Industrial asset temporal anomaly detection with fault variable ranking

A method of temporal anomaly detection includes accessing sensor data readings obtained at a monitored industrial asset, performing a data cleanup operation on at least a portion of the accessed sensor data readings, transforming at least the cleaned-up portion of the accessed sensor data readings to time series feature space sensor data, applying a multi-kernel-based projection algorithm to the time series feature space sensor data, computing a respective anomaly score and a respective ranking for one or more variables of the sensor data readings, and providing at least the computed respective anomaly score or the respective ranking for at least one of the one or more variables to a user. Ranking the anomaly score includes comparing each anomaly score to a threshold and then assigning a ranking to scores with a magnitude greater than the threshold based on its magnitude. A system and a non-transitory computer-readable medium are also disclosed.

BACKGROUND

Effective data-driven analytics is possible using advancements in sensor technologies and networked industrial machinery design. Industrial assets often have multiple sensors monitoring operation. With connection to the Internet of Things (IoT), access to the sensor data can be obtained in data streams at almost real time. This increasing availability of streaming time series data can have a practical purpose in detecting anomalies in the operation of the industrial asset.

An industrial asset can be, among other things and without limitation, a generator, gas turbine, power plant, manufacturing equipment on a production line, aircraft engine, wind turbine generator, locomotive, imaging device (e.g., X-ray, MRI, CT, PET, SPECT systems), or mining operation drilling equipment. Each instance of a time series data set is recorded at a certain timestamp of an asset. An event is a failure case that happens at a certain timestamp within the time series data.

An anomaly in the time series data can indicate a change in the industrial asset's status (e.g., a change in turbine rotation). Identification of the anomaly can be beneficial in predicting faults and/or updating maintenance schedules.

DESCRIPTION

Embodying systems and methods provide detection of temporal anomaly(ies) in multivariate time series data. An embodying temporal anomaly detection (TAD) algorithm can be an unsupervised, high-dimensional detector that incorporates manifold learning and provides kernel construction options. An embodying TAD algorithm can provide an anomaly score for each input sample, and also a corresponding feature/variable ranking.

A temporal anomaly can be difficult to detect, but the temporal anomaly can serve as an early warning that there could be an underlying problem with the industrial asset. An embodying TAD algorithm can provide an anomaly score for each input sample (stream of sensor data). The anomaly score is indicative of the likelihood of the corresponding sample being the anomaly—for example, a higher anomaly score makes it more likely of a sample being the anomaly source. It should be readily understood that the invention is not so limited, and that other scales can be applied to the anomaly score.

In accordance with embodiments, along with an anomaly score, an embodying TAD algorithm can support further decision-making by performing root cause analysis. Also, the TAD algorithm can provide a corresponding feature/variable ranking, which can rank the most contributing feature(s) to the detected anomaly(ies).

An embodying TAD algorithm can have one or more of the following characteristics:

(1) Unsupervised: Anomaly detection can be unsupervised (i.e., no anomaly label is required). In this implementation, the algorithm can detect those anomalies that are not well-understood or quantified. The algorithm's training set is assumed to be normal. The training set need not be purely normal, as long as the abnormality in the training data represents a small portion. Any samples with strongly deviated pattern in a testing set would be assigned a high anomaly score.

(2) High-dimensional: In this implementation there is an assumption that on the occurrence of an anomaly (e.g., component failure), an anomalous pattern appears in the time series data for multiple variables simultaneously. This approach can be effective when there are a lot of possibly-related variables to the anomalies. The algorithm can effectively detect anomalous patterns from a large number of input tags (raw variables or derived variables), where input data dimensions can be voluminous (e.g., hundreds or perhaps thousands).

(3) Multi-kernels: The algorithm can operate with the selection of differing options of kernel construction. The algorithm can include more than one kernel to measure the degree of anomaly, which can not only built upon Euclidean space (e.g. Gaussian kernel), but also other linear and non-linear kernel space.

