continuous variable between 0 and 1 whose uncertainty is expressed as p(f). A frequency f value of 0 indicates that the alarm 126 of interest will likely not be activated during production of a syringe, while a frequency f value of 1 indicates that the alarm 126 of interest will likely be activated during production of every syringe. As another example, a frequency f value of 0.25 indicates that the alarm 126 of interest will likely be activated once during the production of every four syringes. A way to express the likelihood of a given frequency f value is p(f). For example, p(f = 0) = 0.9 indicates a 90 percent likelihood that alarm 126 will not activate during the production of a syringe, while p(f = 0.25) = 0.88 indicates an 88 percent likelihood that the alarm 126 will activate once for every four syringes produced. As indicated in the exemplary case in FIG.2, pdf p1(f) is proportional to a binomial distribution model: ^^^∝ ^^ேೌ^1 െ ^^^ேೞିேೌ[EQ.1]

[0027] In the graph of pdf p1(f), frequency f is indicated along axis 201 and probability is indicated along axis 202. In the exemplary case, probability p(f|d) values are shown on a log scale, but this is only one example. The graph is centered at Na / Ns and the width of the graph (i.e., the variance or uncertainty in that frequency f) is based on the selected model. As noted, the frequency f may vary between 0 and 1. The binomial distribution model used in EQ.1 is a non-limiting example model that may be used. That is, according to an exemplary embodiment, the pdf p1(f) may be estimated assuming that the incidence of the alarm 126 follows a binomial distribution and using Bayes’ theorem. The pdf p1(f) curve may be regarded as a baseline probability p(f|d) for the alarm 126 of interest from which deviations (i.e., anomalies) can be determined. In some embodiments, this does not mean that the set of batches 210a or pdf p1(f) are known to be optimal, average, or have any particular significance. Instead, the pdf p1(f) determined for an initial set of batches 210a may simply be taken as a baseline in order to determine deviations (i.e., anomalies).

[0028] FIG.3 shows the historical records of manufacturing data 200 and alarm data 205, as well as pdf p2(f), which the probability of the alarm 126 of interest being activated during manufacture of a syringe during a second set of batches 210b according to an exemplary embodiment. The pdf p2(f) may be determined in the same way as the pdf p1(f) (e.g., using a binomial distribution model). As FIG.3 indicates, the sets of batches 210a and 210b differ only in that the set of batches 210b includes one more batch than the set of batches 210a. However, this exemplary illustration is not intended to be limiting. The sets of batches 210a and 210b need not overlap at all or could partially overlap, as shown in FIG.3, or partially overlap by fewer batches than shown. Further, the number of batches in each of the sets of batches 210a and 210b may be the same or different, as in the exemplary case shown in FIG.3.

[0029] As indicated, a Kullback-Leibler divergence (KLD) may be computed between the two pdfs p1(f) and p2(f). The KLD is given by: ^^ ^^ ^^ ൌ^^^ ^ ^^^^^ ^^^ ^^ ^^ ^^ ^ భ ^^ ^^ [EQ. 2]Athat there is no change in the frequency of the alarm 126 during the examined batches. As the value of KLD increases, it indicates a greater difference between the two pdfs p1(f) and p2(f) and a corresponding greater variation in alarm frequency between the two sets of batches 210a and 210b for the alarm 126 being examined. Using the two pdfs p1(f) and p2(f) and resulting KLD value, rather than, for example, simply looking at a difference between the ratio of Na / Nsbetween the two sets of batches 210a and 210b, may provide a more accurate indication of an anomaly. This is because the KLD value is less sensitive to small changes in the number of activations of an infrequency alarm 126. For example, if an alarm 126 does not get activated at all in the set of batches 210a, but that same alarm 126 gets activated once during the set of batches 210b, this can look like an anomaly or a large change in the frequency of the alarm 126 if Na / Nsis considered. However, by calculating pdfs p1(f) and p2(f) using, for example, a binomial distribution, and using KLD as a metric for identifying anomalies, such false alarms may be avoided or mitigated, since the calculation of pdfs may be less sensitive to small changes in the number of activations of an infrequently-activated alarm 126.

[0030] A KLD value above a predefined or determined threshold value may indicate a change in the manufacturing network 105 that should be investigated further. Essentially, the batch or a set of batches within which alarm frequency changed (the changepoint) may be narrowed down using this technique (i.e., determination of KLD) once, or iteratively with data d from smaller sets of batches, within the batches for which manufacturing data 200 and alarm data 205 are available. While the manufacturing data 200 and alarm data 205 are historical, they may pertain to batches that were just completed. As such, any changepoint in alarm frequency that is detected may be recent and the detection may facilitate timely repair or other action needed for the manufacturing network 105.

