A GNN-based master state generation method for real-time anomaly detection

Abstract

This specification discloses a method for analyzing log data output from a PLC (Programmable Logic Controller) and generating a master state, which is a normal state in a repetitive cycle. Also, a method for generating log data as graph data as data preprocessing for generating the master state is disclosed. The master pattern generation method and cycle analysis model training method according to this specification are differentiated from conventional techniques in that they are a technology for processing a machine control language (Low-Level Language) that is difficult for humans to analyze and converting it into an analyzable language (High-Level Language), that is, a technology based on MLP (machine language processing) that analyzes an executed machine language (language that controls a machine) by a computer and is understandable by humans.

Description

[Technical field]

[0001] The present invention relates to a method for generating a master state of a facility, and more particularly to a method for analyzing log data of the facility and discovering key states in an iterative cycle. [Background technology]

[0002] The material discussed in this section is merely intended to provide background information for the embodiments described herein and does not necessarily constitute prior art.

[0003] PLCs (Programmable Logic Controllers) are primarily used to build automated lines, and are driven by PLC control logic specifications (PLC control logic code) created using operator symbols such as AND / OR and relatively simple functions such as TIMER / FUNCTION BLOCK. Control logic is defined using memory addresses in the PLC hardware, which are called contacts. Automated lines are operated by defining input / output relationships for these contacts and controlling the contact values ​​according to the situation.

[0004] Generally, PLC control logic has many nodes according to the scale of the automation line. Therefore, attempts are being made to analyze the contents of the PLC control logic code between the nodes, analyze the relationship and sequence between the nodes, generate a reference master pattern for determining whether the automation line is operating normally, and detect abnormal situations in the automation line.

[0005] However, the state of an automated line operated by a PLC changes over time due to various reasons, such as equipment deterioration, replacement, and changes in PLC control codes, and the reference master pattern for determining whether the line is operating normally also changes. As a result, it is inappropriate to use a previously generated reference master pattern as basic data for determining whether an automated line in a changed environment is operating normally.

[0006] In addition, in recent years, in the automated manufacturing industry, as the complexity of the manufacturing lines increases, the control logic is designed to be vast and very complicated. Therefore, the PLC program is also logicized in a complicated manner. For this reason, it is also becoming more and more difficult to diagnose and monitor the PLC program, and the time required to find and correct errors tends to gradually increase. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Korean Patent No. 10-1527419 Summary of the Invention [Problem to be solved by the invention]

[0008] The present specification aims to provide a method capable of treating the operating states of equipment and processes as finite states and generating a master state based on a GNN.

[0009] The present specification is not limited to the above-mentioned problems, and other problems not mentioned herein will be clearly understood by those skilled in the art from the following description. [Means for solving the problem]

[0010] The graph data generating method according to the present specification for solving the above-mentioned problems includes the steps of (a) dividing log data represented by a Gantt chart into one state for each section in which a node value changes; (b) identifying main states from the divided states, adding at least one sensor value for each section corresponding to the main states, and converting the log data into node matrix data according to the order of generation of the main states to which the sensor values ​​were added; and (c) defining connection relationships between the divided states, representing the divided states as nodes, representing connection relationships between the divided states as edges, and converting the log data into edge index data.

[0011] According to an embodiment of the present disclosure, the step (a) may further include assigning a distinguishing feature for dividing the states according to the changed contact value.

[0012] According to one embodiment of the present specification, step (b) may be a step of counting the number of states having the same identifying characteristic, and identifying a state having a number equal to or greater than a preset value as a main state.

[0013] According to an embodiment of the present disclosure, the step (b) may further include assigning an identification code to the identified main state in a one hot encoding format.

[0014] According to one embodiment of the present specification, in step (b), when there are two or more sensor values ​​output from one sensor within the interval, one representative value may be selected and added.

[0015] According to an embodiment of the present specification, the connection relationship may be a necessary or exclusive condition.

[0016] According to one embodiment of the present specification, step (c) may include deleting nodes that do not correspond to major states from the node matrix data, connecting the nodes before and after the deleted node, and converting the data into edge index data.

