MACHINE LEARNING-BASED FAULT DETECTION SYSTEM

Various systems and methods are provided that detect faults in data-based systems utilizing techniques that stem from the field of spectral analysis and artificial intelligence. For example, a data-based system can include one or more sensors associated with a subsystem that measure time-series data. A set of indicator functions can be established that define anomalous behavior within a subsystem. The systems and methods disclosed herein can, for each sensor, analyze the time-series data measured by the respective sensor in conjunction with one or more indicator functions to identify anomalous behavior associated with the respective sensor of the subsystem. A spectral analysis can then be performed on the analysis to generate spectral responses. Clustering techniques can be used to bin the spectral response values and the binned values can be compared with fault signatures to identify faults. Identified faults can then be displayed in a user interface.

TECHNICAL FIELD

The present disclosure relates to systems and techniques for using machine learning to identify components of a building that are malfunctioning.

BACKGROUND

Office buildings consume 40% of the energy used in the United States, and 70% of the electricity used in the United States. Energy consumption—whether electrical, fossil fuel, or other energy usage—has become a topic of concern not only for the efficient use of resources, but also because of its global impact.

Since interest in the efficient use of energy is high, technologies and tools that aid designers or building owners in providing comfortable, clean, and efficient buildings have been in use for many years. For example, such technologies and tools can include building management systems that monitor and control building performance. However, the building management systems can fail or malfunction, reducing the expected benefits.

SUMMARY

Disclosed herein are various systems and methods for detecting faults in data-based systems utilizing techniques that stem from the field of spectral analysis and artificial intelligence. For example, a data-based system can include one or more subsystems, where individual subsystems are associated with one or more sensors (or other electronic devices, such as Internet of Things (IoT) devices) that measure time-series data. A set of indicator functions can be established that define anomalous behavior within a subsystem. The systems and methods disclosed herein can, for each sensor of a subsystem, analyze the time-series data measured by the respective sensor in conjunction with one or more indicator functions to identify anomalous behavior associated with the respective sensor of the subsystem. The identified anomalous behavior can be represented as a set of anomalous behavior time-series data, where each individual anomalous behavior time-series data corresponds to a sensor and indicator function combination.

The systems and methods disclosed herein can then decompose the anomalous behavior time-series data in terms of spatial-temporal modes that describe the behavior of the sensors at different time-scales. For example, the anomalous behavior time-series data can be converted into the frequency domain to describe anomalous behavior of the sensors at different time-scales. Clustering techniques can be used to bin or aggregate the values associated with various sensor and indicator function combinations and the binned values can be scored and/or ranked based on a level of coincidence and/or a level of severity. A set of fault signatures can be established that define a pattern of coincidence and/or severity levels for one or more indicator functions and/or sensors that indicate a likelihood that a specific fault has occurred. The systems and methods disclosed herein can compare the fault signatures with the scored and/or ranked binned values to identify faults that may have occurred and/or probabilities that the individual identified faults occurred. The systems and methods disclosed herein can generate an interactive user interface that displays the identified faults and/or the probabilities.

The systems and methods disclosed herein can include additional features to improve the accuracy of the fault detection. For example, heuristics (e.g., artificial intelligence, such as machine learning, support vector regression, support vector machines, ensemble methods, artificial neural networks, diffusion maps, etc.) can be used to identify previously unidentified faults and/or to remove false positive fault identifications. If a comparison of fault signatures and a portion of the scored and/or ranked binned values does not yield a match (e.g., the portion of the scored and/or ranked binned values do not equal the score and/or rank or fall within a range of scores and/or ranks that define the fault signature), but the portion of the scored and/or ranked binned values have a pattern that resembles that of a fault according to machine learning heuristics (e.g., the portion includes high coincidence and/or severity levels), then the systems and methods disclosed herein can suggest to a user that a fault has occurred and provide details of the analysis. Based on the feedback provided by the user on whether the portion corresponds to a fault, the systems and methods disclosed herein can suggest (or not suggest) a fault has occurred the next time similar coincidence and/or severity levels are identified for similar sensors and/or indicator functions. As another example, the systems and methods disclosed herein allow a user to define a physical, structural, and/or control relationship between sensors and/or subsystems. If the scored and/or ranked binned values of two sensors exhibit a high level of coincidence and/or severity, the systems and methods disclosed herein can decline to suggest that a fault has occurred in response to a determination that the two sensors are not physically and/or structurally related or in response to a determination that the two sensors are not controlled together (e.g., controlled by the same entity).

One aspect of the disclosure provides a fault detection system for detecting a fault in a data-based system. The fault detection system comprises a computing system comprising one or more computer processors; a database storing values measured by a sensor of a component in the data-based system; and a computer readable storage medium that stores program instructions that instruct the computing system to at least: retrieve, from the database, first values measured by the sensor during a first time period, apply, to each of the first values, a first indicator function in a plurality of indicator functions to generate a respective second value, process the second values using a spectral analysis to generate a plurality of third values, where each third value in the plurality of third values is associated with a magnitude value and a time period in a plurality of time periods, and where each third value in the plurality of third values corresponds with the first indicator function, retrieve a plurality of fault signatures, where each fault signature is associated with an indicator function in the plurality of indicator functions and a fault magnitude value, identify a first third value in the plurality of third values that is associated with a second time period in the plurality of time periods, compare the magnitude value of the first third value with the fault magnitude value of a first fault signature in the plurality of fault signatures, detect that a fault has occurred with a first probability in response to a determination that the fault magnitude value of the first fault signature matches the magnitude value of the first third value and that the indicator function associated with the first fault signature is the first indicator function, and display the detected fault in an interactive user interface.

The fault detection system of the preceding paragraph can have any sub-combination of the following features: where the first fault signature is associated with the fault magnitude value and a second fault magnitude value, and where the computer readable storage medium further stores program instructions that instruct the computing system to at least: retrieve, from the database, fourth values measured by a second sensor of the component during the first period of time, apply, to each of the fourth values, a second indicator function in the plurality of indicator functions to generate a respective fifth value, process the fifth values using the spectral analysis to generate a plurality of sixth values, where each sixth value in the plurality of sixth values is associated with a magnitude value and a time period in the plurality of time periods, identify a first sixth value in the plurality of sixth values that is associated with the first time period, compare the magnitude value of the first sixth value with the second fault magnitude value of the first fault signature, and detect that the fault has occurred in response to a determination that the fault magnitude value of the first fault signature matches the magnitude value of the first third value and that the second fault magnitude value of the first fault signature matches the magnitude value of the first sixth value; where the computer readable storage medium further stores program instructions that instruct the computing system to at least: bin the first third value and the first sixth value, and detect that a second fault has occurred in response to a determination that the binned first third value and the binned first sixth value exhibit a level of coincidence that exceeds a first threshold value and exhibit a level of severity that exceeds a second threshold value; where the level of coincidence corresponds with a level of similarity between two magnitude values; where the first indicator function defines an anomalous condition represented by a threshold value, and where the computer readable storage medium further stores program instructions that instruct the computing system to at least, for each of the first values: determine whether the respective first value exceeds the threshold value, assign the respective second value a high value in response to a determination that the respective first value exceeds the threshold value, and assign the respective second value a low value lower than the high value in response to a determination that the respective first value does not exceed the threshold value; where the computer readable storage medium further stores program instructions that instruct the computing system to at least: receive, via the interactive user interface, an indication that the detected fault is misdiagnosed, process the indication using artificial intelligence, and determine whether to display a second fault that corresponds with the detected fault in the interactive user interface at a later time based on results of the processing; where the component comprises one of an HVAC system, a variable air volume system, an air handling unit, a heat pump, or a fan powered box; and where the computer readable storage medium further stores program instructions that cause the computing system to process the second values using a Koopman mode analysis.

Another aspect of the disclosure provides a computer-implemented method for detecting a data-based system fault. The computer-implemented method comprises: as implemented by a fault detection server comprising one or more computing devices, the fault detection server configured with specific executable instructions, retrieving, from a sensor database, first values measured by a sensor of a component during a first time period; applying, to each of the first values, a first indicator function in a plurality of indicator functions to generate a respective second value; processing the second values using a spectral analysis to generate a plurality of third values, where each third value in the plurality of third values is associated with a magnitude value and a time period in a plurality of time periods; retrieving a plurality of fault signatures, where each fault signature is associated with an indicator function in the plurality of indicator functions and a fault magnitude value; identifying a first third value in the plurality of third values that is associated with a second time period in the plurality of time periods; comparing the magnitude value of the first third value with the fault magnitude value of a first fault signature in the plurality of fault signatures; detecting that a fault has occurred with a first probability in response to a determination that the fault magnitude value of the first fault signature falls within a range of the magnitude value of the first third value; and displaying the detected fault in an interactive user interface.