[0031] In addition to an anomaly in the frequency of an alarm 126, an anomaly may also be identified in one or more patterns of alarms 126. For example, a given alarm 126 A and another alarm 126 B may typically be activated such that alarm 126 B is activated or occurs within some time window after alarm 126 A is triggered. This may be because the two alarms 126 A and B are associated with related sensed parameters such that an alarm condition in one parameter results in an alarm condition in the other, related parameter within a short time. For example, if alarm A indicates a clogged filling line, and alarm B indicates under-filling of a syringe supplied by that filling line, it is likely that if alarm A is activated, alarm B would also be activated shortly thereafter, because the clogged filling line may lead to under-filling of syringes. It should be appreciated that such a pattern of repeating alarm sequences may be found for any number of alarms 126.

[0032] If an expected or established alarm pattern were disrupted in some way, this may be indicative of an anomaly that requires further investigation and / or needed repair or maintenance. For example, if alarm B is typically activated within some time window after alarm A is triggered, but at a certain time point that correlation ceases or is weakened such that alarm B no longer activates (or only infrequently activates) within the time window afteralarm A is triggered, this may be indicative of an anomaly. As described herein, by identifying an anomaly in the form of a change in alarm pattern and determining a batch or other segment of historical records evidencing the change in pattern, investigation and any needed repair in the manufacturing network 105 may be performed more efficiently.

[0033] FIG.4 illustrates exemplary alarm patterns 400a, 400b identified according to one or more embodiments. The alarm patterns 400a, 400b (generally referred to as 400) may represent time-series alarm state information for alarms 126 activated in a single interval (e.g., batch of manufacture) with time t within the interval indicated. Each alarm pattern 400a, 400b may be associated with a different interval (e.g., batch), such that alarm pattern 400a is associated with a first interval, while alarm pattern 400b is associated with a second, different interval. As detailed, by examining the alarm pattern 400 over multiple intervals (e.g., batches), a batch in which the alarm pattern 400 changed the most may be identified. In alarm pattern 400a, each activation of alarm A and alarm B within the exemplary interval is indicated and labeled. Other alarms 126 may also be activated in the interval but are not shown because they are not relevant to the discussion of the exemplary alarm pattern AB. After each activation of alarm A, a corresponding window duration w is indicated. For example, window w1 is shown following alarm A1, window w2 is shown following alarm A2, and so on. Any one or more activations of alarm B within the window following alarm A is counted as an instance of the alarm pattern AB holding.

[0034] For example, based on alarm B1 and alarm B2 being within window w1, the alarm A1 is part of an AB pattern. This would be true even if only alarm B1 or only alarm B2 had been within window w1. Alarm A2 is not part of an AB pattern, because there is no activation of an alarm B within its corresponding window w2, but alarm A3 is part of an AB pattern, because alarm B3 is within the window w3, which corresponds with alarm A3. Both alarms A4 and A5 are part of an AB pattern because there is at least one alarm B within each of their windows w4 and w5. In fact, there are two qualifying alarms 126 (alarms B5 and B6) within the window w4 associated with alarm A4 and three qualifying alarms 126 (alarms B5, B6, and B7) within the window w5 associated with alarm A5.

[0035] The probability that alarm B is activated within a window of time after activation of alarm A (i.e., the alarm pattern AB) is indicated as p(B|A) and is given by: ^^^ ^^| ^^^ ൌ^௨^^^^ ^^ ^ ௪^௧^ ^௧ ^^^^௧ ^ ^ ௪^௧^^^ ௪^^ௗ^௪௧^௧^^ ^௨^^^^ ^^ ^[EQ.3]In the exemplary alarm pattern 400a, four alarms A1, A3, A4, and A5 each are followed by at least one alarm B (B1 or B2, B3, B5 or B6, B5, B6, or B7) within a corresponding window w of time, and there are a total of five alarms A1-A5. Thus, p(B|A)= 4 / 5, as shown.

[0036] In alarm pattern 400b, each activation of alarm A, alarm B, and alarm C within the exemplary interval is indicated and labeled. Other alarms 126 may also be activated in the interval but are not shown because they are not relevant to the discussion of the exemplary alarm patterns AB and ABC. After each activation of alarm A, a corresponding window duration w is indicated. For example, window w1 is shown following alarm A1, window w2 is shown following alarm A2, and so on. Any one or more activations of alarm B within the window following alarm A is counted as an instance of the alarm pattern AB holding, and any one or more activations of alarm B followed by an activation of alarm C within the window following alarm A is additionally counted as an instance of alarm pattern ABC.

