Detection of anomalies in technical systems by monitoring using multiple sensors

Abstract

A method (100) for identifying anomalies in a technical system (1) whose behavior is monitored by an assembly of n sensors, the method (100) comprising the steps of: for each sensor k=1,...,n, detecting (110) a time series of N observations of said sensor at time instants t=1,...,N; and for each time instant t=1,...,N and for indices i=1,...,n and j=1,...,n, detecting a pairwise conditional probability distribution P D Characteristic quantities that characterize (i|j) Step (120) to identify TIFF2025516803000082.tif7150 and all the parameters Tensor K in TIFF2025516803000083.tif7150 * and mapping (130) the detected behavioral state of the technical system (1) to a predefined classification (3) as to whether the behavior of the technical system (1) is normal or anomalous, by a trained machine learning model (2).

Description

Technical Field

[0001] The present invention relates to the monitoring of technical systems by sensors for identifying known and unknown anomalies.

Background Art

[0002] Prior Art For example, complex technical systems such as vehicles or industrial facilities are monitored by a large number of sensors in order to identify anomalies in their operation. In this case, it tends to be difficult to distinguish anomalies in the monitored technical system from inevitable disturbances in sensor monitoring. Therefore, the measurement signals detected by sensors often have noise attached, and transmitting such measurement signals via a network may be delayed in time. Also, as the number of sensors increases, the possibility of the functions of individual sensors being inhibited becomes increasingly high. In order to identify anomalies based on specific rules and reduce the above-mentioned effects at that time, the measurement data has to be very strongly smoothed, and in this case, a very large amount of information will be lost.

Summary of the Invention

Problems to be Solved by the Invention

[0003] Disclosure of the Invention The present invention provides a method for identifying anomalies in a technical system whose behavior is monitored by an assembly of n sensors.

Means for Solving the Problems

[0004] Within the framework of this method, for each sensor k = 1, ···, n, a time series consisting of N observation results of the sensor at time points t = 1, ···, N

Number

Number

Number

Number

Number

[0005] Therefore, all characteristic quantities

Number

[0006] It is exactly this "fingerprint" K * that is mapped by a trained machine learning model to a given classification as to whether the behavior of the technical system is normal or abnormal. This classification can have any form. This classification may, for example, be binary, but may include one or more real-valued scores in relation to a particular mode of operation.

[0007] It has been found that the physical configuration of many technical systems defines the physical interactions between the measured quantities detected by a plurality of different sensors, and thus causes a temporal correlation between these measured quantities. For example, when recording the flow of a fluid medium at one end of a pipeline, this is correlated with the fact that a changed temperature is recorded at the other end of the pipeline with a slight delay. In that case, the existence of such a correlation can be evaluated as a signal as to whether the technical system is functioning properly. If the pipeline is, for example, leaking or broken and the medium flowing at one end does not reach the other end, but instead flows into the factory hall, the correlation between the changed temperature and the flow will suddenly drop out.

[0008] Therefore, advantageously, at least two sensors whose physical interactions are mediated by the physical configuration of the technical system in the nominal state of the technical system are selected for the measured quantities.

[0009] In particular, for example, one measured quantity may well be a measure of the amount of energy supplied to the technical system or a measure of the amount of energy present within the technical system, and the other measured quantity may well be a measure of the amount of energy present or a measure of the amount of energy released by the technical system. In the above example using a pipeline, when the hot fluid supplied to one end of the pipeline introduces energy into the pipeline and thereby heats the pipeline, this pipeline then releases energy. Also, for example, an increase in the motor current of an electric motor appears as an increase in the amplitude of the vibration of this electric motor. Since energy is a physically conserved quantity, in many technical systems there is a temporal correlation between the measured values supplied by a plurality of different sensors. These correlations do not need to be explicitly analyzed and formulated in order to monitor whether the technical system is functioning properly using these correlations. It is sufficient that the correlations during normal operation simply exist physically, and thus can be learned by a machine learning model.