The computer-implemented method of the preceding paragraph can have any sub-combination of the following features: where the first fault signature is associated with the fault magnitude value and a second fault magnitude value, and where the method further comprises: retrieving, from the sensor database, fourth values measured by a second sensor of the component during the first period of time, applying, to each of the fourth values, a second indicator function in the plurality of indicator functions to generate a respective fifth value, processing the fifth values using the spectral analysis to generate a plurality of sixth values, where each sixth value in the plurality of sixth values is associated with a magnitude value and a time period in the plurality of time periods, identifying a first sixth value in the plurality of sixth values that is associated with the first time period, comparing the magnitude value of the first sixth value with the second fault magnitude value of the first fault signature, and detecting that the fault has occurred in response to a determination that the fault magnitude value of the first fault signature matches the magnitude value of the first third value and that the second fault magnitude value of the first fault signature matches the magnitude value of the first sixth value; where the computer-implemented method further comprises binning the first third value and the first sixth value, and detecting that a second fault has occurred in response to a determination that the binned first third value and the binned first sixth value exhibit a level of coincidence that exceeds a first threshold value and exhibit a level of severity that exceeds a second threshold value; where the level of coincidence corresponds with a level of similarity between two magnitude values; where the first indicator function defines an anomalous condition represented by a threshold value, and where applying, to each of the first values, a first indicator function comprises, for each of the first values: determining whether the respective first value exceeds the threshold value, assigning the respective second value a high value in response to a determination that the respective first value exceeds the threshold value, and assigning the respective second value a low value lower than the high value in response to a determination that the respective first value does not exceed the threshold value; where the first third value corresponds with the first indicator function, and where detecting that a fault has occurred comprises detecting that the fault has occurred in response to a determination that the fault magnitude value of the first fault signature matches the magnitude value of the first third value and the indicator function associated with the first fault signature is the first indicator function; where the computer-implemented method further comprises receiving, via the interactive user interface, an indication that the detected fault is misdiagnosed, processing the indication using artificial intelligence, and determining whether to display a second fault that corresponds with the detected fault in the interactive user interface at a later time based on results of the processing; where the component comprises one of an HVAC system, a variable air volume system, an air handling unit, a heat pump, or a fan powered box; and where processing the second values using a spectral analysis comprises processing the second values using a Koopman mode analysis.

Another aspect of the disclosure provides a non-transitory computer-readable medium having stored thereon a spectral analyzer and a fault detector for identifying faults in a data-based system, the spectral analyzer and fault detector comprising executable code that, when executed on a computing device, implements a process comprising: retrieving first values measured by a sensor of a component during a first time period; applying, to each of the first values, a first indicator function in a plurality of indicator functions to generate a respective second value; processing the second values using a spectral analysis to generate a plurality of third values, where each third value in the plurality of third values is associated with a magnitude value and a time period in a plurality of time periods; retrieving a plurality of fault signatures, where each fault signature is associated with a fault magnitude value; identifying a first third value in the plurality of third values that is associated with a second time period in the plurality of time periods; comparing the magnitude value of the first third value with the fault magnitude value of a first fault signature in the plurality of fault signatures; detecting that a fault has occurred with a first probability in response to a determination that the fault magnitude value of the first fault signature falls within a range of the magnitude value of the first third value; and displaying the detected fault in an interactive user interface.

The non-transitory computer-readable medium of the preceding paragraph can have any sub-combination of the following features: where the first indicator function defines an anomalous condition represented by a threshold value, and where the executable code further implement a processing comprising, for each of the first values: determining whether the respective first value exceeds the threshold value, assigning the respective second value a high value in response to a determination that the respective first value exceeds the threshold value, and assigning the respective second value a low value lower than the high value in response to a determination that the respective first value does not exceed the threshold value; and where the executable code further implement a processing comprising: receiving, via the interactive user interface, an indication that the detected fault is misdiagnosed, processing the indication using artificial intelligence, and determining whether to display a second fault that corresponds with the detected fault in the interactive user interface at a later time based on results of the processing.

DETAILED DESCRIPTION OF SPECIFIC EMBODIMENTS

Overview

As described above, building management systems can fail or malfunction, reducing building energy efficiency and producing waste. Typically, data can be collected from sensors associated with components within a building (e.g., sensors that measure data derived from heating, ventilating, and air conditioning (HVAC) systems, air handling units, fan powered boxes, variable air volume systems, etc.) and stored for analysis to determine when a component within a building has failed or is malfunctioning (e.g., a fault has occurred).

However, buildings are complicated systems. Many of the components within the building are interrelated and the outputs of sensors associated with one component can be affected by the operation of another component. Furthermore, many issues that result in faults can occur at a high-frequency or level of oscillation (e.g., measured values can swing from one extreme to another) over a period of time, occur at a consistently short duration over a long period of time, and/or the like. Thus, it can be very difficult for a human to simply view the stored sensor data and accurately identify faults that are occurring.

Some systems may use a set of rules to help identify faults within the stored data. A rule can specify that a fault has occurred if a predefined set of conditions exist across spatial and/or temporal fields. For example, a rule can specify that a fault has occurred if a first sensor measures a first value, a second sensor measures a second value, and so on, for a predetermined time interval of occurrences. Thus, rules rely on and are defined based on actual measured values. Rules are made up of conditions that ultimately result in either true or false, and thus the determination of whether a fault occurred is dependent on whether the result of a rule is true or false. However, as mentioned above, buildings are complicated systems and many of the building components are interrelated. To define a rule, it would be necessary to understand what outputs represent faulty behavior, how each component in the building operates (e.g., which might require knowing the make and model of each of the components in the building, the units of the measurements provided by the sensors of the component, etc.), and/or how each of the components are related. Thus, to identify potential faults, a user may need to define thousands of highly specific rules that correspond to just a single building. Defining rules in this manner is inefficient because such rules are not modular—the rules cannot be replicated and be used for other buildings (given that components in other buildings may be different makes or models, physically related in a different manner, etc.). In fact, occasionally component relationship information is not readily available, is outdated, and/or is otherwise incomplete. Accordingly, rules derived from incomplete data cannot be expected to provide reliable determinations on whether a fault occurred. Additionally, the output of a rule may be a true/false value that reflects whether a specified condition exists. Any change to the description of the rule (e.g., a change that results in the comparison of different sensor outputs, different values, different time intervals, etc.) may result in the creation of a new rule. Likewise, ruled-based systems may not be capable of comparing one rule to another rule unless the comparison is defined in a rule because the comparison itself would be a different rule. In practice, the very nature of rules leads to a proliferation of definitions in a rules-based system, and, due to the static nature of rules, the scope of applicability of rules-based systems is limited. Moreover, each time a component is replaced in a building, rules associated with the replaced component may need to be updated to account for the new component. Furthermore, these rules would only capture known faults or faults that can be linked to a set of sensor outputs. If the conditions that govern a fault are unknown or not easily definable, rules-based systems may be unable to identify such faults.

Accordingly, disclosed herein are various systems and methods for detecting faults in buildings utilizing techniques that stem from the field of spectral analysis and artificial intelligence. For example, a building can include one or more components (e.g., HVACs, air handling units, fan powered boxes, variable air volume systems, etc.), where individual components are associated with one or more sensors that measure time-series data. A set of indicator functions can be established that define anomalous behavior within a component. An indicator function is a simple algorithm that converts time-series data associated with one or more sensors (or derivatives of the time-series data) into a bitmap of true/false conditions (e.g., binary outputs) for each time instance. As an example, a first type or class of indicator function can define a setpoint (e.g., a measured value in the time-series data, such as 70 degrees) and determine whether the setpoint is exceeded (e.g., a true condition) or not exceeded (e.g., a false condition) over time. Other classes of indicator functions can define whether a component is unexpectedly on (e.g., enabled, functioning, operational, etc.), whether an actuator is at an operational limit, whether the value of an output of a type of sensor is outside of a value range that is physically reasonable or possible, and/or the like. As another example, an indicator function can define an oscillation in the time-series data (e.g., a frequency of oscillation, a magnitude of oscillation, a phase of oscillation, etc.) and determine whether oscillation exceeds or does not exceed a threshold value. As another example, an indicator function can calculate a derivative of the time-series data (e.g., 2nd derivative, 3rd derivative, etc.) and determine whether the derivative exceeds or does not exceed a threshold value.