[0037] In the exemplary alarm pattern 400b, alarm A1 is part of an alarm AB pattern, as well as an alarm ABC pattern, because alarm B1 followed by alarm C1 are both activated within the time window w1 following the activation of alarm A1. In the time window w2 following alarm A2, there is at least one alarm B (alarm B2 or alarm B3), but no activation of alarm C is indicated. Thus, alarm A2 is part of a pattern AB but not ABC. Alarm A3 is part of an alarm AB pattern (due to either alarm B2 or alarm B3) and also part of an alarm ABC pattern, because alarm C2 follows at least one alarm B (either alarm B2 or alarm B3) within the window w3. Alarm A4 is part of an AB pattern due to alarm B4 being activated within the time window w4 following activation of alarm A4. However, the alarm C3, which is also within the window w4, precedes alarm B4. Thus, alarm A4 is not part of an ABC pattern. Finally, alarm A5 is part of both an AB pattern, due to alarm B4 being activated within the time window w5, and part of an ABC pattern, because alarm C4, which follows alarm B4, is also within window w5.

[0038] The probability that alarm B is activated within a window of time after activation of alarm A (i.e., the alarm pattern AB) is indicated as p(B|A) and, based on EQ.1, is 5 / 5. That is, every alarm A1-A5 is followed by at least one alarm B within a time window w following activation of the alarm A. The probability that alarms B and C are activated in that order within a window of time after activation of alarm A or, put another way, that alarm C is activated after alarms A and B (i.e., the alarm pattern ABC) is indicated as (B,C|A) and given by:^^^ ^^, ^^| ^^^ ൌ^௨^^^^ ^^ ^ ௪^௧^ ^௧ ^^^^௧ ^ ^ ௧^^^ ^௧ ^^^^௧ ^ ^ ௪^௧^^^ ௪^^ௗ^௪௧^௧^^ ^௨^^^^ ^^ ^[EQ.4] In the exemplary alarm pattern 400b, three alarms A1, A3, and A5 each are followed by at least one alarm B (B1, B2 or B3, B4) and then at least one alarm C (C1, C2, C4) within a corresponding window w of time, and there are a total of five alarms A1-A5. Thus, p(B,C|A)= 3 / 5, as shown. As previously noted, the probability or ratio of a given alarm pattern is determined in a similar manner for every interval among a set of intervals of interest (e.g., for a set of batches for which alarm data is recorded). This information is used to identify an anomaly, as discussed with reference to FIG.5.

[0039] FIG.5 is a process flow of a method 500 of performing alarm pattern anomaly detection according to one or more embodiments. As indicated historical data in the form of alarm records 505 may be available. The alarm records 505 may include time-series alarm state information that indicates a time of activation of each alarm 126 within an interval, such as a batch of manufacture for a particular product. At 510, obtaining or identifying one or more alarm patterns refers to determining which alarm patterns may be of interest in anomaly detection. This determination may be based on known alarm patterns. That is, two or more components of the manufacturing network 105 may be known to be related such that their associated sensors 125 and alarms 126 are related, and the alarms 126 should follow a particular pattern under normal conditions. As another example, a determination of one or more alarm patterns of interest may be based on examining historical records 505. That is, an alarm pattern may be identified by examining alarm records 505 pertaining to one batch, for example, and analysis of additional batches may be performed to determine whether there was a change in that pattern.

[0040] At 520, calculating the probability of a pattern holding within each interval (e.g., batch) may involve computing a ratio, as detailed with reference to FIG.4. For a given set of intervals indexed by i, ximay be used to represent the probability of a given pattern occurring at interval i. For example, x3 may be p(B|A) for batch or interval 3. More than one pattern may be of interest, as noted with reference to alarm pattern 400b. Thus, while x3= p(B|A) for batch 3, ^^ଷᇱmay be p(B,C|A) for batch 3. The number of alarm patterns that may be identified or of interest within a set of alarm records 505 is not intended to be limited by the examples discussed with reference to FIG.4. Any number of alarm patterns involving any number of alarms 126 may be examined for a change.

[0041] At 530, calculating a mean average of probability over all the intervals (e.g., batches) may be performed for each alarm pattern of interest. Generally, for N intervals of interest, mean average of probability is given by: ^^^ ൌ∑^సభ ௫^ே [EQ.5] For example, ^^^ may be the mean average of xi, pertaining to the probability of the pattern AB(p(B|A)), over a set of intervals. Similarly, ^^^ᇱmay be the mean average of ^^^ᇱ, pertaining tothe probability of the pattern ABC (p(B,C|A)), over the set of intervals. As previously noted, the specific alarm patterns and the numbers of alarm patterns that may be examined are not intended to be limited by the examples used for explanatory purposes.