[0010] In other advantageous embodiments, at least two further sensors whose physical interaction with each other is eliminated by the physical configuration of the technical system in the nominal state of the technical system are selected for further measured quantities. For example, the pressures in regions or containers that are not interconnected should not be correlated with each other. However, if such a correlation still exists, this can suggest that there is an unwanted leakage between these regions or containers.

[0011] Thus, in particular, for example, the further sensors may well be arranged on different sides of a barrier that prevents physical interaction between further measured quantities in the nominal state of the technical system.

[0012] A machine learning model can, in particular, for example, learn the normal behavior of a technical system, in which case anything that is "different from this" can be classified as an anomaly, and more specifically, even if this anomaly is only related to small signal components of one or more measurement signals detected by sensors, it can be classified as an anomaly. This is somewhat similar to the fact that when a legitimate resident hammers a nail into a wall, the intrusion notification system does not trigger an alarm, whereas the intrusion notification system identifies the work noise caused by the manual operation of a door lock using a unlocking tool as an attempted intrusion and triggers an alarm.

[0013] In particular, for example, a vehicle or industrial facility that processes one or more starting materials into one or more products by means of one or more processing steps can be selected as a technical system. Currently, a large number of measured values are already detected by sensors in both vehicles and industrial facilities, and by using the method proposed in this specification, such a large number of measured values can be better evaluated with respect to possible anomalies. In particular, a vehicle can mediate a large number of correlations via a vehicle body in which sensors are distributed in a relatively confined space and utilize these correlations to identify anomalies. In the case of industrial facilities, such correlations are mediated, for example, by the material flow of starting materials and / or products passing through the facility. Furthermore, a control device in a vehicle and a "plant historian" in an industrial facility automatically record a plurality of measured values. Using these records, it is possible to obtain training data labeled for both normal and abnormal states, for example, in relation to determining whether an anomaly existed at a specific point in time. Using these labeled training data, the machine learning model can be trained with a teacher. In particular, for example, the conditional probability distribution P D (i|j) can be specified and / or approximated. How far back in the past a machine learning model can refer depends on the selected architecture parameters, for example, on the width of the filter core in a convolutional layer.

[0014] In other advantageous embodiments, a control signal is formed from the classification provided by the machine learning model, and the technical system is controlled by this control signal. For example, in response to an anomaly being detected in a vehicle, it is possible to reduce the maximum speed, prevent the execution of a driving maneuver involving a particular danger (e.g., an overtaking maneuver), or stop a vehicle that is on a pre-planned emergency stop trajectory. For example, it is possible to switch an industrial facility to a safe mode in which the throughput of the facility is reduced to a minimum. In that case, in this safe mode, it is also possible to operate the facility manually, for example if the automatic control has failed.

[0015] As described above, the machine learning model can be trained using the labeled training examples of the tensor K * However, specially labeled training examples for anomalies are often lacking, because in most cases the technical system still functions well with few anomalies occurring.

[0016] Therefore, the present invention provides a method for training a machine learning model for use in the above-described method that can make do with only a few labeled training examples.

[0017] Within the framework of this method, characteristic quantities characterizing the conditional probability distribution P D (i|j) for each pair of observation results of sensors i and j

Number

[0018] The tensor K only in a manner that can also occur during normal operation of the technical system* A distribution of disturbance p that is known not to change is provided.

[0019] An example of such a disturbance p is additive Gaussian noise that may also be included in the observation results supplied by the sensor.

[0020] Another example is that the off - diagonal elements of the tensor K * become probabilistically zero, and the elements

Number

Number

Number

Number

[0021] External disturbance p can create so-called positive pairs and negative pairs for the process of contrast learning. Contrast learning is self-supervised learning based on positive and negative examples where it is known whether they are similar to each other or not.

