Description:FORM 2

THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENT RULES, 2003

COMPLETE SPECIFICATION
(See Section 10 and Rule 13)

Title of invention:
METHOD AND SYSTEM FOR STATE BASED ENTROPY COMPUTATION FOR ANOMALY DETECTION TO PREDICT MACHINE FAILURE

Applicant:
Tata Consultancy Services Limited
A company Incorporated in India under the Companies Act, 1956
Having address:
Nirmal Building, 9th Floor,
Nariman Point, Mumbai 400021,
Maharashtra, India

The following specification particularly describes the invention and the manner in which it is to be performed.
TECHNICAL FIELD
The embodiments herein generally relate to the field of machine health monitoring and, more particularly, to a method and system for state based entropy computation for anomaly detection to predict machine failure.

BACKGROUND

Remote and/or automated monitoring of machines to detect anomalies and predict failures is a well-researched area. Sensors capturing the machine status generate huge amount of data containing vital information about the health of the machine. Sensors on machines, typically on vehicle engines, measure various parameters or features associated with the engine such as temperature, pressure, rpm, speed, accelerations, fuel, oil etc. in a very small intervals of 5 seconds, generating huge volume of data. Analyzing the data and understanding the behavior of the engine, requires huge amount of data processing and analytical abilities to rightly identify true anomalies that contribute towards machine failure.
Conventional anomaly and fault detection methods are deficient in that they either require considerable expert analysis or rely on Machine learning models that fail to capture unmodelled anomalies. To overcome these deficiencies, model-free statistical approaches to this analysis are needed that do not require significant user input. Thus, entropy-based approaches for anomaly detection are appealing since they provide more fine-grained insights than the conventional data analysis.
Most of the existing entropy based approaches focus on outlier based anomaly detection. However, the outlier based anomaly detection technique has limitation as it works only when there is a high value observed. However, in a scenario, in a sensor value of a vehicle may be reporting a gradual change in value at each interval for a coolant temperature. If for example, rate of change of entropy is 5% at time t1, and 3% at time t2 and 1% at time t3, then the change in entropy is a small value and the outlier technique will not be able to consider it. However, since slowly the coolant temperature is decreasing, it is desired this change is detected as it will lead to vehicle engine failure.
In another existing approach, change of entropy with the time scale is considered and machine learning (ML) techniques are used to predict the changes. This existing method is designed for detecting only vibrational changes in the machine and is based on assumption that machine being monitored works in same operating environment. However, when the machine is a vehicle engine, the normal working sensor reading differ from one operating condition to other. For example, the range of sensor readings such as for temperature parameter of the vehicle engine on a plane road to a hill ascent are entirely different, but vehicle engine is still in normal operating range. However, above existing method, if applied fails to rightly tap monitor engine health for such operational environment variation scenarios as there is a possibility of false anomaly detection, which are obvious changes in sensor readings due to change in operational environment. Thus, a technical approach used to compute entropy and detect anomalies needs to be modified to tap both sudden and incremental anomalies while also taking into consideration the operational environment changes.