A fault detection system can, for each sensor of a component, analyze the time-series data measured by the respective sensor using one or more indicator functions to identify anomalous behavior associated with the respective sensor of the component. For example, the fault detection system can convert the time-series data measured by the respective sensor into another time-series, where each data point in the new time-series corresponds to whether a true or false condition occurred at the given time instance. The identified anomalous behavior may then be time instances in which a true condition occurred (or, alternatively, in which a false condition occurred). A new time-series may be generated for each indicator function that is used to analyze the time-series data of the respective sensor. Thus, the fault detection system can generate a set of new time-series, where each time-series in the set corresponds to a sensor and indicator function combination. As used herein, the new time-series can also be referred to as an anomalous behavior time-series.

The fault detection system can then decompose the new time-series data in terms of spatial-temporal modes that describe the behavior of the sensors at different time-scales. For example, the new time-series data can be converted into the frequency domain to describe anomalous behavior of the sensors at different time-scales. Clustering techniques (e.g., K-means clustering, hierarchical clustering, etc.) can be used by the fault detection system to bin or aggregate the values (e.g., magnitudes in the frequency domain, phases in the frequency domain, combinations of magnitudes and phases in the frequency domain, etc.) associated with various sensor and indicator function combinations and the binned values can be scored and/or ranked based on a level of coincidence (e.g., how similar values are in magnitude, phase, and/or period of occurrence) and/or a level of severity (e.g., the higher the magnitude and/or phase value, the higher the severity level). A user and/or the fault detection system can establish a set of fault signatures that indicate the characteristics of the occurrence of a specific class of fault. The fault signatures can define a pattern of coincidence and/or severity levels for one or more indicator functions and/or sensors that correspond to the specific fault. The fault detection system can compare the fault signatures with the scored and/or ranked binned values to identify faults that potentially have occurred. The fault detection system can generate an interactive user interface that displays the identified faults and/or statistics corresponding to a likelihood that the identified faults occurred.

In an embodiment, the fault detection system provides additional features to improve the accuracy of the fault detection. For example, heuristics (e.g., artificial intelligence, such as machine learning, support vector regression, support vector machines, ensemble methods, artificial neural networks, diffusion maps, etc.) can be used to identify previously unidentified faults and/or to remove false positive fault identifications. If a comparison of fault signatures and a portion of the scored and/or ranked binned values does not yield a match (e.g., the portion of the scored and/or ranked binned values do not equal the score and/or rank or fall within a range of scores and/or ranks that define the fault signature), but the portion of the scored and/or ranked binned values have a pattern that resembles that of a fault according to machine learning heuristics (e.g., the portion includes high coincidence and/or severity levels), then the fault detection system can suggest to a user that a fault has occurred and provide details of the analysis (e.g., component(s) that triggered the fault, the periodicity of the potential fault, etc.). Based on feedback provided by the user on whether the portion corresponds to an actual fault, the fault detection system can suggest (or not suggest) a fault has occurred the next time similar coincidence and/or severity levels are identified for similar sensors and/or indicator functions. As another example, the fault detection system can allow a user to define a physical, structural, and/or control relationship between sensors and/or components. If the scored and/or ranked binned values of two sensors exhibit a high level of coincidence and/or severity, the fault detection system can decline to suggest that a fault has occurred in response to a determination that the two sensors are not physically and/or structurally related or in response to a determination that the two sensors are not controlled together (e.g., controlled by the same entity).

In this way, by using indicator functions, spectral analysis, and machine learning, the techniques implemented by the fault detection system are modular and can be applied to any building, regardless of the components installed in the building or their relationship with each other. For example, unlike a rule, the fault detection system does not rely on how an individual component operates (and how that operation differs from other makes or models of the same type of component), the units in which a sensor outputs data, and/or how components are related to each other. Rather, the fault detection process as described herein can, for example, be broken into three concepts: (1) an indicator function provides a general indication of how a component is behaving (e.g., a component is on, a component is off, a component is cooling, a component is warming, etc.) over time (without a user specifying a time interval for the occurrence of a condition) and thus can be applied to a class of components (not just an individual make and model of component within the class); (2) the characteristics of the occurrence of a condition over time (e.g., daily, weekly, seasonally, annually, etc.) can be represented via a spectral analysis (e.g., by performing a spectral analysis on the output of an indicator function); and (3) the likelihood of the occurrence of a fault can be evaluated by applying machine learning to the spectral values of a single indicator function and/or the coincidence and/or severity of spectral values from multiple indicator functions. Because the indicator functions can apply generally to classes of components and do not rely on the relationships between components, the same indicator functions can be used for different buildings and/or if components are replaced with different makes and/or models.

Furthermore, spectrally analyzing the results of an application of an indicator function allows for the fault detection system to identify previously unknown faults. For example, the spectral analysis of an indicator function allows the fault detection system to detect abnormalities corresponding to one or more sensors, where the abnormalities have occurred simultaneously or nearly simultaneously (or at similar intervals of time) at a similar coincidence and/or severity level. Thus, unlike a rules-based system, indicator function(s) can be used to detect a fault even if the underlying conditions that caused the fault to occur are previously unknown.

While the systems and methods disclosed herein are described with respect to sensors in buildings or other physical structures, this is merely for illustrative purposes and is not meant to be limiting. The systems and methods disclosed herein can be applied to measurements received from any type of electronic device, such as an Internet of Things (IoT) device (e.g., a device that allows for secure, bi-direction communication over a network, such as an actuator, a light, a coffee machine, an appliance, etc.), associated with any data-based system (e.g., systems associated with healthcare, agriculture, retail, finance, energy, industry, etc.).

Exemplary System Overview

FIG. 1illustrates a block diagram showing the various components of a fault detection system100. As illustrated inFIG. 1, the fault detection system100may include a physical structure110(e.g., a building with one or more components), a fault detection server140, a sensor data store150, and a user device160. In an embodiment, the physical structure110(e.g., a building management system within the physical structure110) and the sensor data store150communicate via a network120. In some embodiments, the physical structure110further communicates with the fault detection server140via the network120. In other embodiments, the fault detection server140may be located on-site, within the physical structure110, and be housed within a server or series of servers. Similarly, the functionality disclosed with reference to these components may be distributed to other computing devices and/or partially performed by multiple computing devices.

The physical structure110may be a structure that comprises various components and/or equipment. Such components and/or equipment can include HVAC systems, air handling units, fan powered boxes, variable air volume systems, cooling towers, condenser water loops, heat recovery wheels, rooftop terminal units, heat pumps, and/or the like. The physical structure110may further include a plurality of sensors115that detect or measure physical properties, such as voltage, current, pressure, air flow, temperature, and/or the like over a period of time. Some or all of the components or equipment within the physical structure110can each be associated with one or more sensors115. For example, an air handling unit can include a first sensor115that measures supply air temperature, a second sensor115that measures static pressure, and so on. A sensor115(or the component or equipment associated with a sensor115) can be associated with a location within the physical structure110.

The fault detection server140may include various modules. For example, the fault detection server140may include a feature detector141, a spectral analyzer142, a fault detector143, a machine learning feedback system144, a user interface generator145, an indicator function data store146, a fault signature data store147, a hierarchical data store148, and a mapping data store149. References herein to “data store” may refer to any type of data structure for storing and/or organizing data, including, but not limited to, relational databases (for example, Oracle database, mySQL database, and the like), spreadsheets, XML files, and text files, among others. The various terms “database,” “data store,” and “data source” may be used interchangeably in the present disclosure. A “file system” may control how data is stored and/or retrieved (for example, a disk file system like FAT, NTFS, optical discs, etc., a flash file system, a tape file system, a database file system, a transactional file system, a network file system, etc.). For simplicity, the disclosure is described herein with respect to data stores. However, the systems and techniques disclosed herein may be implemented with file systems or a combination of data stores and file systems.

In an embodiment, the feature detector141, the spectral analyzer142, the fault detector143, the machine learning feedback system144, and the user interface generator145are each implemented as executable code modules that are stored in the memory of, and executed by the processor(s) of, the fault detection server140. The feature detector141, the spectral analyzer142, the fault detector143, the machine learning feedback system144, and the user interface generator145may also be implemented partly or wholly in application-specific hardware.

The feature detector141is configured to determine which indicator function(s) should be used to analyze a given physical structure110. For example, the user can provide, via a user interface generated by the user interface generator145, information on the components within the physical structure110and/or how the components are physically interrelated. Alternatively, this information can be received directly from the physical structure110via a building management system. The information on the components within the physical structure110can be provided in any format and the feature detector141can map the provided information to a uniform format.