[0022] Two external disturbances p sampled from the distribution 1 and p 2 are applied to one same training example K * to generate variations

Number

Number

Number

Number

[0023] Two external disturbances p sampled from the distribution 1 and p 2 are applied to two different training examples K *’ and K *’’ to generate variations

Number

Number

Number

Number

[0024] Precisely for training the machine learning model in this regard, using the machine learning model to be trained, from the variants

Number

Number

Number

[0025] Here, within the framework of contrastive learning, the processed products

Number

Number

Number

Number

Number

Number

[0026] This means that the feature extractor of the machine learning model places, within the latent space of its output, the processing products

Number

Number

Number

Number

Number

Number

[0027] That is, the machine learning model can perform most of its training in this self-supervised manner, and for this purpose, there is no need to use labeled training examples.

[0028] Then, for example, the classification head can be trained with labeled training examples K * with a target classification. Since the classification head occupies only a small part of the machine learning model, especially with respect to the number of parameters to be optimized, a relatively small number of labeled training examples are sufficient for training the classification head. In this context, it is also particularly advantageous for the classification head to receive, as input, processed products that have already been well pre-classified as a result of self-supervised training. That is, the classification head does not need to correct what was previously missed at the cost of further training costs.

[0029] The present invention further provides a further method for training a machine learning model for use in the method described at the beginning. Different from the contrastive learning described above, this method uses ordinary supervised training.

[0030] Within the framework of this method, a feature quantity characterizing the conditional probability distribution P D (i|j) for each pair of observation results of sensors i and j

Number

[0031] Here, when the technical system is operating normally, tensor K is changed in a manner that is not expected * by a disturbance p whose distribution is known. * An example of such a disturbance is uniform distribution noise.

[0032] The disturbance p sampled from the distribution * is applied to the training example K * to generate variant

Number

Number

[0033] By this method, when an appropriate distribution of the disturbance p is available for each application, the machine learning model can be directly trained in one step based on the desired classification task. In contrast, when such a distribution of the disturbance p is not available or difficult to model, the above-described approach regarding contrastive learning can be utilized. An important advantage of contrastive learning is that contrastive learning does not depend on the modeling of the disturbance p * When such a distribution of the disturbance p is not available or difficult to model, the above-described approach regarding contrastive learning can be utilized. An important advantage of contrastive learning is that contrastive learning does not depend on the modeling of the disturbance p * When such a distribution of the disturbance p is not available or difficult to model, the above-described approach regarding contrastive learning can be utilized. An important advantage of contrastive learning is that contrastive learning does not depend on the modeling of the disturbance p * is that contrastive learning does not depend on the modeling of the disturbance p.

[0034] Optionally, within the framework of this method, the training example K can be further transformed by applying the disturbance p described in relation to contrastive learning to additional variants* can be extended and then used as additional training examples for normal behavior within the framework of supervised learning.

[0035] In the following, further means for improving the present invention will be described in more detail based on the drawings together with the description of advantageous embodiments of the present invention.

Brief Description of the Drawings

[0036]

Figure 1

Figure 2

Number

Figure 3

Figure 4

Modes for Carrying Out the Invention

[0037] Embodiment FIG. 1 is a schematic flowchart of an embodiment of a method 100 for identifying an abnormality in a technical system 1. The behavior of this system 1 is monitored by an assembly consisting of n sensors.

[0038] In step 110, for each sensor k = 1, ···, n, a time series consisting of N observation results of the sensor at time points t = 1, ···, N

Number

[0039] In this case, according to block 111, at least two sensors can be selected for the measurand, whose physical interaction between them is mediated by the physical configuration of the technical system 1 in its nominal state. According to block 111a, at least two further sensors can then also optionally be selected for the further measurand, whose physical interaction between them is excluded by the physical configuration of the technical system 1 in its nominal state.

[0040] In step 120, for each time instant t=1,...,N and for indices i=1,...,n and j=1,...,n, we calculate a pairwise conditional probability distribution P D Characteristic quantities that characterize (i|j)

number

[0041] In step 130, all the characteristics

number

[0042] In step 140 a control signal 4 is formed from the classifications 3 provided by the machine learning model 2 .

[0043] In step 150 the technical system 1 is controlled by the control signal 4 .