[0017] The method for generating a master state according to the present specification for solving the above-mentioned problems is a method for generating a master state using a plurality of graph data generated by the graph data generation method described in the present specification, and includes the steps of: (a) inputting one of the plurality of graph data that has not yet been input into a GNN AutoEncoder as input data; (b) calculating a difference value of a sensor value between the reconstructed data output by the GNN AutoEncoder and the input data (hereinafter, "analog level loss"); (c) calculating an average value of the analog level loss for each node (hereinafter, "node level loss") and calculating an average value of the node level loss for each graph (hereinafter, "graph level loss"); (d) re-learning the GNN AutoEncoder using the graph level loss; and (e) repeatedly executing steps (a) to (d) when there is any graph data remaining among the plurality of graph data that has not yet been input.

[0018] According to one embodiment of the present specification, the method may further include a step of: (f) calculating an average value and a standard deviation of the node-level losses when all the graph data are input as input data to a GNN AutoEncoder, and setting a value obtained by adding the average value to a standard deviation value reflecting a preset parameter as an upper limit standard of the master state.

[0019] According to another embodiment of the present specification, the method may further include a step of: (f) calculating an average value and a standard deviation of the graph-level loss when all the graph data are input as input data to a GNN AutoEncoder, and setting a value obtained by adding the average value to a standard deviation value reflecting a preset parameter as an upper limit standard of the master state.

[0020] The graph data generating method according to the present disclosure may be embodied as a computer program recorded on a computer-readable recording medium, the computer program being prepared to execute each step of the graph data generating method on a computer.

[0021] The method for generating a master state according to the present disclosure may be embodied as a computer program recorded on a computer-readable recording medium, the computer program being prepared so that each step of the method for generating a master state is executed by a computer.

[0022] Further details of the invention are contained in the detailed description and the drawings. Effect of the Invention

[0023] According to one aspect of the present invention, a master state can be generated based on a GNN from log data and control logic.

[0024] According to another aspect of the present specification, by analyzing and graphing the correlation between static and dynamic data flows while the device to be analyzed is being controlled, it is possible to provide multifaceted services such as control logic inspection, control logic generation, real-time anomaly detection, reproducibility, productivity, and quality analysis via an AI model such as a Graph Neural Network (GNN).

[0025] The effects of the present invention are not limited to those mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the following description. [Brief description of the drawings]

[0026] [Figure 1] FIG. 1 is a general flow reference diagram of the invention disclosed herein. [Diagram 2] 1 is a schematic flow chart of a method for generating graph data according to the present disclosure; [Diagram 3] FIG. 13 is a reference diagram for log data collection. [Figure 4] FIG. 13 is a reference diagram of state division and state identification features. [Diagram 5] This is a reference diagram that identifies the main conditions. [Figure 6] FIG. 13 is a reference diagram in which a sensor value is added for each section. [Figure 7] FIG. 13 is a reference diagram in which a sensor value is added for each section. [Figure 8] FIG. 11 is a reference diagram in which log data is converted into node matrix data. [Figure 9] FIG. 13 is a reference diagram showing that connection relationships between adjacent states are defined. [Figure 10] This is a reference diagram for removing nodes corresponding to the Minor state. [Figure 11] FIG. 11 is a reference diagram regarding the relationship between log data, node matrix data, edge index data, and graph data. [Figure 12] FIG. 1 is a reference diagram of the relationship between graph data and cycles. [Figure 13] This is a reference diagram of an AutoEncoder. [Figure 14] 1 is a schematic flow chart of a method for generating a master state according to the present disclosure; [Figure 15] FIG. 1 is a reference diagram for a method of generating a master state according to this specification. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0027] The advantages and features of the present invention disclosed herein, as well as the methods for achieving them, will become clearer with reference to the following detailed embodiments in conjunction with the accompanying drawings. However, the present disclosure is not limited to the embodiments disclosed below, and may be embodied in various different forms, and the embodiments are provided merely to complete the disclosure of the present specification, and to allow those skilled in the art (hereinafter, "those skilled in the art") to fully understand the scope of the present specification, and the scope of the present specification is defined only by the scope of the claims.