For example,FIG. 2Aillustrates a table200depicting the mapping of component information to a standard format. As illustrated inFIG. 2A, a building management system provides two long phrases in column202that each identify a name of the physical structure110(e.g., Tower 1), a name of a class of component (e.g., fan powered box, a heat pump, etc.), a name for the specific component in the class (e.g., FPB_G5_4312, HP_J12_1970, etc.), and a type of sensor associated with the specific component (e.g., damper command, discharge air temperature, etc.). The feature detector141can map the provided information into, for example, three columns204,206, and208that break up the provided phrase into discrete pieces of information using standard language. The mapping can be stored in the mapping data store149.

The feature detector141can retrieve the mapping from the mapping data store149, use the standard format to identify the components in the physical structure110, and retrieve indicator functions that correspond to the identified components from the indicator function data store146.

In addition, the feature detector141can retrieve and/or store information on how the components are physically interrelated. For example,FIG. 2Billustrates a graph structure210representing the physical relationship between components and/or parameters associated with the physical structure110. As illustrated inFIG. 2B, a type of sensor that measures chilled water supply temperature212affects the operation of a component identified as air handling unit214. The operation of the air handling unit214affects the operation of components fan powered box216, fan powered box218, and heat pump220. The operation of the fan powered box218is measured by sensors that measure flow rate222, damper position224, and space temperature226. Thus, for example, the graph structure210identifies a physical relationship between the air handling unit214and the fan powered box218and a physical relationship between the flow rate222and the damper position224. However, there may not be a relationship between the heat pump220and the flow rate222. This relationship information can be stored in the hierarchical data store148for retrieval by the machine learning feedback system144for the purpose of removing false positives, as described herein.

The feature detector141can also apply one or more indicator functions to the outputs of the sensors115. The feature detector141can retrieve the time-series data measured by the sensors115from the sensor data store150or directly from the sensors115via the network120. In an embodiment, indicator functions correspond to specific types of sensors and/or specific classes of components. Thus, the mapping of the provided information into the standard format or language allows the feature detector141to determine which indicator functions are to be applied to any given time-series dataset. For example, a specific type of sensor corresponds to a specific standard term, and the indicator functions that correspond to the specific type of sensor then correspond with the specific standard term. When time-series data from a specific type of sensor is analyzed, the feature detector141can identify the specific standard term corresponding to the specific type of sensor and retrieve the indicator functions corresponding to the specific standard term. Thus, the feature detector141can apply the indicator functions to the time-series data of the appropriate sensors115.

The feature detector141can apply one or more indicator functions to the time-series data associated with some or all of the sensors115. For example, if two indicator functions are associated with a first sensor115and three indicator functions are associated with a second sensor115, then the feature detector141can apply the first indicator function to the time-series data of the first sensor115, the second indicator function to the time-series data of the first sensor115, the third indicator function to the time-series data of the second sensor115, the fourth indicator function to the time-series data of the second sensor115, and the fifth indicator function to the time-series data of the second sensor115.

In an embodiment, application of an indicator function to time-series data includes analyzing a data point at each time instance and determining whether the respective data point corresponds to a true condition or a false condition according to the indicator function. For example, if the indicator function defines a true condition to be a value that exceeds a setpoint (e.g., which is undesirable) and a false condition to be a value that does not exceed the setpoint (e.g., which is desirable), then the feature detector141analyzes data points at each time instance to determine whether the respective data point exceeds or does not exceed the setpoint. If the data point at a time instance exceeds the setpoint, then the feature detector141can assign the time instance to be a high value (e.g., a logical 1). If the data point at a time instance does not exceed the setpoint, then the feature detector141can assign the time instance to be a low value (e.g., a logical 0). Thus, the feature detector141can generate a new time-series (or an anomalous behavior time-series), where each data point in the new time-series is a high value or a low value. Accordingly, given the example of the first sensor115and the second sensor115provided above, the feature detector141can generate five new time-series, one for each sensor115and indicator function pair. Generally, if each data point in the new time-series is a low value, then this may indicate that the sensors115or component associated with the new time-series are operating properly. An illustrative example of the application of an indicator function to time-series data is provided inFIG. 3C.

Once the new time-series are generated, the spectral analyzer142can perform a spectral analysis (e.g., a Koopman mode analysis using, for example, an Arnoldi subspace method, a discrete Fourier transform, a Burg-type algorithm, etc.) of each of the new time-series to generate a spectral response for each of the new time-series. Performance of the spectral analysis may result in the conversion of the data from the time domain to the frequency domain such that the behavior of the sensors115(e.g., whether the data points at different time instances result in a true or false condition) can be described at different time-scales (e.g., in a graph, the x-axis may represent different time periods and a value at each point along the x-axis represents the magnitude (or phase) at the respective time period). For example, if the spectral analysis results in the magnitude (or phase) at a point corresponding to a 24 hour period being high, then this may indicate that data measured by a sensor115regularly corresponds to a true condition of an indicator function every 24 hours. An illustrative example of the spectral responses is provided inFIG. 3D.

The fault detector143can use the generated spectral responses to detect faults that have possibly occurred. For example, the fault detector143can implement clustering techniques (e.g., K-means clustering, hierarchical clustering, etc.) to bin or aggregate the values (e.g., magnitudes, phases, or combinations thereof) of the spectral responses. In an embodiment, the fault detector143uses the clustering techniques to bin or aggregate values that correspond to the same sensor115or component. In additional embodiments, the fault detector143uses the clustering techniques to bin or aggregate values that correspond to different sensors115or components. As described above, the spectral responses indicate values for different time-scales. To perform the binning, the fault detector143can select a single time-scale and organize into the same row the values associated with the selected time-scale and a single sensor115or component, where the order of the values may depend on the implemented clustering techniques (e.g., similar values may be organized together). Thus, each row can include the values derived from the spectral responses associated with a single sensor115or component at a selected time-scale (and therefore the values in a row correspond to the different indicator functions associated with the single sensor115or component). An illustrative example of the binned values is provided inFIG. 3H.

In an embodiment, once the fault detector143bins or aggregates the values, the fault detector143scores and/or ranks values based on a level of coincidence (e.g., how similar values are in magnitude, phase, and/or period of occurrence) and/or a level of severity (e.g., the higher the magnitude or phase value, the higher the severity level). For example, as described above, values can be clustered. The fault detector143can evaluate clustered values to determine the level of coincidence and/or the level of severity of these clustered values. The higher the level of coincidence and/or the level of severity, the higher such clustered values may be scored. The ranking of clustered values may depend on the score of the clustered values (e.g., the higher the score, the higher the ranking).

The fault detector143can use the scored and/or ranked binned values and a set of fault signature to detect potential faults. A fault is an equipment or operational issue (e.g., a malfunction) that adversely affects energy efficiency, occupant comfort, and/or equipment useful life. A fault can be described by a combination of one or more indicator functions. For example, a fault may have occurred if the one or more indicator functions that describe the fault are each high (e.g., correspond to a true condition) at the same time-scale. Because faults can be described using modular indicator functions that can apply to a class of components (e.g., all HVAC systems, regardless of manufacturer), the faults themselves (and the corresponding fault signatures) can apply to a class of components and are not restricted to specific makes and/or models of components or relationships between components that are unique to a particular physical structure110. As described herein, the modular aspect of the indicator functions also allows the fault detection server140(e.g., the fault detector143) to automatically identify previously unknown faults using a combination of one or more existing indicator functions because the indicator functions may not rely on the physical relationship between components.

In an embodiment, a fault signature is a representation of the fault using scores and/or ranks and the indicator functions associated with the scores and/or ranks. The fault signature can be used to determine the likelihood that a certain fault occurred. For example, a fault signature can be associated with a single indicator function and is defined as a value with a certain score and/or rank or a value within a range of scores and/or ranks. As another example, a fault signature is associated with two or more indicator functions and is defined as a cluster of values with a certain score and/or rank or a cluster of values within a range of scores and/or ranks (e.g., where the cluster of values are associated with the two or more indicator functions, respectively).

The fault signature may correspond with a defined fault description that can be displayed in the interactive user interface when a likely fault is detected. For example, a fault can be that a variable air volume system is providing insufficient cooling capacity. This can result if space temperatures are consistently above a setpoint while a damper remains 100% open. A first indicator function can correspond to a determination of whether the space temperature exceeds the setpoint and a second indicator function can correspond to a determination of whether the damper is open or closed. Both indicator functions may be associated with the same sensor115or component. If a variable air volume system is indeed providing insufficient cooling capacity, the spectral response value associated with the first indicator function and the spectral response value associated with the second indicator function may be similar in coincidence and/or severity level during the same time-scale, and thus the values may be clustered together. The fault signature associated with the insufficient cooling capacity of a variable air volume system may then identify the first and second indicator functions and be a score that corresponds to a score that would be expected to be assigned to these clustered values. If the fault signature defines a range of scores, the range may be determined based on a score that would be expected to be assigned to these clustered values and a threshold range above and/or below the expected score.

