Detecting anomalies in a plurality of showcases

Systems and methods for detecting anomalies in a plurality of showcases are provided. A system can obtain a corresponding table between each of the plurality of showcases and at least one corresponding sensor. The system obtains information for showcase clustering. The system can include a processor device that can determine at least one cluster of showcases based on the information for showcase clustering and the corresponding table between each of the plurality of showcases and the at least one corresponding sensor. The system can build at least one model for each of the at least one cluster of showcases and detect at least one anomaly based on data from the at least one cluster of showcases and the at least one model.

BACKGROUND

Technical Field

The present invention relates to cooling device monitoring and more particularly to detecting anomalies in the refrigeration showcases.

Description of the Related Art

Refrigeration showcases, chillers and refrigerators are important equipment in retail stores. Their improper use may greatly increase their electric utility cost. This cost can be huge since the electric utility cost of operating refrigeration showcases is often a half (or more) of the electric utility cost in a store. In addition, opportunity loss is incurred whenever the showcases stop their services due to a failure. Early anomaly detection is important to reduce those losses.

SUMMARY

According to an aspect of the present invention, a method is provided for detecting anomalies in showcase. The method includes obtaining a corresponding table between each of the showcases and at least one corresponding sensor and obtaining information for showcase clustering. The method also includes determining, by a processor device, at least one cluster of showcases based on the information for showcase clustering and the corresponding table between each of the showcases and the at least one corresponding sensor. The method further includes building at least one model for each of the at least one cluster of showcases and detecting at least one anomaly based on data from the at least one cluster of showcases and the at least one model.

According to another aspect of the present invention, a system is provided for detecting anomalies in showcases. The system includes a processor device operatively coupled to a memory device. The processor device is configured to obtain a corresponding table between each of the showcases and at least one corresponding sensor and obtain information for showcase clustering. The processor device is further configured to determine at least one cluster of showcases based on the information for showcase clustering and the corresponding table between each of the showcases and the at least one corresponding sensor. The processor device is also configured to build at least one model for each of the at least one cluster of showcases, and detect at least one anomaly based on data from the at least one cluster of showcases and the at least one model.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

In accordance with the present invention, systems and methods are provided for fault detection in clustered showcases rather than individual showcases. The various embodiments build clusters of showcases and then builds a model for each cluster with multi-variate time series data to learn data properties over normally running periods. Using the model, the various embodiments keep monitoring system status by checking the reconstruction error from the model. When the error becomes large, the embodiments provide an alert to report a failure of the showcase(s).

Embodiments disclosed herein reduce the uncertainty of models for detecting anomalies by considering only similar or dependent showcases together. The various embodiments can find robust features for anomaly detection among attributes and/or parameters associated with the showcases. As a result, the embodiments reduce influence from noise, dynamics or both in time series data. The dynamics in time series data from the showcases can include non-stationary process with sudden change during normal status of the showcases. The noise in time series data from the showcases can include meaningless information and/or information that cannot be interpreted. The models can be used to identify features (or attributes) in the data sets that are most relevant to determining an accurate prediction of the behavior of the showcases and deviations from this behavior (for example, anomalies).

Referring now in detail to the figures in which like numerals represent the same or similar elements and initially toFIG. 1, an exemplary computer system (e.g., a server or a network device) for anomaly detection for clustered showcases is shown in accordance with an embodiment of the present invention. The computer system100includes at least one processing device (CPU)105operatively coupled to other components via a system bus102. A cache106, a Read Only Memory (ROM)108, a Random-Access Memory (RAM)110, an input/output (I/O) adapter120, a network adapter190, a user interface adapter150, a cluster modeling device170, a cluster management device180and a display adapter160, can be operatively coupled to the system bus102.

A first storage device122and a second storage device129can be operatively coupled to system bus102by the I/O adapter120. The storage devices122and129can be any of a disk storage device (e.g., a magnetic or optical disk storage device), a solid state magnetic device, and so forth. The storage devices122and129can be the same type of storage device or different types of storage devices. Either or both of the storage devices122and129can be configured to operate as a data store or database to store various logs of system events (e.g., heterogeneous logs). The cluster modeling device170, and cluster management device180can include software and/or hardware as described herein below.