[0028] The terms used in the present specification are for the purpose of describing the embodiments and are not intended to limit the scope of the present specification. In the present specification, the singular form includes the plural form unless otherwise specified. The words "comprises" and / or "comprising" used in the specification do not exclude the presence or addition of one or more other components in addition to the components described.

[0029] The same reference numerals refer to the same elements throughout the specification, and the term "and / or" includes each of the elements mentioned and all combinations of one or more. Although "first", "second", and the like are used to describe various elements, it is understood that these elements are not limited by these terms. These terms are used merely to distinguish one element from another element. Therefore, it is understood that the first element described below can be the second element within the technical concept of the present invention.

[0030] Unless otherwise specified, all terms (including technical and scientific terms) used in this disclosure may be used in a manner commonly understood by ordinary skilled artisans in the technical field to which this specification belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless expressly defined otherwise. Hereinafter, an embodiment of the present invention will be described in detail with reference to the attached drawings.

[0031] The definitions of terms used in this specification are as follows:

[0032] The Master State refers to a model that graphs the process states and the relations between the states, and then uses a GNN (Graph Neural Network) model to graph the graphed data to show a "standard process graph" such as the "standard state" and "standard relationship" of each phase.

[0033] PLC (Programmable Logic Controller) refers to a highly autonomous control device that adds a numerical calculation function to basic sequence control (replacement of relay, timer, counter, etc. functions with semiconductor elements such as ICs and transistors) and enables program control. For reference, the National Electrical Industry Standard defines it as "a digitally operated electronic device that uses programmable memory to perform special functions such as logic, sequence, timer, counter, and calculation through digital or analog input / output modules and controls various types of machines and processors."

[0034] Log data is the result of collecting PLC contact data at regular intervals. Depending on the operation of equipment on the line, the value of the contact on the PLC related to the operation changes. A log is collected every time the contact value on the PLC changes. The log data is data represented as [contact name, value, date and time], and is the value data of a specific contact at the corresponding date and time.

[0035] A cycle refers to a period during which the contact data is repeated at a regular interval. The unit of a cycle may be a factory, a line, a process, or the like.

[0036] FIG. 1 is a general flow diagram of the invention disclosed herein.

[0037] Referring to Fig. 1, the invention disclosed herein may be carried out in the order of a "graph data generation method" of first collecting data and preprocessing the collected data, and a "master state generation method" using the generated graph data. Hereinafter, the "graph data generation method" and the "master state generation method" will be described in more detail in this specification. Each step of the "graph data generation method" and the "master state generation method" according to this specification may be executed by a processor.

[0038] FIG. 2 is a schematic flow chart of a method for generating graph data according to the present disclosure.

[0039] First, the log data collected in step S10 can be represented in a Gantt chart.

[0040] FIG. 3 is a reference diagram for log data collection.

[0041] Referring to FIG. 3, a log is generated in the PLC every time the equipment executes a specific operation. By collecting the logs generated in this way, data represented by [contact name, value, date and time], i.e., log data, can be collected. In the example shown in FIG. 3, "1" means that the contact changes from an "off" state to an "on" state, and "0" means that the contact changes from an "on" state to an "off" state. The collected log data can be represented in a Gantt chart as shown in FIG. 3.

[0042] Referring again to FIG. 2, in the next step S11, in the log data represented by the Gantt chart, each section in which the contact value changes can be divided into one state.

[0043] FIG. 4 is a reference diagram for state division and state identification features.

[0044] TIFF0007660938000001.tif71170

[0045] Referring back to FIG. 2, in the next step S12, the number of states having the same identifying feature is counted, and a state having a number equal to or greater than a preset value can be identified as a main state.

[0046] FIG. 5 is a reference diagram that identifies the main conditions.

[0047] TIFF0007660938000002.tif70170

[0048] Referring back to FIG. 2, in step S13, at least one sensor value may be added for each section corresponding to the main condition.