The fault detector143can retrieve the fault signatures from the fault signature data store147and compare the retrieved fault signatures with the scored and/or ranked binned values. A comparison yields a proximity of match between a fault signature and the scored and/or ranked binned values if the scored and/or ranked binned values correspond to the same indicator functions that the fault signature is associated with and the scored and/or ranked binned values match the scores and/or ranks or the range of scores and/or ranks defined by the fault signature.

If the scored and/or ranked binned values are proximate to a fault signature (e.g., equal the score and/or rank or fall within a range of scores and/or ranks that define the fault signature), then the fault detector143detects that it is likely that a fault corresponding to the fault signature has occurred. The fault detector143may determine a probability that the fault occurred based on how close the scored and/or ranked binned value(s) are to the scored and/or ranked value(s) that define the fault signature. The fault detector143can transmit a message to the user interface generator145such that information regarding the fault can be displayed in an interactive user interface (e.g., a description of the fault and the probability that the fault occurred).

If the scored and/or ranked binned values do not match a fault signature, the fault detector143may still detect that a potential fault has occurred. For example, if the coincidence and/or severity level of the clustered values exceed a threshold value but otherwise do not match a fault signature (e.g., equal the score and/or rank or fall within a range of scores and/or ranks that define the fault signature), the fault detector143may determine that an unknown fault has potentially occurred. The fault detector143can instruct the user interface generator145to display information regarding this unknown fault and request user feedback, as described in greater detail below. The fault detector143may not, however, determine that an unknown fault has occurred if the indicator function associated with the ranked and/or scored binned values are associated with sensors115or components that are not related according to the physical interrelationship information retrieved by the feature detector141. The fault detector143can repeat the binning and fault detection process for other time-scales.

In some embodiments, the fault detector143further generates an alert and/or a notification when a likely fault is detected. The alert and/or notification can be automatically transmitted by the fault generator143to the user device160to inform a user associated with the alert and/or notification. The alert and/or notification can be transmitted at the time that the alert and/or notification is generated or at some determined time after generation of the alert and/or notification. When received by the user device160, the alert and/or notification can cause the user device160to display the alert and/or notification via the activation of an application on the user device160(e.g., a browser, a mobile application, etc.). For example, receipt of the alert and/or notification may automatically activate an application on the user device160, such as a messaging application (e.g., SMS or MMS messaging application), a standalone application (e.g., fault detection application), or a browser, for example, and display information included in the alert and/or notification. If the user device160is offline when the alert and/or notification is transmitted, the application may be automatically activated when the user device160is online such that the alert and/or notification is displayed. As another example, receipt of the alert and/or notification may cause a browser to open and be redirected to a login page generated by the fault detection server140so that the entity can log in to the fault detection server140and view the alert and/or notification. Alternatively, the alert and/or notification may include a URL of a webpage (or other online information) associated with the alert and/or notification, such that when the user device160(e.g., a mobile device) receives the alert, a browser (or other application) is automatically activated and the URL included in the alert and/or notification is accessed via the Internet.

The machine learning feedback system144can use heuristics (e.g., artificial intelligence, such as machine learning, support vector regression, support vector machines, ensemble methods, artificial neural networks, diffusion maps, etc.) to modify operation of the fault detector143over time based on user feedback. In an embodiment, the interactive user interface that displays detected faults to a user also provides the user with an opportunity to confirm that a fault occurred or indicate that a detected fault is a false positive (or otherwise unimportant to the user). For example, an operator of a first physical structure110may not be interested in faults that are detected as occurring on 24 hour periods. Thus, the operator may close faults detected as occurring on 24 hour periods. The machine learning feedback system144can use this information to modify the operation of the fault detector143such that the fault detector143reduces or eliminates the flagging of incidents that occur on 24 hour periods as being potential faults. As another example, the fault detector143may identify an unknown fault and information of the unknown fault may be presented to an operator of a second physical structure110. If the operator confirms that a fault occurred (and provides additional descriptive information of the fault), then the machine learning feedback system144can generate a new fault signature for storage in the fault signature data store147. The new fault signature can be based on the score(s) of the value or clustered values that triggered the previously unknown fault. Thus, the next time the fault detector143begins searching for faults, the fault detector143can use the new fault signature when performing the comparisons. As mentioned previously, if the scored and/or ranked binned values are proximate to a fault signature, then the fault detector143can detect that a fault corresponding to the fault signature has occurred. Based on whether the operator acts (or does not act) on a reported fault and/or based on any feedback provided by the operator regarding a reported fault (e.g., feedback such as whether the reported fault is actually a fault), the machine learning feedback system144can modify one or more fault signatures so that future scored and/or ranked binned values better align with the reporting preferences of the operator.

The user interface generator146may generate an interactive user interface that provides a summary of one or more physical structures110, displays a description of the detected faults, displays or indicates a probability that the detected fault occurred, and provides an opportunity for a user to provide feedback on whether a detected fault can be confirmed as an actual fault. The interactive user interface may provide additional features, such as the ability to correct or address a fault, add notes associated with a fault, and other information related to the fault. Example interactive user interfaces are described in greater detail below with respect toFIGS. 4A-6.

The indicator function data store146can store indicator functions that are each associated with a sensor115or class of component. As described herein, the indicator functions may not be constructed in a manner such that the indicator functions correspond to a specific component in a class of components. While the indicator function data store146is illustrated as being stored in the fault detection server140, this is not meant to be limiting. The indicator function data store146can be external to the fault detection server140.

The fault signature data store147can store a plurality of fault signatures. The fault signature data store147can be updated with new fault signatures generated by the machine learning feedback system144. While the fault signature data store147is illustrated as being stored in the fault detection server140, this is not meant to be limiting. The fault signature data store147can be external to the fault detection server140.

The hierarchical data store148can store the physical relationships between sensors and/or components. While the hierarchical data store148is illustrated as being stored in the fault detection server140, this is not meant to be limiting. The hierarchical data store148can be external to the fault detection server140.

The mapping data store149can store the mapping of the provided information on the components within the physical structure110into the standard format. While the mapping data store149is illustrated as being stored in the fault detection server140, this is not meant to be limiting. The mapping data store149can be external to the fault detection server140.

In an embodiment, the fault detection server140begins the fault detection process when data is received from the sensors115and/or the sensor data store150. In other embodiments, the fault detection server140beings the fault detection process at set intervals or at random times.

The operations described herein with respect to the fault detection server140can improve the processing efficiency and memory utilization over other systems that may attempt to identify faults in physical structures110. For example, typical systems identify faults based on an analysis of data in the time domain. The sensors115can measure data at hundreds to thousands of times a second, resulting in a large amount of data to process and analyze, thereby affecting the performance of these typical systems. However, by converting the data from the time domain to the frequency domain (and then binning, scoring, and/or ranking the data), the amount of data that is eventually processed by the fault detector143to identify faults is significantly reduced. For example, instead of having tens of thousands of data points to cover a 24 hour period for one sensor115to identify a potential fault, the fault detection server140can filter the data to a single set of values for a 24 hour period and sensor115(e.g., a single data point for each indicator function associated with the sensor115, as described and illustrated herein and below with respect toFIG. 3H). Accordingly, the operations described herein provide significant improvements to the functioning of the fault detection server140, reducing memory utilization and increasing processor performance through the reduction in the amount of data that needs to be stored and processed.

The fault detection server140may be implemented as a special-purpose computer system having logical elements. In an embodiment, the logical elements may comprise program instructions recorded on one or more machine-readable storage media. Alternatively, the logical elements may be implemented in hardware, firmware, or a combination thereof. In one embodiment, the fault detection server140may be implemented in a Java Virtual Machine (JVM) that is executing in a distributed or non-distributed computer system. In other embodiments, the fault detection server140may be implemented as a combination of programming instructions written in any programming language (e.g. C++, Visual Basic, Python, etc.) and hardware components (e.g., memory, CPU time) that have been allocated for executing the program instructions.

A user may use the user device160to view and interact with the interactive user interface generated by the user interface generator145. For example, the user device160may be in communication with the fault detection server140via the network120. The user device160can include a wide variety of computing devices, including personal computing devices, terminal computing devices, laptop computing devices, tablet computing devices, electronic reader devices, mobile devices (e.g., mobile phones, media players, handheld gaming devices, etc.), wearable devices with network access and program execution capabilities (e.g., “smart watches” or “smart eyewear”), wireless devices, set-top boxes, gaming consoles, entertainment systems, televisions with network access and program execution capabilities (e.g., “smart TVs”), and various other electronic devices and appliances. The user devices160may execute a browser application to communicate with the fault detection server140.