A transceiver195can be operatively coupled to system bus102by network adapter190. A display device162is operatively coupled to system bus102by display adapter660. Sensor data220can be operatively coupled to system bus102directly or indirectly, for example via cluster management device180and cluster modeling device170. The cluster modeling device170can be configured to build refrigeration showcase clusters with corresponding table between the refrigeration showcases and sensors and information for showcase clustering, for example as described herein below with respect toFIG. 2. The cluster management device180can be configured to receive sensor data220(for example, in real time) and, for each cluster of refrigeration showcases, build a model, and then apply the model to the refrigeration showcases for monitoring, for example as described herein below with respect toFIG. 3. If anomaly is detected, the cluster management device180can generate an alert for users.

A first user input device152and a second user input device159can be operatively coupled to system bus102by user interface adapter150. The user input devices152and159can be any of a sensor, a keyboard, a mouse, a keypad, a joystick, an image capture device, a motion sensing device, a power measurement device, a microphone, a device incorporating the functionality of at least two of the preceding devices, and so forth. Of course, other types of input devices can also be used in accordance with the present invention. The user input devices152and159can be the same type of user input device or different types of user input devices. The user input devices152and159can be used to input and output information to and from system100.

Other embodiments of the present invention can optionally include further processing units including a graphics processing unit (“GPU”), a mother board, or alternatively/additionally another storage medium, an operating system, one or more application software, as well as including one or more communication interfaces (e.g., RS232, Ethernet, Wi-Fi, Bluetooth, USB). Useful examples of computing devices optionally included in or integrable with embodiments of the present invention include, but are not limited to, personal computers, smart phones, laptops, mobile computing devices, tablet PCs, and servers. In accordance with embodiments of the present invention, an event record log source can be a computer storage medium.

It should be understood that multiple computing devices can be operably linked to form a computer network in a manner as to distribute and share one or more resources, such as clustered computing devices and server banks/farms. In embodiments of the present invention each of the aforementioned elements (e.g., device, medium, source, or module) can be directly or indirectly communicably connected (e.g., via a wireless a wired electronic connection) to at least one other element of the system. As described in more detail below, some embodiments of the present invention can be wholly contained within a single computing device. Other embodiments however, can encompass a plurality of interconnected or networked devices and resources.

Referring now toFIG. 2, a system for clustered refrigeration showcase monitoring is illustratively depicted in accordance with an embodiment of the present invention.

As shown inFIG. 2, system200includes multiple showcases210(shown individually as210-a,210-band210-c, by way of example) and time series data220(shown individually as220-a,220-b,220-cand220-d, by way of example) generated by a sensor network215that receives data from the showcases210. The showcases210may include refrigeration showcases, chillers, freezers and refrigerators and similar equipment deployed, for example, in retail stores or other commercial locations in which multiple cooling devices are deployed (for example, factories, medical laboratories, packaging facilities, abattoirs, etc.). As is shown by the different shapes of the time series data curves220-ato220-d, the variation in data from the sensors associated with the different showcases (and, in some instances, associated refrigeration units) can at times be large.

The refrigeration showcases in retail stores are affected by external environment and operations. In some instances, the external environment and operations causes large change in time series data220of sensors on showcases210. This may increase the number of false positives (or the probability of false positives) when anomaly detection methods are applied. The cluster anomaly monitoring server230reduces the false positives by clustering (data from) the showcases210and applying analysis to the clustered showcases.

The cluster anomaly monitoring server230retrieves a data stream (selected, for example, from220-ato220-d) from each of the showcases210via the sensor network215. For example, the sensor network215can provide sensor data220from sensors215embedded in each of the showcases210to the cluster anomaly monitoring server230. The example embodiments described herein below are (for the most part) directed towards instances in which only showcases210are targeted for monitoring for purposes of simplicity and clarity of explanation. However, the example embodiments can be applied to other scenarios for monitoring equipment. For example, sensors on refrigerators and on the store (for example, heating, ventilation and air conditioning (HVAC) systems, freezers, etc.) can also be modeled together with those on showcases210.

The cluster anomaly monitoring server230can log the sensor data220, e.g., in a memory or storage device, or in a database. The sensor data220includes, for example, compressor frequency, temperature, electricity consumption, etc. The sensor data220including time series data220-ato220-dfrom each of the showcases210is input224into cluster anomaly monitoring server230. Raw time series data from showcases is dynamic and noisy in general.