[0049] 6 and 7 are reference diagrams in which sensor values ​​are added for each section.

[0050] TIFF0007660938000003.tif53170

[0051] TIFF0007660938000004.tif37170

[0052] Referring again to FIG. 2, the log data can be converted into node matrix data according to the generation order of the main states to which the sensor values ​​are added in step S14.

[0053] FIG. 8 is a reference diagram in which log data is converted into node matrix data.

[0054] 8, each main state corresponds to one node, and each node corresponds to an identification code. When converted to the node matrix data, the node needs to maintain the order of the log data.

[0055] 2, in step S15, connection relationships between the divided states can be defined. The connection relationships can be necessary or exclusive conditions.

[0056] FIG. 9 is a reference diagram showing the definition of connection relationships between adjacent states.

[0057] Referring to FIG. 9, in state 0, "Y12B1" is "ON", and in state 1, "Y06A2" is "ON". At this time, in order for "Y06A2" to be "ON", "Y12B1" needs to be "ON", so "state 0" is in a "necessary condition" relationship for "state 1". Also, in state 1, "Y12B1" and "Y06A2" need to be "OFF" before "Y0494" is "ON" in state 3. At this time, in order for "Y0494" to be "ON", "Y12B1" and "Y06A2" need to be "OFF", so "state 1" is in an "exclusive condition" relationship for "state 3".

[0058] Referring back to FIG. 2, in step S16, the split states may be represented as nodes, connections between the split states may be represented as edges, and the log data may be converted into edge index data.

[0059] Referring again to FIG. 9, it can be seen that the states are represented by a graph connected by edges and an edge index.

[0060] Meanwhile, since the node matrix only describes information about the "major states," it is necessary to similarly leave only the nodes corresponding to the major states in the edge index, and remove the nodes corresponding to the rarely occurring states (Minor). According to one embodiment of the present specification, it is possible to delete the nodes that do not correspond to the major states from the node matrix data, and connect the nodes before and after the deleted node to convert it into edge index data.

[0061] FIG. 10 is a reference diagram for removing nodes corresponding to the Minor state.

[0062] Referring to FIG. 10, node 5, which does not correspond to a main state, is to be deleted. The example on the left shows a relationship in which node 3 and node 4 enter node 5, and node 5 exits node 6. Therefore, node 5 can be deleted, and node 3 and node 4 can be changed to enter node 6 directly. At this time, node 6 is changed to node 5 according to the node order, and node 7 is changed to 6. The example on the right shows a relationship in which node 4 enters node 5, and node 5 exits node 6 and node 7. Therefore, node 5 can be deleted, and node 4 can be changed to exit node 6 and node 7. At this time, node 6 is changed to node 5 according to the node order, and node 7 is changed to node 6. Through the above process, the nodes of the node matrix data and the nodes of the edge index data can have a corresponding relationship with each other.

[0063] Through the above process, the raw data is converted into node matrix data and edge index data, which can be combined and represented as graph data.

[0064] FIG. 11 is a reference diagram showing the relationship between the log data, node matrix data, index data, and graph data.

[0065] On the other hand, in a production process, it is common for the same operation to be repeated in the same equipment. Therefore, the collected log data (raw data) should also repeat a cycle containing similar data, and in this case, one piece of graph data can correspond to one cycle.

[0066] FIG. 12 is a reference diagram showing the relationship between the graph data and the cycle.

[0067] In the following, the master state method will be described using graph data (node ​​matrix data+edge index data) generated by the graph data generation method according to this specification.

[0068] Prior to learning the model, an autoencoder will be described.

[0069] FIG. 13 is a reference diagram for an AutoEncoder.

[0070] TIFF0007660938000005.tif121170

[0071] In particular, an autoencoder can be freely applied by changing the network used for the encoder and decoder depending on the type of target data. In the case of image data, a convolution neural network (CNN) is used for the encoder and decoder, and in the case of table data, a multi-layered perceptron (MLP) is used for the encoder and decoder. In light of this, the master state generation method according to this specification is an extension to graph data by using a graph neural network (GNN) for the encoder and decoder.