[0044] Figure 2 shows the function of the tensor K based on a simple example with three time-dependent observations x(t), y(t) and z(t). *shows the formation. Starting from the fact that for each time point t, one of the three values x(t), y(t), and z(t) is given, conditional probabilities can be presented for the values of all variables x(t), y(t), and z(t). A characteristic quantity

Number

[0045] Figure 3 is a schematic flowchart of an example of a method 200 for training a machine learning model 2 for use in the method 100 described in relation to Figure 1. Method 200 is based on contrastive learning.

[0046] In step 210, a characteristic quantity D that characterizes the conditional probability distribution P

Number

[0047] In step 220, a distribution of a disturbance p is provided that is known not to change the tensor K * except in a manner that can also occur during the normal operation of the technical system.

[0048] In step 230, by applying two disturbances p 1 and p 2 sampled from the distribution to one and the same training example K * , a positive pair of variations

Number

Number

[0049] In step 240, two disturbances p 1 and p 2 sampled from the distribution are applied to two different training examples K *’ and K *’’ to generate negative pairs

Number

Number

[0050] In step 250, using the machine learning model 2 to be trained, from the variants

Number

Number

[0051] According to block 251, the machine learning model 2 may include a feature extractor 21 that extracts features from the tensor K * and a classification head 22 that maps the features to the searched classification of the behavior of the technical system.

[0052] In step 260,

Number

Number

Number

Number

[0053] In step 270, classification head 22 is trained with supervision using training example K * labeled with the target classification. This means that parameter 22a characterizing the behavior of classification head 22 is optimized for the purpose of mapping training example K * to their respective target classifications by machine learning model 2. In the state where the optimization of these parameters is completed, reference sign 22a * is attached.

[0054] FIG. 4 is a schematic flowchart of an embodiment of method 300 for training machine learning model 2 for use in method 100 described in relation to FIG. 1. This method, unlike method 200, is based on supervised training.

[0055] In step 310, a tensor K D (i|j) characterizing the conditional probability distribution P

Number

[0056] ​ In step 320, a disturbance p * is provided whose distribution changes the tensor K in a manner not expected during the normal operation of the technical system. *

[0057] In step 330, a variant * is generated by applying the disturbance p * sampled from the distribution to the training example K.

Number

[0058] In step 340, on the one hand, using the training example K * regarding the normal behavior of the technical system 1, and on the other hand, using the variant

Number

Number

Claims

1. A method (100) for identifying anomalies in a technical system (1) whose behavior is monitored by an assembly of n sensors, the method (100) comprising: - For each sensor k = 1,..., n, a time series consisting of N observations of the sensor at time points t = 1,..., N 【Number 1】 is detected in step (110); For each time point t = 1,..., N, and for indices i = 1,..., n and j = 1,..., n, a characteristic quantity that characterizes the conditional probability distribution P Ｄ (i|j) of each pair of observation results of the sensors i and j 【Number 2】 is identified in step (120); - All characteristic quantities [Number 3] tensor K ＊ mapping step (130) by the trained machine learning model (2) to a predetermined classification (3) as to whether the behavior of the technical system (1) is normal or abnormal The method (100) comprising.

2. At least two sensors whose physical interaction with each other is mediated by the physical configuration of the technical system (1) in the nominal state of the technical system (1) are selected (111) for the measured quantity, The method (100) according to claim 1.

3. One measured quantity is a measure of the amount of energy supplied to the technical system or a measure of the amount of energy present in the technical system, The other measured quantity is a measure of the amount of energy present or a measure of the amount of energy released by the technical system, The method (100) according to claim 2.

4. At least two further sensors whose physical interaction with each other is eliminated by the physical configuration of the technical system (1) in the nominal state of the technical system (1) are selected (111a) for further measured quantities, The method (100) according to claim 2 or 3.

5. The further sensors are arranged on different sides of a barrier that prevents physical interaction between the further measured quantities in the nominal state of the technical system (1), The method (100) according to claim 4.