SUMMARY
Embodiments of the present disclosure present technological improvements as solutions to one or more of the above-mentioned technical problems recognized by the inventors in conventional systems.
For example, in one embodiment, a method for state based entropy computation for anomaly detection to predict machine failure is provided. The method includes receiving a plurality of sensor readings at regular time stamps, wherein the plurality of sensor readings corresponds to a plurality of features associated with the machine to be monitored for anomaly detection. Further, the method includes predicting a plurality of state probabilities of each time stamp for each of the plurality of features, wherein the plurality of state probabilities are predicted corresponding to each of a plurality of hidden states in a state space identified for each of the plurality of sensor readings. Further, the method includes computing an entropy of each of the plurality of features for each time stamp from the plurality of state probabilities. Further, the method includes computing a mean entropy of each of the plurality of features for an entropy compute interval by aggregating the entropy for each time stamp over the entropy compute interval. Furthermore, the method includes computing the mean entropy for successive entropy compute intervals and simultaneously compute a distance between a current mean entropy and a previous mean entropy for each of the plurality of features over the successive entropy compute intervals, wherein the distance is computed using a distance computation technique. Further, the method includes obtaining a rate of change of the mean entropy based on change in the distance between the current mean entropy and the previous mean entropy of the successive entropy compute intervals. Furthermore, the method includes detect a plurality of anomalies in the plurality of sensor readings, wherein: a short-lived anomaly is recorded if the rate of change of the mean entropy between two consecutive entropy compute intervals is higher than a predefined ratio, wherein the short-lived anomaly captures switching of a value of a feature among the plurality of features from a normal value to an abnormal value without providing prior indications; and an incremental anomaly is recorded if the rate of change of a current mean entropy as compared with aggregated mean entropies in an immediate previous predefined time interval satisfies an incremental anomaly entropy change criterion, wherein the incremental anomaly captures slow deviations in the mean entropy at each entropy compute interval.
Further, the method includes building a first deep learning model to predict the anomalies from real time sensor readings of the machine based on supervised learning using the computed entropy associated with one or more sensor readings that correspond to a complete machine failure, a partial machine failure and a normal condition of the machine. Further, the method includes building a second deep learning model to predict a time to critical of the machine using time durations recorded between the detected anomalies and the complete machine failure as training data. Furthermore, the method includes utilizing a self-learning approach that learns from the computed entropy, predictions of the first deep learning model and predictions of the second deep learning model to predict anomalies without detecting short-lived anomalies or the incremental anomalies.
In another aspect, a system for state based entropy computation for anomaly detection to predict machine failure is provided. The system comprises a memory storing instructions; one or more Input/Output (I/O) interfaces; and one or more hardware processors coupled to the memory via the one or more I/O interfaces, wherein the one or more hardware processors are configured by the instructions to receive a plurality of sensor readings at regular time stamps, wherein the plurality of sensor readings corresponds to a plurality of features associated with the machine to be monitored for anomaly detection. Further, the one or more hardware processors are configured to predict a plurality of state probabilities of each time stamp for each of the plurality of features, wherein the plurality of state probabilities are predicted corresponding to each of a plurality of hidden states in a state space identified for each of the plurality of sensor readings. Further, the one or more hardware processors are configured to compute an entropy of each of the plurality of features for each time stamp from the plurality of state probabilities. Further, the one or more hardware processors are configured to compute a mean entropy of each of the plurality of features for an entropy compute interval by aggregating the entropy for each time stamp over the entropy compute interval. Furthermore, the one or more hardware processors are configured to compute the mean entropy for successive entropy compute intervals and simultaneously compute a distance between a current mean entropy and a previous mean entropy for each of the plurality of features over the successive entropy compute intervals, wherein the distance is computed using a distance computation technique. Further, the one or more hardware processors are configured to obtain a rate of change of the mean entropy based on change in the distance between the current mean entropy and the previous mean entropy of the successive entropy compute intervals. Furthermore, the one or more hardware processors are configured to detect a plurality of anomalies in the plurality of sensor readings, wherein: a short-lived anomaly is recorded if the rate of change of the mean entropy between two consecutive entropy compute intervals is higher than a predefined ratio, wherein the short-lived anomaly captures switching of a value of a feature among the plurality of features from a normal value to an abnormal value without providing prior indications; and an incremental anomaly is recorded if the rate of change of a current mean entropy as compared with aggregated mean entropies in an immediate previous predefined time interval satisfies an incremental anomaly entropy change criterion, wherein the incremental anomaly captures slow deviations in the mean entropy at each entropy compute interval.