In an embodiment, the network120includes any communications network, such as the Internet. The network120may be a wired network, a wireless network, or a combination of the two. For example, network120may be a local area network (LAN) and/or a wireless area network (WAN).

Example to Illustrate Concepts Implemented by the Fault Detection Server140

To understand why the operations described herein are implemented to detect faults, an explanation of the underlying concepts that drive the operation of the fault detection server140may be useful. In particular, the following paragraphs in this section describe conceptually how the fault detection server140identifies known faults and new, previously unknown faults.

As described herein, the fault detection server140can detect and/or classify faults from time-series data using, in part, a spectral analysis (e.g., spectral Koopman methods) combined and a cluster analysis. The fault detection server140can take measured data and analyze the time-series behavior between the difference of outputs and their expected value. For example, using spectral Koopman methods, the fault detection server140can represent the result in the frequency domain to characterize the time-scales at which measured data is not behaving as anticipated. Using the frequency domain representation, the fault detection server can define spectral signatures of faults (e.g., which correspond to the scores and/or ranks described herein), and these signatures can be compared with the signature of the deviation of measured data from the expectation.

In an embodiment, let the following equation:

be a vector input of measured functions of time (g1(t), . . . gn(t)). From g(t), the vector of outputs can be defined as follows:

where η is a mapping of the measured functions of time to some output space. Let the following equation:

be a vector input of predefined functions of time. In the detection of faults, there may be some desired, or expected, behavior of these time-series signals. From f(t), the vector of desired or expected outputs can be defined as follows:

where κEcan be a mapping of the functions of time to some expected values. For example, if f(t) is the output of an indicator function, then κE(f(t)) is a vector of zeros (e.g., no anomalous behavior is detected). In a more advanced example, if f(t) is a time-series of temperature measurements, then κE(f(t)) may be the deviation from a setpoint or the ideal temperature response as predicted from, for example, a building energy model. Thus, the desired or expected output can be a composition of the vector function κEwith functions of time f(t)=(f1(0, . . . , fn(t)). A function of particular interest may be the Koopman spectrum corresponding to the subtraction function y(t)−ye(t). This spectrum of the subtraction function can be represented as Y(ω), which can be a complex value. An example of the spectral response of the time-series obtained by taking the difference between an output and its expected value is illustrated inFIG. 3D.

In an ideal operating scenario (e.g., no fault has occurred), the magnitude of the entire spectrum would be equal to zero (e.g., Y(ω)=0 for all ω), indicating that y(t) equals ye(t) or that the observed output is equal to its expected value for all time. Spectral responses that have nonzero magnitudes can indicate some deviation from the expected behavior of the output. Based on the magnitude of other spectral signatures, these deviations from zero can designate the existence of a fault.

The concept of the Koopman spectrum can be used here to capture as broad a class of dynamical behaviors of components as possible. For example, the signals can be nonlinear, and thus the concept of the linear state-space representation spectrum may not be applicable, and the signals may not be periodic (e.g., so this is not necessarily the Fourier spectrum). The concept of Koopman spectrum can be reduced to linear spectrum when, for example, the dynamics are linear and can be reduced to Fourier spectrum when, for example, the dynamics are periodic.

In an embodiment, because a scenario in which there are no faults can be defined as Y(ω) equals 0 for all ω, any state or scenario where Y(ω) does not equal 0 can indicate some form of adversity within one or more sensors115or components of the physical structure110and can be considered a fault. However, there are such state that are more important than others, and classification and artificial intelligence (e.g., machine learning) can be used to identify which are important and which are not. For example, among Y(ω) that does not equal 0, specific faults corresponding to understood physical issues can be defined and labeled as Fi(e.g., where Ficorresponds to a physical description or is an indicator of a known condition, such as “temperature above a setpoint”), where i equals values from 1 to m, thereby corresponding to different YFi(ω). Thus, faulty states can be classified by their distance from Y(ω) equals 0 and YFi(ω). The fault detection server140can use clustering techniques to assign a particular observed Y(ω) to a specific fault Fi. In addition, if a cluster of points close to YD((ω)) does not equal 0 is observed in Y space that does not correspond to any specific, known YFi(ω), then this could potentially be identified by the fault detection server140as a previously unknown fault. The fault detection server140can include the previously unknown fault in the interactive user interface and request that the user confirm that the detected fault is indeed a fault and/or to provide a physical description of the detected fault (e.g., a description of the malfunction that has occurred). This new fault D can then be mapped to FM+1(e.g., added to the fault signature data store147as a new fault signature).

In a further embodiment, Y(ω) can be reduced to a scalar value. For example, the fault detection server140can perform this reduction through a scoring process (such as the scoring process described herein) that evaluates Y(ω) and assigns a value according to characteristics of the spectrum, where high values indicate persistent deviations from desired behavior and low values signify that an output (e.g., sensor115or component) is behaving as expected. The result can be a binning map, such as the depicted in the graph329inFIG. 3H. The binning process facilitates analysis by taking high-dimensional data (e.g., the spectrum of Y(ω), the spectrum of a classified fault Fi, or in general, the spectrum generated by any time-series) and embedding the high-dimensional data into a lower dimensional manifold. This binning process then provides additional means of grouping subtraction function(s), Y(ω), to a fault, Fi, based on the proximity of characteristics of the spectrum between both quantities and the attributes of the particular binning process being used. Some methods of binning (e.g., dimensionality reduction) include self-organizing maps (SOM), diffusion maps, K-means clustering, density-based clustering, and/or the like.

Example Fault Detection Flow and Illustrative Graphs

FIG. 3Aillustrates a flow diagram300illustrating the operations performed by the fault detection server140.FIGS. 3B-3Idepict graphs320-330that graphically represent the operations performed by the fault detection server140. In some embodiments, the fault detection server140performs the operations described herein, but does not generate graphical representations of these operations. In other embodiments, the fault detection server140generates the graphical representations of these operations and displays one or more of the graphs320-330in the interactive user interface generated by the user interface generator145.

As illustrated inFIG. 3A, sensor data302A-N can be received from various sensors115. The sensor data302A-N can be time-series data, as illustrated in the graph320inFIG. 3B. In the example ofFIG. 3B, the sensor data302A-N includes temperature values over time. While a user may notice that the sensor data302A-N generally oscillates within a range of temperatures, it may be very difficult for the user to identify any trends or faults from just a visual inspect of the sensor data302A-N.

In an embodiment, an indicator function304A is applied to the sensor data302A, an indicator function304B is applied to the sensor data302B, and so on. While a single indicator function is depicted inFIG. 3Aas being applied to a given sensor data302A-N, this is merely for illustrative purposes and is not meant to be limiting. Any number of indicator functions can be applied to the same sensor data302A-N. The graph321inFIG. 3Cillustrates an example anomalous behavior time-series generated by the fault detection server140(e.g., the feature detector141) in response to application of an indicator function304A-N to one of the sensor data302A-N. As depicted in the graph321, the time-series has a high value corresponding to a true condition (e.g., a determination that anomalous behavior has occurred) at various time instances in which a condition defined by the indicator function304A-N is satisfied and a low value corresponding to a false condition (e.g., a determination that no anomalous behavior has occurred) at various time instances in which a condition defined by the indicator function304A-N is not satisfied.

The fault detection server140(e.g., the feature detector141or the spectral analyzer142) may perform a multiplex306operation on the various anomalous behavior time-series that are generated (e.g., N anomalous behavior time-series are generated in this example). For example, the fault detection server140may aggregate the various anomalous behavior time-series.

The fault detection server140(e.g., the spectral analyzer142) can then perform a spectral analysis308on the aggregated anomalous behavior time-series to convert the data from the time domain to the frequency domain and generate spectral responses for each of the time-series. The graph322inFIG. 3Drepresents the data in the frequency domain. Each row in the graph322may correspond to a different sensor and indicator function pair and a shading of the graph322at a particular row and time period may represent a magnitude value (or a phase value or a combination of magnitude and phase values). For example, a lighter the shading (or a darker the shading), the higher the magnitude (or phase) value is. As depicted in the graph322, many of the sensor and indicator function pairs have a high magnitude (or phase) value near the time period highlighted by marker335. In alternative embodiments, the fault detection server140can perform the multiplex306operation after the spectral analysis308operation.