Cluster anomaly monitoring server230implements a fault detection process for clustered showcases210(rather than individual showcases). Cluster anomaly monitoring server230builds clusters of showcases210and then builds a model for each cluster with multi-variate time series data to learn data properties over normally running periods. At first, cluster anomaly monitoring server230builds a model with given multivariate time series data220as shown inFIG. 2. After building the model(s), cluster anomaly monitoring server230computes the score for abnormality in real time using given the latest observation in the time series, in a manner such as described herein below with respect toFIG. 3. Extracting the data from the clustered showcases210reduces the effect of noise on the anomaly detection process.

When building a model for clustered showcases from multi-variate time series, the cluster anomaly monitoring server230can use any data driven modeling which can model dependency between attributes such as long short-term memory (LSTM) auto-encoder, invariant relationships, and principal component analysis (PCA) based method, etc.

Referring now toFIG. 3, a system for clustered refrigeration showcase monitoring is illustratively depicted in accordance with an embodiment of the present invention.

Using a model for clustered refrigeration showcase monitoring, such as determined with respect toFIG. 2herein above, cluster anomaly monitoring server230keeps monitoring system status by checking the reconstruction error from the model. Reconstruction error may be used for an auto-encoder (or similar), where the goal is either to reduce the dimensionality of the input then reconstruct the original input, or to take in noise-perturbed input and reconstruct original input. In instances in which the system status is normal, the reconstruction error is small. When the error goes large, the cluster anomaly monitoring server230detects system failure (for example, with respect to certain clusters of the clustered showcases210) and gives alert to report the system failure.

If the error score is higher than a predetermined threshold, the cluster anomaly monitoring server230notifies its user through the client240that an anomaly happened at showcases210. Given the notification, the user can call to a technician to fix the problem. In some instances, cluster anomaly monitoring server230can address faults by, for example, shutting down systems and equipment that are malfunctioning, as indicated by the fault, shutting down or resetting devices to prevent hazardous situations caused by or associated with the fault, dispatching maintenance teams, issuing alerts via the internet, email, simple messaging service (SMS) or other communication medium, or any other appropriate response to the fault.

If an anomaly is detected, cluster anomaly monitoring server230generates an alert for users. Cluster anomaly monitoring server230can analyze sensor data220to determine anomalous behavior. For such analysis, the cluster anomaly monitoring server230can determine behavior that does not match normal operating behavior of the refrigeration showcases210(for example, power consumption or temperature that is outside of a predetermined range, etc.).

Cluster anomaly monitoring server230can also provide ranking scores for sensors215. Based on the ranking score, cluster anomaly monitoring server230can inform the user240as to which sensors215provide the most relevant information about the failure. In addition, the cluster anomaly monitoring server230can notify the user as to the location of the faulty showcase or identify the faulty component in the showcase. Additionally, cluster anomaly monitoring server230can provide estimate value(s) for each sensor215. Cluster anomaly monitoring server230can thereby allow an end user240to visualize expected behavior in sensor215and actual behavior of sensor215concurrently. For example, the expected behavior and actual behavior may be displayed in graphical form on a user interface. The cluster anomaly monitoring server230can shorten the time to fix the issue with the refrigeration showcases210and thereby reduce power consumption, maintain the displayed goods at required temperatures, prevent spoilage, increase customer retention, etc.

Referring now toFIG. 4, information elements400for clustered refrigeration showcase monitoring are illustratively depicted in accordance with an embodiment of the present invention.

The information elements400can be stored by cluster anomaly monitoring server230in an associated data storage (for example, first storage device122and a second storage device129, as described herein above with respect toFIG. 1) and then accessed for use in clustered refrigeration showcase monitoring.

Appropriate clustering of showcases increases the accuracy of anomaly detection. To reduce influence from noise, dynamics (for example, regular fluctuations in the data, non-linear behavior that is not attributable to a fault, etc.) or both in time series data220, cluster anomaly monitoring server230uses information for showcase clustering410that implies similarity or dependency between showcases210. Considering only similar or dependent showcases210together, cluster anomaly monitoring server230can reduce uncertainty of the model and find robust features for anomaly detection among the showcases210. As a result, cluster anomaly monitoring server230can reduce influence from noise, dynamics or both in time series data. The information for showcase clustering410can be classified (or further stored, accessed, etc.) according to several options.