Options of kernel construction can include, but are not limited to, “braycurtis”, “Canberra”, “Chebyshev”, “cityblock”, “correlation”, “cosine”, “dice”, “euclidean”, “hamming”, “jaccard”, “kulsinski”, “mahalanobis”, “matching”, “minkowski”, “rogerstanimoto”, “russellrao”, “euclidean”, “sokalmichener”, “sokalsneath”, “sqeuclidean”, “yule”. The kernel selection can depend on differentiability of the data in that kernel space. The distribution of training dataset (which can be normal or near normal) should be differentiable in the selected kernel space.

FIG. 1illustrates a process that implements temporal anomaly detection algorithm100in accordance with embodiments. Sensor data is accessed, step105. The sensor data can be raw (i.e., sensor reading data), multivariate, temporal sensor data from a monitored industrial asset. Data cleanup and preprocessing can be performed, step110, which can include filling missing values. The cleanup can include removal of outlier data points (e.g., perhaps a measurement error from the sensor). Data can be filled by interpolation and/or imputation techniques.

The raw sensor reading data variables can be transformed, step115, to time series features (transformed variables) using temporal feature engineering techniques. In some implementations, feature transformation is calculated with a sliding-window with a certain length l. Although not limiting, two types of feature transformations can be: univariate and pair-wise. The input is vector b related to one/two raw features, with length(b)=l. The output is one scalar which describes the statistics of b in a certain way.

spk⁡(b)=bl/2-mean⁡(b1:l3,b2⁢l3:l).
For the a two dimensional time-series vector b ∈Rl×2, the following pair-wise feature transformation options can include: Covariance: cov(b)=covariance (b:,1, b:,2); and Correlation: crl(b)=correlation(k:,1, b:,2). The transformed data set can be projected, step120, onto a low embedding space using multi-kernel-based projection method(s).

FIG. 2illustrates a process that implements multi-kernel-based projection (MKP) algorithm200in accordance with embodiments. In some embodiments, this method can be implemented as a manifold learning modeling algorithm. A training data set and a testing data set are accessed, step205, as input for the MKP algorithm. The training set can be historical data before a selected time and the testing set can be data after that selected time. The training and the testing sets are derived from sensor data after undergoing the data cleanup and preprocessing process (e.g. data cleaning, feature engineering and data normalization).

The training data set can be expresses as Xtrn∈ Rn1×mand the testing data set as Xtst∈ Rn2×m, where n1(n2) is the number of training (or testing) samples, and m is the number of transformed features. The number of low embedding kernels is represented by k. MKP algorithm200can provide an anomaly score output s ∈ Rn2×1for the testing data set.

A similarity matrix (A1:t=[A1, A2, . . . , At] for Xtrn) is constructed, step210; where t is the number of the chosen kernel options and Ai∈ Rn1×n1is the similarity matrix based on each kernel (1≤i≤t). For each element of the similarity matrix (Aiin A1:t), a projection matrix is calculated, step215.

Calculation of the projection matrix includes first, calculating
Li=Di−Ai(EQ. 1)
where Diis the degree matrix of Ai; then, calculating top k eigenvectors Ψi∈ Rn1×kwith the smallest eigenvalues
λi∈R1×kofLi(EQ. 2)
The projection matrix can then be calculated as
Pi∈Rm×k(EQ. 3)
from Lito ψiusing elastic net regression.

After a projection matrix is calculated for each element of the similarity matrix, step220, the MKP algorithm proceeds. The MKP algorithm follows steps225-235to calculate projected embeddings and an anomaly score matrix.

At step225, for each element in the projection matrix (Pi), projected embeddings are calculated by applying each Pito Xtstto get the projected embeddings
ϕi∈Rn2×k(EQ. 4)
Corresponding elements of an anomaly score matrix are calculated, step230, and can be expressed as
Si,j=Σpe−λi,pϕi(j,p)  (EQ. 5)
where j is the index of testing sample, p is the index of eigenvector/eigenvalue.

The projected embeddings and corresponding anomaly score matrix elements are calculated for all elements of the projection matrix, step235. Once all elements are calculated, a final anomaly score vector (s by sj=ΣiSi,j; where j is the index of each testing sample) is computed, step240. The anomaly score is calculated by measuring the neighborhood density of each sample in the low embedding space. The results of MKP algorithm200are returned to TAD algorithm100.