[0042] At 540, calculating a cumulative sum of mean deviations (CUSUM) Si for each interval may also be performed separately for each alarm pattern of interest. Generally, CUSUM Si is given by: ^^^ൌ ^^^ି^^ ^ ^^^െ ^^^^ [EQ.6] Thus, for example, ^^^may be computed for ^^^and ^^^, pertaining to the probability of alarm pattern AB (p(B|A)), and ^^^ᇱmay be computed for ^^^ᇱand ^^^ᇱ, pertaining to the probability of alarm pattern ABC (p(B,C|A)). Since ^^^is calculated based at least in part on ^^^ି^, the order in which the intervals i are arranged may affect the specific value calculated for ^^^.

[0043] At 550, the processes involve identifying the interval i corresponding to the largest absolute value of CUSUM Si as a potential changepoint for the alarm pattern pertaining to Si. A changepoint refers to the interval i during which a given alarm pattern changed the most, indicating a potential anomaly. According to the example above, the interval i corresponding to the largest absolute value of CUSUM Simay be a potential changepoint for the alarm pattern AB, and the interval i corresponding to the largest absolute value of ^^^ᇱmay be a potential changepoint for the alarm pattern ABC. The potential changepoints for the two alarm patterns AB and ABC may not be the same interval i. As part of the processing at 550, a confidence level with which the changepoint interval is identified may be determined. This is further discussed with reference to FIG.6.

[0044] At 560, an optional process may be performed to increase resolution by repeating the processes at 530-550 for sub-intervals of the original set of intervals i. As a non-limiting example for explanatory purposes, 10 intervals (e.g., i=1 to 10 batches) are originally examined and, at 550, batch 4 is identified as a potential changepoint in a given alarm pattern. At 560, the original 10 intervals may be split into two sub-sets of batches 1-4 (sub-set 1) and batches 5-10 (sub-set 2), and processes 530-550 may be performed for sub-set1 and sub-set 2. Further splits may also be performed based on additionally identified changepoints. This approach may help to identify smaller changepoints than the initially identified changepoint.

[0045] For a given alarm pattern of interest, once a potential changepoint (e.g., a particular batch of manufacturing a given product) has been identified (at 550) or multiple changepoints have been identified based on additional processes (at 560), further investigation of sensor information, other alarms, or any other data pertaining to the changepoint(s) may be undertaken, at 570. Generally, at 570, the processes involve managing the manufacturing network 105 according to the identified one or more changepoints.

[0046] FIG.6 illustrates a process flow of a method 600 of determining confidence in a changepoint determination (at 550) according to one or more embodiments. As shown on the left, with the original ordering of intervals (i.e., in the time order in which alarm records 505 were obtained), values of CUSUM Siare obtained from the probability of a given alarm pattern xi in each interval i, then Sdiff is calculated as the difference between Smax, the maximum absolute value of Si, and Smin, the minimum absolute value of Si. According to this original ordering of intervals i, the absolute value of Si corresponds to the interval ithat is identified as the potential changepoint (at 550).

[0047] As detailed, the additional processes performed as part of the confidence determination at 550 generally are directed to changing the order of the intervals in the alarm records 505, re-calculating Sdifffor the re-ordered intervals, and determining whether the re- calculated value of Sdiff is smaller than the originally calculated value for Sdiff. Since Si depends at least in part on Si-1(per EQ.6), shuffling the order of the intervals (i.e., re- ordering the intervals) will result in different values for Si and, hence, for Sdiff. Each time that the intervals are re-ordered and the originally calculated value for Sdiffremains larger than the re-calculated value of Sdiff, confidence level that the originally identified changepoint (at 550) is a true changepoint increases. If the originally calculated value for Sdiffis smaller than the re-calculated value of Sdiff for a given re-order of intervals, confidence level that the originally identified changepoint (at 550) is a true changepoint remains the same or is decreased.

[0048] As indicated in FIG.6, a reshuffling of the order of the intervals in the alarm records 505 is performed n times. While a specific number of eight intervals and a particular reordering is shown in FIG.6 for explanatory purposes, any number of intervals may be of interest and a random or other reshuffling may be performed. As shown, based on a first reshuffling, values of CUSUM Si after the first reshuffling are obtained and (Sdiff)1 iscalculated as the difference between (Smax)1, the maximum absolute value of Si, and (Smin)1, the minimum absolute value of Siresulting from the first reshuffle. A count value is increased by 1 if the original Sdiff is greater than the (Sdiff)1 resulting from theThis is repeated up to the nthreshuffle. The confidence is then computed as the count, which is the number of reshuffles for which Sdiff exceeds the post-reshuffle (Sdiff)1^n, divided by the number of reshuffles, n. The calculated confidence level may then be compared to a threshold confidence value, and if the calculated confidence level is greater than the threshold confidence value, the identified changepoint may be identified as a true changepoint (at 550).