[0072] FIG. 14 is a schematic flow chart of a method for generating a master state according to the present disclosure.

[0073] FIG. 15 is a reference diagram of a method for generating a master state according to this specification.

[0074] TIFF0007660938000006.tif28170

[0075] TIFF0007660938000007.tif28170

[0076] TIFF0007660938000008.tif28170

[0077] TIFF0007660938000009.tif18170

[0078] In the next step S24, it can be determined whether or not there is any graph data that has not been input among the plurality of graph data. If there is any graph data that has not been input (YES in S24), the process can proceed to step S20. In step S20, one graph data that has not been input among the plurality of graph data is input as input data to a GNN AutoEncoder, and steps S20 to S24 can be repeatedly executed.

[0079] Meanwhile, when all the graph data are input to the GNN AutoEncoder, the GNN AutoEncoder has completed learning. Then, the GNN AutoEncoder that has completed learning can be used to determine whether or not there is an abnormality in the process. However, it is necessary to set a reference range, i.e., an upper limit, for determining whether or not there is an abnormality.

[0080] According to one embodiment of the present specification, in step S25, when all the graph data are input to a GNN AutoEncoder as input data, the node level average value (μ) and standard deviation (σ) are calculated, and the average value plus a standard deviation value reflecting a preset parameter can be set as an upper limit reference of the master state. For example, when the preset parameter is 1.5, the upper limit value for determining whether or not there is an anomaly in the node level loss can be “μ±1.5σ”.

[0081] According to another embodiment of the present specification, when all the graph data are input as input data to a GNN AutoEncoder in step S25, an average value and a standard deviation of the graph-level loss are calculated, and a value obtained by adding a standard deviation value reflecting a preset parameter to the average value may be set as an upper limit criterion of the master state. For example, when the preset parameter is 1.5, an upper limit value for determining whether or not there is an abnormality in the graph-level loss may be "μ±1.5σ".

[0082] The artificial neural network trained according to the above description is capable of tracking not only whether there is an error in the cycle when new cycle data is input, but also whether the error occurs at a certain node and / or any link. The master pattern generation method and cycle analysis model training method according to the present specification are different from the conventional technology in that they are a technology that processes a machine control language (Low-Level Language) that is difficult for humans to analyze and converts it into an analyzable language (High-Level Language), that is, a technology based on MLP (machine language processing) that analyzes the executed machine language (language that controls the machine) by a computer and is understandable by humans. By using the cycle analysis model according to the present specification, it is possible to provide multifaceted services such as control logic inspection, control logic generation, real-time detection, reproducibility, productivity, and quality analysis based on an AI model such as GNN (Graph Neural Network) by analyzing and graphing the correlation of static and dynamic data flows while the device to be analyzed is controlled.

[0083] In addition, the graph data generating method and the master state generating method according to the present specification may include a processor, an application-specific integrated circuit (ASIC), other chipsets, logic circuits, registers, communication modems, data processing devices, etc., known in the art to which the present invention pertains, to execute the described calculations and various control logics. In addition, when the above-mentioned control logic is realized in software, the processor may be embodied as a collection of program modules. In this case, the program modules may be stored in the memory device and executed by the processor.

[0084] The program may include code coded in a computer language such as C / C++, C#, JAVA, Python, machine language, etc. that the processor (CPU) of the computer can read through the device interface of the computer to cause the computer to read the program and execute the method embodied as the program. Such code may include functional code related to functions defining functions necessary to execute the method, and may include control code related to execution procedures required for the processor of the computer to execute the function according to a predetermined procedure. Furthermore, such code may further include memory reference related code for additional information required for the processor of the computer to execute the function, and at which location (address, address) in the internal or external memory of the computer the media should be referenced. In addition, if the processor of the computer needs to communicate with any other remote computer, server, etc. to execute the function, the code may further include communication related code for how to communicate with any different remote computer, server, etc. using the communication module of the computer, and what information or media should be transmitted and received during communication.