With reference again toFIG. 1, the anomaly score and variable ranking output is provided to a user, step125. This output can include identification of a transient fault in the industrial asset; identification of the temporal event that caused the transient fault; and/or the fault propagation through the time series data. The identification of the transient fault can be determined based on a user's predefined threshold. The user can determine the threshold level from parameters such as, but not limited to, the nature (i.e., type) of the industrial asset and a case-specific amount of variation or dispersion in the sensor data values that is acceptable to the user. The fault ranking can be quantified by the magnitude of each identified fault's individual variance from the user's predefined threshold.

FIG. 3depicts system300for implementing temporal anomaly detection algorithm100in accordance with embodiments. Control processor310can include processor unit312and memory unit314. The control processor can be in direct communication with data store320, or in indirect communication across electronic communication network340. Processor unit312can execute executable instructions322, which cause the processor to perform TAD algorithm100and MKP algorithm200in accordance with embodiments. Memory unit314can provide the control processor with local cache memory.

The data store can include sensor data records326that contain operational data monitored by sensor suite355in industrial asset350. Only one industrial asset is depicted, however, there can be multiple industrial assets each including sensor suites that provide monitored data across electronic communication network340to data store320. The data store can also include TAD algorithm324, MKP algorithm330, training data set330, and testing data set332.

In some embodiments, the anomaly score and variable ranking outputs of TAD algorithm100(step125) can be presented graphically.FIG. 4illustrates an exemplary graphical output400of the temporal anomaly detection algorithm in accordance with embodiments.

TAD output curve410represents monitored sensor data over a time period from a single sensor. This output curve depicts the data in time series feature space after processing by TAD algorithm100. Failure spike440represents a failure in an industrial asset (e.g., a lean blowout (LBO) in a turbine generator). Operator effect spike450indicates failure propagation.

Alert spike430,432each represent a failure event in the industrial asset. These spikes occur at different times, and each exceeds user predefined threshold420. Analysis of TAD output curve420shows that before the LBO occurrence, the TAD algorithm successfully detected a problem(s) prior to the occurrence of the failure event. This early detection can provide a possibility for any early response to prevent failure events and their subsequent failure propagation.

FIG. 5illustrates a second exemplary graphical output500of the temporal anomaly detection algorithm ofFIG. 1in accordance with embodiments. Graphical curve500provides a view on key contributing features to the detected alert spike430,432. This view of can be used to support decisions regarding repair and/or maintenance scheduling for the industrial asset. TAD output curve510is a superimposition of input space sensor data from multiple sensors. Depicted in this illustration is raw data from five sensors. The invention is not so limited and other numbers of sensor data can be superimposed. Time period530represents a period when the industrial asset is operating in normal range520. Perturbation spike540indicates the occurrence of a problem. After the problem occurs, the industrial asset returns to normal operating range520during time period550. Analysis of TAD output curve510informs that a problem occurred but operations returned to normal, which can lead to a conclusion that the industrial asset requires maintenance. More particularly, the component(s) being monitored by sensor(s) that contribute to perturbation spike540should be evaluated, maintained, repaired, and/or replaced.

In accordance with some embodiments, a computer program application stored in non-volatile memory or computer-readable medium (e.g., register memory, processor cache, RAM, ROM, hard drive, flash memory, CD ROM, magnetic media, etc.) may include code or executable program instructions that when executed may instruct and/or cause a controller or processor to perform methods discussed herein such as a method of temporal anomaly detection and fault analysis, as disclosed above.

The computer-readable medium may be a non-transitory computer-readable media including all forms and types of memory and all computer-readable media except for a transitory, propagating signal. In one implementation, the non-volatile memory or computer-readable medium may be external memory.

Although specific hardware and methods have been described herein, note that any number of other configurations may be provided in accordance with embodiments of the invention. Thus, while there have been shown, described, and pointed out fundamental novel features of the invention, it will be understood that various omissions, substitutions, and changes in the form and details of the illustrated embodiments, and in their operation, may be made by those skilled in the art without departing from the spirit and scope of the invention. Substitutions of elements from one embodiment to another are also fully intended and contemplated. The invention is defined solely with regard to the claims appended hereto, and equivalents of the recitations therein.