6. A vehicle or industrial facility that processes one or more starting materials into one or more products by one or more processing steps is selected as the technical system (1), The method (100) according to any one of claims 1 to 5.

7. - A control signal (4) is formed (140) from the classification (3) supplied by the machine learning model (2), - The technical system (1) is controlled (150) by the control signal (4), The method (100) according to any one of claims 1 to 6.

8. A method (200) for training a machine learning model (2) for use in the method (100) according to any one of claims 1 to 7, the method (200) comprising: ・Conditional probability distribution P for each pair of observation results of sensors i and j Ｄ Characteristic quantity characterizing (i|j) 【Number 4】 tensor K ＊ providing a training example for (step 210), ・Providing a distribution of disturbance p that is known not to change tensor K in any way that could occur even during normal operation of the technical system ＊ and step (220) of providing a distribution of disturbance p that is known not to change tensor K in any way that could occur even during normal operation of the technical system ・Two disturbances p sampled from the distribution １ and p ２ are applied to one same training example K ＊ to obtain a variant 【Number 5】 positive pairs of 【Number 6】 A step (230) of generating ・Two disturbances p sampled from the distribution １ and p ２ are applied to two different training examples K ＊’ and K ＊’’ to obtain a variant 【Number 7】 negative pairs of 【Number 8】 A step (240) of generating ・Using the machine learning model (2) to be trained, the variant 【Number 9】 to generate respective processed products 【Number 10】 A step (250) of generating ・The positive pairs 【Number 11】 processed products related to 【Number 12】 and 【Number 13】 To maximize the similarity between and, and the negative pairs 【Number 14】 processed products related to 【Number 15】 and 【Number 16】 A step (260) of optimizing the parameter (2a) characterizing the behavior of the machine learning model (2) with the aim of minimizing the similarity between and A method (200) comprising

9. ・The machine learning model (2) the tensor K ＊ a feature extractor (21) that extracts features from A classification head (22) that maps the feature to the retrieved classification of the behavior of the technical system Including (251) ・The processed product 【Number 17】 Is formed by the feature extractor (21) (252) The method (200) according to claim 8

10. Training example K labeled with the target classification ＊ using which, the classification head (22) is trained with a teacher The method (200) according to claim 9

11. The disturbance p ・Additive normal distribution noise, and / or ・the tensor K ＊ whose off-diagonal elements become stochastically zero, and / or ・Elements on the plane t 【Number 18】 Are replaced by elements on the plane t + 1 or t - 1, and / or 【Number 19】 Including the method (200) according to any one of claims 8 to 10 ・the tensor K ＊ the planes t, t' thereof are misidentified

12. A method (300) for training a machine learning model (2) for use in the method (100) according to any one of claims 1 to 7, wherein the method (300) A step (330) of generating ・Conditional probability distribution P for each pair of observation results of sensors i and j Ｄ Characteristic quantity characterizing (i|j) 【Number 20】 tensor K ＊ step (310) of providing a training example for, the training example K ＊ relates to the normal behavior of the technical system (1), step (310) and ・During normal operation of the technical system, a disturbance p ＊ that is known to change tensor K in an unexpected manner ＊ is provided with a distribution (step 320); ・ The disturbance p sampled from the distribution ＊ is applied to the training example K ＊ to obtain a variant 【Number 21】 Using to perform supervised training on the machine learning model (2) A step (340) - On the one hand, using the training example K regarding the normal behavior of the technical system (1), and on the other hand, the variation as a training example regarding the abnormal behavior of the technical system (1) ＊ is used 【Number 22】 A method (300) comprising

13. A computer program, which when executed on one or more computers and / or computer instances, includes machine-readable instructions for causing the one or more computers to one or more computer instances to perform the method (100) according to any one of claims 1 to 12, a computer program

14. A machine-readable data medium and / or download product comprising the computer program according to claim 13

15. One or more computers and / or computer instances comprising the computer program according to claim 13 and / or comprising the machine-readable data medium and / or download product according to claim 14 ​

Images