Further, the one or more hardware processors are configured to build a first deep learning model to predict the anomalies from real time sensor readings of the machine based on supervised learning using the computed entropy associated with one or more sensor readings that correspond to a complete machine failure, a partial machine failure and a normal condition of the machine. Further, the one or more hardware processors are configured to build a second deep learning model to predict a time to critical of the machine using time durations recorded between the detected anomalies and the complete machine failure as training data. Furthermore, the one or more hardware processors are configured to utilize a self-learning approach that learns from the computed entropy, predictions of the first deep learning model and predictions of the second deep learning model to predict anomalies without detecting short-lived anomalies or the incremental anomalies.
In yet another aspect, there are provided one or more non-transitory machine-readable information storage mediums comprising one or more instructions, which when executed by one or more hardware processors causes a method for state based entropy computation for anomaly detection to predict machine failure.
The method includes receiving a plurality of sensor readings at regular time stamps, wherein the plurality of sensor readings corresponds to a plurality of features associated with the machine to be monitored for anomaly detection. Further, the method includes predicting a plurality of state probabilities of each time stamp for each of the plurality of features, wherein the plurality of state probabilities are predicted corresponding to each of a plurality of hidden states in a state space identified for each of the plurality of sensor readings. Further, the method includes computing an entropy of each of the plurality of features for each time stamp from the plurality of state probabilities. Further, the method includes computing a mean entropy of each of the plurality of features for an entropy compute interval by aggregating the entropy for each time stamp over the entropy compute interval. Furthermore, the method includes computing the mean entropy for successive entropy compute intervals and simultaneously compute a distance between a current mean entropy and a previous mean entropy for each of the plurality of features over the successive entropy compute intervals, wherein the distance is computed using a distance computation technique. Further, the method includes obtaining a rate of change of the mean entropy based on change in the distance between the current mean entropy and the previous mean entropy of the successive entropy compute intervals. Furthermore, the method includes detect a plurality of anomalies in the plurality of sensor readings, wherein: a short-lived anomaly is recorded if the rate of change of the mean entropy between two consecutive entropy compute intervals is higher than a predefined ratio, wherein the short-lived anomaly captures switching of a value of a feature among the plurality of features from a normal value to an abnormal value without providing prior indications; and an incremental anomaly is recorded if the rate of change of a current mean entropy as compared with aggregated mean entropies in an immediate previous predefined time interval satisfies an incremental anomaly entropy change criterion, wherein the incremental anomaly captures slow deviations in the mean entropy at each entropy compute interval.
Further, the method includes building a first deep learning model to predict the anomalies from real time sensor readings of the machine based on supervised learning using the computed entropy associated with one or more sensor readings that correspond to a complete machine failure, a partial machine failure and a normal condition of the machine. Further, the method includes building a second deep learning model to predict a time to critical of the machine using time durations recorded between the detected anomalies and the complete machine failure as training data. Furthermore, the method includes utilizing a self-learning approach that learns from the computed entropy, predictions of the first deep learning model and predictions of the second deep learning model to predict anomalies without detecting short-lived anomalies or the incremental anomalies.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS
The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate exemplary embodiments and, together with the description, serve to explain the disclosed principles:
FIG. 1 is a functional block diagram of a system for state based entropy computation for anomaly detection to predict machine failure, in accordance with some embodiments of the present disclosure.
FIGS. 2A through 2B (collectively referred as FIG. 2) is a flow diagram illustrating a method for state based entropy computation for anomaly detection to predict machine failure, using the system of FIG. 1, in accordance with some embodiments of the present disclosure.
FIG. 3 is a process overview of the state based entropy computation, in accordance with some embodiments of the present disclosure.
FIG. 4 is an overview of the system of FIG. 1 depicting an example of vehicle engine anomaly detection, in accordance with some embodiments of the present disclosure.
FIG. 5 illustrates a self-learning approach of the system of FIG.1 using the example of the vehicle engine, in accordance with some embodiments of the present disclosure.
It should be appreciated by those skilled in the art that any block diagrams herein represent conceptual views of illustrative systems and devices embodying the principles of the present subject matter. Similarly, it will be appreciated that any flow charts, flow diagrams, and the like represent various processes which may be substantially represented in computer readable medium and so executed by a computer or processor, whether or not such computer or processor is explicitly shown.