[0085] The storage medium refers to a medium that stores data semi-permanently and can be read by a device, rather than a medium that temporarily stores data such as a register, cache, memory, etc. In particular, examples of the storage medium include, but are not limited to, ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc. That is, the program can be stored in various recording media on various servers to which the computer can be connected or various recording media on the user's computer. Also, the media can be distributed among computer systems connected by a network to store computer readable code in a distributed manner.

[0086] Although the embodiments of the present invention have been described above with reference to the attached drawings, those skilled in the art to which the present disclosure pertains will understand that the present invention can be embodied in other specific forms without departing from the technical spirit or essential characteristics thereof. Therefore, the embodiments described above should be understood to be illustrative and not restrictive in all respects. [Industrial Applicability]

[0087] The present invention can generate a master state based on a GNN from log data and control logic, and by analyzing and graphing the correlation between static and dynamic data flows while the device to be analyzed is being controlled, it can provide multifaceted services such as control logic inspection, control logic generation, real-time anomaly detection, reproducibility, productivity, and quality analysis through AI models such as a GNN (Graph Neural Network).

Claims

1. (a) a step in which a processor divides log data represented by a Gantt chart into one state for each section in which a node value changes; (b) the processor identifies major states from the divided log data, adds at least one sensor value to each section corresponding to the major states, and converts the log data into node matrix data according to a generation order of the major states to which the sensor values ​​are added; and (c) defining connection relationships between states from the partitioned log data, representing states of the partitioned log data as nodes, representing connection relationships of the partitioned log data as edges, and converting the log data into edge index data.

2. The step (a) comprises: The method of claim 1 , further comprising the processor assigning distinguishing features for delimiting states according to changed junction values.

3. The step (b) comprises:

3. The graph data generating method according to claim 2, further comprising the step of: counting the number of states having the same identifying characteristic by the processor; and identifying a state having a number equal to or greater than a preset value as a main state.

4. The step (b) comprises:

4. The graph data generating method of claim 3, further comprising: assigning identification codes in a one hot encoding format to the principal states identified by the processor.

5. The step (b) comprises:

2. The graph data generating method according to claim 1, wherein when two or more sensor values ​​output from one sensor exist within an interval, said processor selects and adds one representative value.

6. The graph data generating method according to claim 1 , wherein the connection relationship is a necessary condition or an exclusive condition.

7. The step (c) comprises:

2. The graph data generation method according to claim 1, wherein the processor deletes nodes that do not correspond to major states from the node matrix data, connects the nodes before and after the deleted node, and converts the data into edge index data.

8. A method for generating a master state using a plurality of generated graph data according to any one of claims 1 to 7, comprising the steps of: (a) inputting, by the processor, one piece of graph data that has not yet been input among the plurality of graph data into a GNN AutoEncoder as input data; (b) the processor calculates a difference value of a sensor value between the reconstructed data output by the GNN AutoEncoder and the input data (hereinafter, "analog level loss"); (c) the processor calculating an average of the analog-level losses for each node (hereinafter "node-level losses") and an average of the node-level losses for each graph (hereinafter "graph-level losses"); (d) the processor retraining the GNN AutoEncoder using the graph-level loss; and (e) when there is graph data remaining among the plurality of graph data that has not yet been input, the processor repeatedly executes steps (a) to (d).

9. 10. The method of claim 8, further comprising: (f) when all of the graph data are input to a GNN AutoEncoder as input data, the processor calculates an average value and a standard deviation of the node-level losses, and sets a value obtained by adding a standard deviation value reflecting a preset parameter to the average value as an upper limit standard of the master state.

10. 9. The method of claim 8, further comprising: (f) when all of the graph data are input to a GNN AutoEncoder as input data, the processor calculates an average value and a standard deviation of the graph-level loss, and sets a value obtained by adding a standard deviation value reflecting a preset parameter to the average value as an upper limit standard of the master state.

11. A computer program that is created to execute each step of the graph data generation method according to any one of claims 1 to 7 and is recorded on a computer-readable recording medium.

12. A computer program that is created to execute each step of the method for generating a master state according to claim 8 and that is recorded on a computer-readable recording medium.

Images