Data driven clustering420builds showcase clusters based on multiple or single time series. In particular, temperature in the showcase can be good candidate for clustering since temperature in the showcase reflect showcase's property and usage directory. Cluster anomaly monitoring server230can apply general time series clustering technique. For example, cluster anomaly monitoring server230makes a correlation matrix and then applies a clustering algorithm, for example spectral clustering, to the correlation matrix.

Topology driven clustering430builds showcase clusters based on connectivity of showcases210. In a store, each showcase210is connected to one of the refrigerators in a store. With this information on connectivity, cluster anomaly monitoring server230builds showcase clusters (based on the topology of the refrigerators and showcases in the store). For example, when a refrigerator is connected to three showcases210, a cluster consists of those three showcases.

Product similarity-based clustering440builds showcase clusters based on model number of the product. If the products in the showcases210are same or relevant/related, cluster anomaly monitoring server230identifies a cluster consisting of those showcases210.

Cluster anomaly monitoring server230builds a model for each showcase cluster. Cluster anomaly monitoring server230can build a model for a showcase cluster from attributes which spatially belongs to one of the showcases210in the cluster. There is no overlap in terms of the sensors among different showcase cluster models. However, attributes which are not unique for a showcase210can be shared among those showcase cluster models. For example, attributes such as temperature in the store, humidity in the store, sensor readings on refrigerators, etc., can be shared among different showcase cluster models.

Referring now toFIG. 5, a method500for clustered refrigeration showcase monitoring is illustratively depicted in accordance with an embodiment of the present invention.

At block510, cluster anomaly monitoring server230obtains a corresponding table between showcases210and sensors215. The table can identify which of the sensors215are associated with each showcase210.

At block520, cluster anomaly monitoring server230obtains information for showcase clustering410. The information includes, for example, time series data of temperature in showcases210. The information can include data driven clustering420information, topology driven clustering430, and product similarity-based clustering440, such as described herein above with respect toFIG. 4.

At block530, cluster anomaly monitoring server230performs showcase clustering based on the information for showcase clustering410and the corresponding table between showcases210and sensors215.

At block540, cluster anomaly monitoring server230can build models for each clustered showcase210with multi-variate time series data to learn data properties over normally running periods. According to an embodiment, cluster anomaly monitoring server230receives historical information regarding the identified showcases210. According to another embodiment, cluster anomaly monitoring server230receives multi-variate time series data regarding the performance of showcases210from different locations as well as additional information regarding the particular locations, such as a local temperature/weather, a time of day at which the data is measured, seasonal information, new product introduction times, etc. The model can also incorporate information regarding the reliability of a power supply (for example, brownouts or blackouts). Cluster anomaly monitoring server230can thereby expand the model to include a real-time or near real-time view of the expected behavior of customers and other factors, such as a power supply.

At block550, cluster anomaly monitoring server230monitors showcases210using the model built for each cluster. Cluster anomaly monitoring server230may store the models with the identified showcase clusters.

At block560, cluster anomaly monitoring server230determines whether an anomaly is found using reconstruction error (based on the model). If cluster anomaly monitoring server230does not detect any anomalies (anomaly found using reconstruction error? No), cluster anomaly monitoring server230continues monitoring (block550).

At block570, if cluster anomaly monitoring server230detects an anomaly (anomaly found using reconstruction error? Yes), cluster anomaly monitoring server230generates an alert for users. Alternatively, cluster anomaly monitoring server230may implement an action to correct the anomaly or mitigate for conditions caused by the anomaly. For example, cluster anomaly monitoring server230may reduce the temperature of other refrigerating units or redirect refrigeration (for example, opening or closing movable vents, in some instances as a temporary measure) in response to detecting an anomaly.

Embodiments described herein can be entirely hardware, entirely software or including both hardware and software elements. In a preferred embodiment, the present invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.

Each computer program can be tangibly stored in a machine-readable storage media or device (e.g., program memory or magnetic disk) readable by a general or special purpose programmable computer, for configuring and controlling operation of a computer when the storage media or device is read by the computer to perform the procedures described herein. The embodiments of the present inventive system can also be considered to be embodied in a computer-readable storage medium, configured with a computer program, where the storage medium so configured causes a computing device (e.g., computer) to operate in a specific and predefined manner to perform the functions described herein.