[0049] Optionally, when sub-intervals are considered, at 560, a sliding window approach may be used to increase confidence in the identified changepoints. Specifically, a window smaller than the number of intervals in the sub-interval may be used. For example, for a sub-interval of six intervals (e.g., batches 5-10 according to the example discussed with reference to FIG.5), a window of 4 may be used in a sliding fashion. At each position of the window, the four intervals among the six intervals of the sub-interval that are inside the window are used to redetermine a highest absolute value of CUSUM Si (according to 530- 550) as a potential changepoint. Confidence level is increased if the changepoint determined for the sub-interval based on the correct, chronological alarm records 505 is reidentified as the changepoint each time it is within the window (i.e., when the original changepoint is part of different subsets of the sub-interval).

[0050] According to additional embodiments, anomaly detection in alarm frequency and anomaly detection in alarm pattern may be used together to address issues in the manufacturing network 105. The processes discussed with reference to FIGS.2 and 3 may be performed for any number of alarms 126 in the manufacturing network 105. When two alarms 126 (e.g., X and Y) are found to significantly change frequency of occurrence within the same batch or interval (or within two batches or intervals that are close in time), an anomaly in the pattern of those alarms 126 may be investigated using the method 500.

[0051] That is, alarms X and Y may not typically be alarms 126 known to be correlated. Yet, the processes discussed with reference to FIGS.2 and 3, implemented separately on alarm X and alarm Y, may indicate an anomalous change in frequency in both alarms X and Y occurring during the same batch (or within a small number of batches (e.g., 2 batches) that occurred close in time). The number of batches regarded as close in time may be based on a duration of the batches in the alarm records 505. The anomalous change in frequency in alarms X and Y within a predetermined duration (e.g., within a number ofbatches) may lead to an investigation of whether a sudden unexpected correlation in the two alarms X and Y has occurred.

[0052] In an exemplary scenario, a changepoint for alarm Y frequency may be found to closely follow (e.g., be within the same batch as) a changepoint for alarm X frequency based on separately using the processes discussed with reference to FIGS.2 and 3 on both alarms 126 X and Y. In this case, the method 500 may then be used to examine alarm pattern XY and a changepoint may be found such that the probability of alarm pattern XY (p(Y|X) increases significantly after the changepoint. This may result, for example, because alarms X and Y pertain to two otherwise unrelated actuators that are both jammed due to a rod accidentally getting stuck between them. The anomaly (of an occurrence of a previously nonexistent alarm pattern XY) and the identified changepoint of the anomaly may lead to investigation of the actuators associated with the alarms X and Y and subsequent removal of the rod.

[0053] FIG.7 is a block diagram detailing aspects of the controller 130 that performs anomaly detection according to exemplary one or more embodiments. The controller 130 may include one or more processors 710 that implement the processes shown in FIG.5, for example. Instructions processed by the one or more processors 710 to implement the method 500 may be stored in non-transitory computer-readable media such as non-volatile storage 720, for example. Any one or more processors 710 may be referred to as “a processor,” and subsequent reference to “the processor” should be interpreted to refer to any one or more of the processors 710. That is, different ones of the processors 710 may implement different aspects of the method 500 and other processes discussed herein. Memory 730 may alarm records 505 and other data. A display 740 may indicate changepoints associated with alarm patterns, for example.

[0054] Techniques operating according to the principles described herein may be implemented in any suitable manner. The processing and decision blocks of the flow charts above represent steps and acts that may be included in algorithms that carry out these various processes. Algorithms derived from these processes may be implemented as software integrated with and directing the operation of one or more single- or multi-purpose processors, may be implemented as functionally-equivalent circuits such as a Digital Signal Processing (DSP) circuit or an Application-Specific Integrated Circuit (ASIC), or may be implemented in any other suitable manner. It should be appreciated that the flow charts included herein do not depict the syntax or operation of any particular circuit or of any particular programming language or type of programming language. Rather, the flow chartsillustrate the functional information one skilled in the art may use to fabricate circuits or to implement computer software algorithms to perform the processing of a particular apparatus carrying out the types of techniques described herein. It should also be appreciated that, unless otherwise indicated herein, the particular sequence of steps and / or acts described in each flow chart is merely illustrative of the algorithms that may be implemented and can be varied in implementations and embodiments of the principles described herein.