The spectral response of an anomalous behavior time-series can depend on the anomalous behavior time-series data itself. For example,FIGS. 3E-3Gdepict the spectral responses for different types of anomalous behavior time-series. As illustrated inFIG. 3E, the graph323depicts an anomalous behavior time-series in which no anomalous behavior is detected (e.g., no fault occurred). The graph324depicts the spectral response of such an anomalous behavior time-series (e.g., the spectral response has a uniformly low magnitude and/or phase). As illustrated inFIG. 3F, the graph325depicts an anomalous behavior time-series in which non-recurrent anomalous behavior is detected (e.g., a one-time fault occurred). The graph326depicts the spectral response of such an anomalous behavior time-series. As illustrated inFIG. 3G, the graph327depicts an anomalous behavior time-series in which recurrent anomalous behavior is detected (e.g., a recurring fault occurred). The graph328depicts the spectral response of such an anomalous behavior time-series.

The fault detection server140(e.g., the fault detector143) can then bin310the spectral responses at a selected time period using clustering techniques. For example, a 24 hour time period can be selected (or a weekly time period, a seasonal time period, an annual time period, etc.), and the magnitudes associated with the sensor and indicator function pairs can be reorganized by sensor and indicator function, as depicted in the graph329inFIG. 3H. The binning310, scoring, ranking, and fault signature comparisons is described herein with respect to magnitude values, but this is merely for illustrative purposes and is not meant to be limiting. The binning310, scoring, ranking, and fault signature comparisons can also be performed using phase values from the spectral response or combinations of magnitude values and phase values from the spectral response. Each row in the graph329may correspond to a sensor (or component) and each column in the graph329may correspond to an indicator function. Alternatively, the rows and columns can be flipped. A tile can be shaded based on the magnitude of the value associated with the sensor and indicator function pair. In some embodiments, a darker color represents a higher magnitude and a lighter color represents a lower magnitude (or vice-versa).

In addition to the binning310, the fault detection server140can score and/or rank the magnitude values associated with the sensor and indicator function pair based on the level of coincidence and/or severity of clusters of magnitude values. For example, cluster340includes magnitude values corresponding to the same sensor that have similar magnitudes (e.g., a high level of coincidence) and similarly high magnitudes (e.g., a high level of severity). Thus, the cluster340may receive a high score and/or rank. Likewise, cluster350also includes magnitude values corresponding to the same sensor that have similar magnitudes (e.g., a high level of coincidence), but relatively low magnitudes (e.g., a low level of severity). Thus, the cluster350may receive a lower score and/or rank than the cluster340. Cluster360includes magnitude values corresponding to the same sensor that do not have similar magnitudes (e.g., a low level of coincidence), and relatively average magnitudes (e.g., a medium level of severity). Thus, the cluster360may receive a lower score and/or rank than the cluster340and/or the cluster350. In some embodiments, the tiles are re-shaded to correspond to the determined score and/or rank.

The binning can help the fault detection server140identify possible faults because similar time-series data may correspond to points in spectral coordinates that are near each other. Thus, if anomalous behavior time-series data that is known to correspond to a fault is similar to recently analyzed anomalous behavior time-series data (and thus a fault may have occurred), then an analysis of the proximity of the spectral responses of the two time-series can be an appropriate technique implemented by the fault detection server140to determine that a fault is detected and what the probability that the fault actually occurred is. For example, graph330inFIG. 3Idepicts points in a spectral space that correspond to binned values. As illustrated inFIG. 3I, one point is marked by marker336and a cluster of two points are marked by marker337, where the point marked by marker336and the two points marked by marker337are some distance apart. Graph331illustrates a time-series associated with the point marked by the marker336, graph332illustrates a time-series associated with one of the points marked by the marker337, and graph333illustrates a time-series associated with the other point marked by the marker337. Because the two points marked by marker337are near each other, the graphs332and333are very similar. However, because the point marked by marker336is far from the other two points, the graph331is different from the graphs332and333.

Once the binning310is complete, the fault detection server140can detect faults312that may have occurred by comparing the scores and/or ranks and the indicator function(s) associated with the scores and/or ranks with various fault signatures. Alternatively, the fault signatures can be described as magnitude values and associated indicator function(s), and the fault detection server140can detect faults312by comparing the magnitude values (e.g., as illustrated in the graph329) with the fault signatures to identify matches. For example,FIG. 3Hillustrates a sample fault signature370. The magnitude of the first tile of the fault signature370matches the magnitude of the first tile in the cluster350, the magnitude of the second tile of the fault signature370matches the magnitude of the second tile in the cluster350, and the magnitude of the third tile of the fault signature370matches the magnitude of the third tile in the cluster350. If the first tile in the cluster350and the first tile in the fault signature370correspond to the same indicator function, if the second tile in the cluster350and the second tile in the fault signature370correspond to the same indicator function, and/or if the third tile in the cluster350and the third tile in the fault signature370correspond to the same indicator function, then the fault detection server140may determine that a fault has likely occurred, the probability that the fault occurred (e.g., which is based on close the score, rank, and/or magnitude of a tile is to the corresponding tile in the fault signature370), and that the fault is associated with the sensor (or component) corresponding to the cluster350. Information on detected faults (e.g., a description, probability that the fault occurred, etc.) can be displayed in the interactive user interface. While the magnitudes of the tiles in the fault signature370do not match the magnitudes of the tiles in the clusters340and360, the fault detection server140may nonetheless determine that a fault has likely occurred if the magnitudes fall within a range of magnitudes defied by the fault signature370or that a fault has potentially occurred if the machine learning indicates that the magnitudes correspond to behavior associated with faults.

Example Physical Structure Summaries in an Interactive User Interface

FIGS. 4A-4Billustrate a user interface400displaying a physical structure110summary information for a plurality of physical structures110. In an embodiment, the user interface400is generated by the user interface generator145. The summary information displayed in the user interface400can be derived from the sensor data stored in the sensor data store150and/or retrieved from the sensors115of various physical structures110. For example, as illustrated inFIG. 4A, the user interface400can display summary information for Tower 1, Office Park 1, and Tower 2.

Information for Tower 1 can be displayed in window402. The window402includes four sub-windows410-413, where window410depicts new findings related to Tower 1 (e.g., new detected faults) and an increase or decrease in new findings over a period of time, window411depicts open findings related to Tower 1 (e.g., faults that have been viewed, but not addressed) and an increase or decrease in open findings over a period of time, window412depicts closed findings related to Tower 1 (e.g., faults that have been addressed) and an increase or decrease in closed findings over a period of time, and window413depicts a key performance index (KPI), such as thermal comfort index (TCI). For example, TCI for Tower 1 is depicted over the indicated period of time (e.g., the previous week in this example) and an increase or decrease in the TCI over that time period. The TCI can represent a percentage of time that the temperature of a room or physical structure110is within a defined comfort range. For example, the TCI can be a number of temperature records within a temperature range (e.g., 70-76 degrees Fahrenheit) over all temperature records (e.g., temperature records gathered when the locations are occupied). Other KPIs may also be depicted as they relate to energy efficiency, occupant comfort, equipment useful life, and/or the like.

Likewise, information for Office Park 1 can be displayed in window404and information for Tower 2 can be displayed in window406. Sub-windows420and430correspond to the type of information depicted in sub-window410, sub-windows421and431correspond to the type of information depicted in sub-window411, sub-windows422and432correspond to the type of information depicted in sub-window412, and sub-windows423and433correspond to the type of information depicted in sub-window413.

In an embodiment, a user can select any of the windows or sub-windows to view additional information. For example, the user can select the sub-window413via cursor450to view more information about the KPI. Selection of the sub-window413causes the user interface400to display a graph460depicting the KPI over time and a table470depicting the KPI by floor in Tower 1, as illustrated inFIG. 4B. The table470can include a numerical value representing a current KPI for a given floor, a shaded graph visually representing the current KPI for a given floor (e.g., where the darker the shade, the higher the KPI), and a change in KPI over a time period for a given floor.

Example Display of Detected Faults in an Interactive User Interface

FIGS. 5A-5Billustrate a user interface500displaying the faults detected for a physical structure110. In an embodiment, the user interface500is generated by the user interface generator145. A user can cause the user interface500to be displayed by, for example, selecting windows402,404, and/or406in the user interface400.

As illustrated inFIG. 5A, the user interface500displays an identification of the physical structure110in field510(e.g., Tower 1 in this case), a table512displaying fault information, a new button515, an open button520, and a closed button525. Each row in the table512can correspond to a fault. Each row can identify a fault ID, a classification of the fault (e.g., undercooling, overcooling, economizer hunting, etc.), a floor in Tower 1 in which the fault occurred, a specific equipment associated with the fault (e.g., a specific variable air volume system, fan powered box, air handling unit, HVAC system, etc.), a number of days during which the fault is observed, a fault feedback provided by the user (e.g., the fault is confirmed as a fault, the fault is not confirmed, the fault is incorrectly diagnosed as a fault, further investigation is needed, etc.), an identification of the correction implementer (e.g., a building, a tenant, a building vendor, a tenant vendor, that a fault cannot be addressed cost-effectively for a given reason, etc.), and a correction status (e.g., action pending, addressed, required, etc.).