[0055] Accordingly, in some embodiments, the techniques described herein may be embodied in computer-executable instructions implemented as software, including as application software, system software, firmware, middleware, embedded code, or any other suitable type of computer code. Such computer-executable instructions may be written using any of a number of suitable programming languages and / or programming or scripting tools, and also may be compiled as executable machine language code or intermediate code that is executed on a framework or virtual machine.

[0056] When techniques described herein are embodied as computer-executable instructions, these computer-executable instructions may be implemented in any suitable manner, including as a number of functional facilities, each providing one or more operations to complete execution of algorithms operating according to these techniques. A “functional facility,” however instantiated, is a structural component of a computer system that, when integrated with and executed by one or more computers, causes the one or more computers to perform a specific operational role. A functional facility may be a portion of or an entire software element. For example, a functional facility may be implemented as a function of a process, or as a discrete process, or as any other suitable unit of processing. If techniques described herein are implemented as multiple functional facilities, each functional facility may be implemented in its own way; all need not be implemented the same way. Additionally, these functional facilities may be executed in parallel and / or serially, as appropriate, and may pass information between one another using a shared memory on the computer(s) on which they are executing, using a message passing protocol, or in any other suitable way.

[0057] Generally, functional facilities include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. Typically, the functionality of the functional facilities may be combined or distributed as desired in the systems in which they operate. In some implementations, one or more functional facilities carrying out techniques herein may together form a complete software package. These functional facilities may, in alternative embodiments, be adapted tointeract with other, unrelated functional facilities and / or processes, to implement a software program application.

[0058] Some exemplary functional facilities have been described herein for carrying out one or more tasks. It should be appreciated, though, that the functional facilities and division of tasks described is merely illustrative of the type of functional facilities that may implement the exemplary techniques described herein, and that embodiments are not limited to being implemented in any specific number, division, or type of functional facilities. In some implementations, all functionality may be implemented in a single functional facility. It should also be appreciated that, in some implementations, some of the functional facilities described herein may be implemented together with or separately from others (i.e., as a single unit or separate units), or some of these functional facilities may not be implemented.

[0059] Computer-executable instructions implementing the techniques described herein (when implemented as one or more functional facilities or in any other manner) may, in some embodiments, be encoded on one or more computer-readable media to provide functionality to the media. Computer-readable media include magnetic media such as a hard disk drive, optical media such as a Compact Disk (CD) or a Digital Versatile Disk (DVD), a persistent or non-persistent solid-state memory (e.g., Flash memory, Magnetic RAM, etc.), or any other suitable storage media. Such a computer-readable medium may be implemented in any suitable manner. As used herein, “computer-readable media” (also called “computer- readable storage media”) refers to tangible storage media. Tangible storage media are non- transitory and have at least one physical, structural component. In a “computer-readable medium,” as used herein, at least one physical, structural component has at least one physical property that may be altered in some way during a process of creating the medium with embedded information, a process of recording information thereon, or any other process of encoding the medium with information. For example, a magnetization state of a portion of a physical structure of a computer-readable medium may be altered during a recording process.

[0060] Further, some techniques described above comprise acts of storing information (e.g., data and / or instructions) in certain ways for use by these techniques. In some implementations of these techniques—such as implementations where the techniques are implemented as computer-executable instructions—the information may be encoded on a computer-readable storage media. Where specific structures are described herein as advantageous formats in which to store this information, these structures may be used to impart a physical organization of the information when encoded on the storage medium. These advantageous structures may then provide functionality to the storage medium byaffecting operations of one or more processors interacting with the information; for example, by increasing the efficiency of computer operations performed by the processor(s).

[0061] In some, but not all, implementations in which the techniques may be embodied as computer-executable instructions, these instructions may be executed on one or more suitable computing device(s) operating in any suitable computer system, or one or more computing devices (or one or more processors of one or more computing devices) may be programmed to execute the computer-executable instructions. A computing device or processor may be programmed to execute instructions when the instructions are stored in a manner accessible to the computing device or processor, such as in a data store (e.g., an on- chip cache or instruction register, a computer-readable storage medium accessible via a bus, a computer-readable storage medium accessible via one or more networks and accessible by the device / processor, etc.). Functional facilities comprising these computer-executable instructions may be integrated with and direct the operation of a single multi-purpose programmable digital computing device, a coordinated system of two or more multi-purpose computing device sharing processing power and jointly carrying out the techniques described herein, a single computing device or coordinated system of computing device (co-located or geographically distributed) dedicated to executing the techniques described herein, one or more Field-Programmable Gate Arrays (FPGAs) for carrying out the techniques described herein, or any other suitable system.

[0062] A computing device may comprise at least one processor, a network adapter, and computer-readable storage media. A computing device may be, for example, a desktop or laptop personal computer, a personal digital assistant (PDA), a smart mobile phone, a server, or any other suitable computing device. A network adapter may be any suitable hardware and / or software to enable the computing device to communicate wired and / or wirelessly with any other suitable computing device over any suitable computing network. The computing network may include wireless access points, switches, routers, gateways, and / or other networking equipment as well as any suitable wired and / or wireless communication medium or media for exchanging data between two or more computers, including the Internet. Computer-readable media may be adapted to store data to be processed and / or instructions to be executed by processor. The processor enables processing of data and execution of instructions. The data and instructions may be stored on the computer-readable storage media.

[0063] A computing device may additionally have one or more components and peripherals, including input and output devices. These devices can be used, among otherthings, to present a user interface. Examples of output devices that can be used to provide a user interface include printers or display screens for visual presentation of output and speakers or other sound generating devices for audible presentation of output. Examples of input devices that can be used for a user interface include keyboards, and pointing devices, such as mice, touch pads, and digitizing tablets. As another example, a computing device may receive input information through speech recognition or in other audible format.

[0064] Embodiments have been described where the techniques are implemented in circuitry and / or computer-executable instructions. It should be appreciated that some embodiments may be in the form of a method, of which at least one example has been provided. The acts performed as part of the method may be ordered in any suitable way. Accordingly, embodiments may be constructed in which acts are performed in an order different than illustrated, which may include performing some acts simultaneously, even though shown as sequential acts in illustrative embodiments.

[0065] Various aspects of the embodiments described above may be used alone, in combination, or in a variety of arrangements not specifically discussed in the embodiments described in the foregoing and is therefore not limited in its application to the details and arrangement of components set forth in the foregoing description or illustrated in the drawings. For example, aspects described in one embodiment may be combined in any manner with aspects described in other embodiments.

[0066] Use of ordinal terms such as “first,” “second,” “third,” etc., in the claims to modify a claim element does not by itself connote any priority, precedence, or order of one claim element over another or the temporal order in which acts of a method are performed, but are used merely as labels to distinguish one claim element having a certain name from another element having a same name (but for use of the ordinal term) to distinguish the claim elements.

[0067] Also, the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. The use of “including,” “comprising,” “having,” “containing,” “involving,” and variations thereof herein, is meant to encompass the items listed thereafter and equivalents thereof as well as additional items.

[0068] The word “exemplary” is used herein to mean serving as an example, instance, or illustration. Any embodiment, implementation, process, feature, etc. described herein as exemplary should therefore be understood to be an illustrative example and should not be understood to be a preferred or advantageous example unless otherwise indicated.

[0069] To clarify the use of and to hereby provide notice to the public, the phrases “at least one of , , ... and <N>” or “at least one of , , ... <N>, or combinations thereof” or “, , ... and / or <N>” are defined by the Applicant in the broadest sense, superseding any other implied definitions hereinbefore or hereinafter unless expressly asserted by the Applicant to the contrary, to mean one or more elements selected from the group comprising A, B, ... and N. In other words, the phrases mean any combination of one or more of the elements A, B, ... or N including any one element alone or the one element in combination with one or more of the other elements which may also include, in combination, additional elements not listed.

[0070] While various embodiments have been described, it will be apparent to those of ordinary skill in the art that many more embodiments and implementations are possible. Accordingly, the embodiments described herein are examples, not the only possible embodiments and implementations. Furthermore, the advantages described above are not necessarily the only advantages, and it is not necessarily expected that all of the described advantages will be achieved with every embodiment.

Claims

CLAIMS We claim:

1. A method for detecting anomalies using alarm data from a manufacturing network for manufacturing products in batches, the method comprising: obtaining alarm data indicating time-series alarm state information for each alarm among a plurality of alarms over a plurality of batches of manufacture, wherein each alarm indicates a different problem within the manufacturing network, the plurality of alarms including a first alarm and a second alarm; for each batch of the plurality of batches, calculating, based on the alarm data, a probability that the second alarm will occur within a specified time period after the first alarm; calculating a cumulative sum of mean deviations (CUSUM) of the probability computed for each of the plurality of batches progressively; and identifying a batch among the plurality of batches with a maximum absolute value of the CUSUM as a changepoint batch exhibiting a potential anomaly indicating an issue for investigation or repair in the manufacturing network.

2. The method according to claim 1, wherein the products include syringes filled with medication.

3. The method according to any one of claims 1-2, wherein: the plurality of alarms includes a third alarm; and the calculating the probability includes calculating the probability that the third alarm will occur after the second alarm.