The buttons515,520, and525can be used as filters. For example, selection of the new button515can cause the user interface500to only display new faults in the table512. A fault may be categorized as new until a user indicates that the fault has been addressed and/or until a threshold period of time elapses. Likewise, selection of the open button520can cause the user interface500to only display open faults in the table512and selection of the closed button525can cause the user interface500to only display closed faults in the table512. A fault may be categorized as closed if a user has indicated that the fault has been addressed and the fault has not been observed by the fault detection server140in any analysis period a threshold amount of time after the user indicates that the fault is addressed. In additional embodiments, selection of sub-window410can result in the user interface500displaying the same information as the selection of the new button515, selection of sub-window411can result in the user interface500displaying the same information as the selection of the open button520, and selection of sub-window412can result in the user interface500displaying the same information as the selection of the closed button525.

In an embodiment, any of the rows of the table512can be selected to view additional information regarding the chosen fault. For example, the user can select the fault identified with the ID of 2 via the cursor450. Selection of this row causes the user interface500to display a window530that displays more information about the fault, as illustrated inFIG. 5B. The window530includes some of the same information as provided in the table512, as well as a detailed description of the fault, a date first observed, a date last observed, a time to address a fault, and an option to enter notes and/or view automatically generated notes (e.g., where the automatically generated notes can be generated based on any of the fault detection server140parameters). The window530also provides the user with an option to edit the tenant name, the identification of the entity in charge of maintaining the physical structure110(or specific fault), the identification of the correction implementer, the vendor type, and/or the correction status. The user can also indicate whether the fault can be confirmed. This user feedback can be provided to the machine learning feedback system144to improve the operation of the fault detector143. In further embodiments, the table512or another window, not shown, can depict some or all of the intervals during which a fault was observed, plots of the associated equipment's sensor measurements, fault detection accuracy (e.g., a percentage of faults that are confirmed by users as being faults), and/or a history of feedback provided by a user or set of users. Furthermore, any of the fault data can be viewed by fault type, by equipment type, by implementer by physical structure110, by implementer across physical structures110(e.g., a contractor, such as a mechanical service company), by comparisons across physical structures110, and/or over specific time periods.

As described herein, once a user (e.g., a building engineer, operator, administrator, etc.) has reviewed a fault in the user interface500, the user can provide feedback on whether the fault has been verified (e.g., fault feedback) and what is being done to correct the fault (e.g., as indicated under correction implementer and correction status). If a user indicates that a fault cannot be addressed cost-effectively, the user may be prompted to provide an explanation under “building notes.” Similarly, if a user specifies that a reported fault is an incorrect diagnosis, the user may be prompted to provide an explanation under “building notes.”

In an embodiment, the fault detection server140(e.g., the fault detector143) can analyze sensor115data at different time intervals (e.g., 1 day, 1 year, etc.). In some cases, a user may not address a pending fault. When the fault detection server140analyzes the sensor115data, the fault detection server140can generate an identical fault (e.g., a fault that corresponds to the same equipment, the same period of time or days observed, etc.). In such a situation, the user interface500can prompt the user to overwrite the previous fault with the newly detected fault.

FIG. 6illustrates a user interface600displaying a graphical representation of a spectral response by floor and period in the physical structure110. In an embodiment, the user interface600is generated by the user interface generator145. A user can cause the user interface600to be displayed by, for example, selecting windows402,404, and/or406in the user interface400.

As illustrated inFIG. 6, the user can select the physical structure110via field510(e.g., Tower 1 in this case), a floor to view via field610(e.g., floor 1 in this case), and a time period to view via field615(e.g., a 24 hour period in this case). Selection of the physical structure110, floor in the physical structure110, and time period can cause the user interface600to display floor plans of the selected floor, where a first floor plan620displays a phase of the spectral response associated with the sensors115and/or components located on the selected floor and a second floor plan630displays a magnitude of the spectral response associated with the sensors115and/or components located on the selected floor. Each of the rooms in the floor plans620and630can be shaded to indicate a value of the phase or magnitude (e.g., a darker color can represent a higher phase or magnitude).

Thus, the user interface600allows a user to visually understand what locations in a physical structure110may have issues and which locations may not. For example, an area with a high magnitude or phase may indicate that indicator functions applied to the sensors115or components in that area are producing true conditions during the selected time period, which can indicate that a fault has occurred. Likewise, an area with a low magnitude or phase may indicate that indicator functions applied to the sensors115or components in that area are producing false conditions during the selected time period, which can indicate that a fault has not occurred.

Example Process Flow

FIG. 7is a flowchart700depicting an illustrative operation of detecting a fault in a data-based system. The method ofFIG. 7may be performed by various computing devices, such as by the fault detection server140described above. Depending on the embodiment, the method ofFIG. 7may include fewer and/or additional blocks and the blocks may be performed in an order different than illustrated.

In block702, first values measured by a sensor of a component in the data-based system during a first time period are retrieved. For example, the component can be an HVAC system and the sensor can measure temperature values over a period of time.

In block704, a first indicator function is applied to each of the first values to generate respective second values. For example, the indicator function can define an anomalous condition represented by a threshold value (e.g., a threshold value that corresponds to a setpoint) such that a true condition occurs if the threshold value is exceeded at a given time instance and a false condition occurs if the threshold value is not exceeded at a given time instance. A respective second value can either be a high value (e.g., if the threshold value is exceeded) or a low value (e.g., if the threshold value is not exceeded).

In block706, the second values are processed using a spectral analysis to generate a plurality of third values. For example, the second values, which are time-series data in the time domain, can be converted into the frequency domain. By converting the second values into the frequency domain, the newly generated third values may correspond to a magnitude value, a phase value, a combination of magnitude and phase values associated with a specific time period (e.g., 24 hours, 168 hours, weekly, seasonally, annually, etc.).

In block708, a first fault signature is retrieved. A first fault can define a fault via the combination of one or more indicator functions. The first fault signature can represent the first fault and be defined as having a certain magnitude value, a certain phase value, a certain combination of magnitude and phase values, and/or a certain score and/or rank for a given indicator function and time period.

In block710, a first third value in the plurality of third values is identified that is associated with a second time period in the plurality of time periods. For example, a fault can be associated with a specific time period. The fault detection server140and/or a user via the user device160can select a specific time period to analyze for faults. The third values can correspond with different time periods, and the third value associated with the selected time period is identified.

In block712, a fault is detected as occurring with a first probability in response to a determination that the fault magnitude value of the first fault signature matches the magnitude value of the first third value. For example, if the magnitude of the third value that corresponds with the selected time period matches the magnitude of the first fault signature, then the fault detection server140may determine that a fault occurred. The first probability may depend on how close the magnitude of the third value that corresponds with the selected time period is to the magnitude of the first fault signature (e.g., the closer the magnitudes, the higher the probability). In further embodiments, the fault detection server140also determines whether the indicator function corresponding to the third value is the same as the indicator function corresponding to the first fault signature before confirming that a fault is detected. In other embodiments, the magnitude of the third value is converted into a score and/or rank, the first fault signature is defined in terms of a score and/or rank (instead of a magnitude value), and the fault detection server140compares the scores and/or ranks to determine whether a fault occurred with the first probability. In alternative embodiments, the fault signature can be associated with a fault phase value and the phase value of the first third value can be compared with the fault phase value to determine whether a fault is detected as occurring with the first probability.

In block714, the detected fault is displayed in an interactive user interface. In an embodiment, a user can provide feedback on whether a fault was accurately detected. If the detected fault was misdiagnosed (and is actually not a fault), this feedback can be provided to the fault detection server140. Artificial intelligence (e.g., machine learning, support vector regression, support vector machines, ensemble methods, artificial neural networks, diffusion maps, etc.) can be used to modify the behavior of the fault detection server140such that a similar type of fault may not be identified as a fault in the future.

Terminology

Each of the processes, methods, and algorithms described in the preceding sections may be embodied in, and fully or partially automated by, code modules executed by one or more computer systems or computer processors comprising computer hardware. The processes and algorithms may be implemented partially or wholly in application-specific circuitry. The term “substantially” when used in conjunction with the term “real-time” forms a phrase that will be readily understood by a person of ordinary skill in the art. For example, it is readily understood that such language will include speeds in which no or little delay or waiting is discernible, or where such delay is sufficiently short so as not to be disruptive, irritating or otherwise vexing to user.