4. The method according to claim 3, wherein the calculating the probability includes calculating the probability that the third alarm will occur after the second alarm within a specified time period after the first alarm.

5. The method according to any one of claims 1-4, wherein the CUSUM for each of the plurality of batches is calculated based on an order for the plurality of batches that matches a chronological order of the plurality of batches in the alarm data.

6. The method according to claim 5, further comprising determining a difference between the highest absolute value of the CUSUM and a lowest absolute value of the CUSUM based on the order for the plurality of batches matching the chronological order.

7. The method according to claim 6, further comprising arranging the plurality of batches in n different orders that differ from the chronological order, and for each respective order of the n different orders, calculating an alternate-order CUSUM for each batch of the plurality of batches based on the respective order.

8. The method according to claim 7, further comprising: determining, for each respective order of the n different orders, an alternate-order difference between a highest absolute value of the alternate-order CUSUM for the respective order and a lowest absolute value of the alternate-order CUSUM for the respective order; determining a number of the n different orders that have alternate-order differences that are less than the difference obtained based on the order matching the chronological order; and determining a confidence in the changepoint batch based on the determined number, wherein the confidence in the changepoint batch increases as the number increases.

9. The method according to claim 1, further comprising: obtaining a first set of batches and a second set of batches as subsets of the plurality of batches; identifying a changepoint batch among the first set of batches; and identifying a changepoint batch among the second set of batches.

10. A system for detecting anomalies using alarm data from a manufacturing network, the system comprising: memory configured to store alarm data indicating time-series alarm state information for each alarm among a plurality of alarms over a plurality of batches of manufacture of products, wherein each alarm indicates a different problem within the manufacturing network, the plurality of alarms including a first alarm and a second alarm; and a processor configured to: for each batch of the plurality of batches, calculate, based on the alarm data, a probability that the second alarm will occur after the first alarm;calculate a cumulative sum of mean deviations (CUSUM) of the probability computed for each of the plurality of batches progressively; and identify a batch among the plurality of batches with a maximum absolute value of CUSUM as a changepoint batch exhibiting a potential anomaly indicating an issue for investigation or repair in the manufacturing network.

11. The system according to claim 10, wherein the products include syringes filled with medication.

12. The system according to any one of claims 10-11, wherein: the plurality of alarms includes a third alarm, and the processor is configured to calculate the probability that the second alarm will occur after the first alarm and the third alarm will occur after the second alarm.

13. The system according to claim 12, wherein the processor is configured to calculate the probability that the third alarm will occur after the second alarm within a specified time period after the first alarm.

14. The system according to claim 10, wherein the processor is configured to calculate the CUSUM for each of the plurality of batches based on an order for the plurality of batches that matches a chronological order of the plurality of batches in the alarm data.

15. The system according to claim 14, wherein the processor is configured to determine a difference between the highest absolute value of the CUSUM and a lowest absolute value of the CUSUM based on the order of the plurality of batches matching the chronological order.

16. The system according to claim 15, wherein the processor is configured to: arrange the plurality of batches in n different orders, wherein the n different orders differ from the chronological order; for each respective order of the n different order, calculate an alternate-order CUSUM for each batch of the plurality of batches based on the respective order;determine, for each respective order of the n different orders, an alternate-order difference between a highest absolute value of the alternate-order CUSUM for the respective order and a lowest absolute value of the alternate-order CUSUM for the respective order; determine a number of the n different orders that have alternate-order differences that are less than the difference obtained based on the order matching the chronological order; and determine a confidence in the changepoint batch based on the determined number, wherein the confidence in the changepoint batch increases as the number increases.

17. The system according to claim 10, wherein one or more of the one or more processors is configured to: obtain a first set of batches and a second set of batches as subsets of the plurality of batches; identify a changepoint batch among the first set of batches; and identify a changepoint batch among the second set of batches.

18. A method of managing a manufacturing network, the method comprising: obtaining a number of activations of an alarm or set of alarms for each batch in a set of manufacturing batches; obtaining a first probability distribution function (pdf) pertaining to a first frequency of the alarm or the set of alarms for a first set of batches within the set of batches; obtaining a second probability distribution function (pdf) pertaining to a second frequency of the alarm or the set of alarms for a second set of batches within the set of batches; and determining whether the first frequency and the second frequency are different.

19. The method according to claim 18, wherein the determining whether the first frequency and the second frequency are different includes calculating a Kullback-Leibler Divergence using the first pdf and the second pdf.

20. The method according to claim 18, wherein the first set of batches and the second set of batches partially overlap or do not overlap.

Images