DETAILED DESCRIPTION OF EMBODIMENTS
Exemplary embodiments are described with reference to the accompanying drawings. In the figures, the left-most digit(s) of a reference number identifies the figure in which the reference number first appears. Wherever convenient, the same reference numbers are used throughout the drawings to refer to the same or like parts. While examples and features of disclosed principles are described herein, modifications, adaptations, and other implementations are possible without departing from the scope of the disclosed embodiments.
Entropy based anomaly detection in state of the art techniques have limitation while addressing the technical challenge of tapping both sudden and incremental anomalies while also taking into consideration the operational environment changes of a machine that effectively reduces false positives. Embodiments of the present disclosure provide a method and system for state based entropy computation for anomaly detection to predict machine failure. For sensor readings corresponding to each measured parameter that provides machine health status, an optimal number of states are predetermined using historical sensor data of the machine. A state probability is obtained for each sensor reading corresponding to the plurality of hidden states. Further, a mean entropy is computed for each entropy compute interval and then compared with previous computed mean entropies of previous entropy compute intervals to detect short-lived and incremental anomalies. The detected anomalies associated with machine failure are used to build a deep learning model for anomaly prediction. Also, time duration between detected anomaly and actual machine failure is used to generate another deep learning model for predicting time-to-critical or time to machine failure.
Furthermore, the system self-learns to detect anomalies and predict anomalies by application of machine learning.
Referring now to the drawings, and more particularly to FIGS. 1 through 5, where similar reference characters denote corresponding features consistently throughout the figures, there are shown preferred embodiments and these embodiments are described in the context of the following exemplary system and/or method.
FIG. 1 is a functional block diagram of a system 100 for state based entropy computation for anomaly detection to predict machine failure, in accordance with some embodiments of the present disclosure.
In an embodiment, the system 100 includes a processor(s) 104, communication interface device(s), alternatively referred as input/output (I/O) interface(s) 106, and one or more data storage devices or a memory 102 operatively coupled to the processor(s) 104. The system 100 with one or more hardware processors is configured to execute functions of one or more functional blocks of the system 100.
Referring to the components of system 100, in an embodiment, the processor(s) 104, can be one or more hardware processors 104. In an embodiment, the one or more hardware processors 104 can be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, and/or any devices that manipulate signals based on operational instructions. Among other capabilities, the one or more hardware processors 104 are configured to fetch and execute computer-readable instructions stored in the memory 102. In an embodiment, the system 100 can be implemented in a variety of computing systems including laptop computers, notebooks, hand-held devices such as mobile phones, workstations, mainframe computers, servers, and the like.
The I/O interface(s) 106 can include a variety of software and hardware interfaces, for example, a web interface, a graphical user interface to display the generated target images and the like and can facilitate multiple communications within a wide variety of networks N/W and protocol types, including wired networks, for example, LAN, cable, etc., and wireless networks, such as WLAN, cellular and the like. In an embodiment, the I/O interface (s) 106 can include one or more ports for connecting to a number of external devices or to another server or devices.
The memory 102 may include any computer-readable medium known in the art including, for example, volatile memory, such as static random access memory (SRAM) and dynamic random access memory (DRAM), and/or non-volatile memory, such as read only memory (ROM), erasable programmable ROM, flash memories, hard disks, optical disks, and magnetic tapes.
In an embodiment, the memory 102 includes a plurality of modules 110. The plurality of modules 110 include programs or coded instructions that supplement applications or functions performed by the system 100 for executing different steps involved in the process of state based entropy computation for anomaly detection to predict machine failure, being performed by the system 100. The plurality of modules 110, amongst other things, can include routines, programs, objects, components, and data structures, which performs particular tasks or implement particular abstract data types. The plurality of modules 110 may also be used as, signal processor(s), node machine(s), logic circuitries, and/or any other device or component that manipulates signals based on operational instructions. Further, the plurality of modules 110 can be used by hardware, by computer-readable instructions executed by the one or more hardware processors 104, or by a combination thereof. The plurality of modules 110 can include various sub-modules (not shown) for determining optimal states, state probability computation, entropy computation, and mean entropy computation. Further the submodules include a first deep learning model to predict anomalies, a second deep learning model to predict a time to critical of the machine. The plurality of modules 110 may include computer-readable instructions that supplement applications or functions performed by the system 100 for state based entropy computation for anomaly detection to predict machine failure.
Further, the memory 102 may comprise information pertaining to input(s)/output(s) of each step performed by the processor(s) 104 of the system100 and methods of the present disclosure. Further, the memory 102 includes a database 108. The database (or repository) 108 may include a plurality of abstracted piece of code for refinement and data that is processed, received, or generated as a result of the execution of the plurality of modules in the module(s) 110.
Although the data base 108 is shown internal to the system 100, it will be noted that, in alternate embodiments, the database 108 can also be implemented external to the system 100, and communicatively coupled to the system 100. The data contained within such external database may be periodically updated. For example, new data may be added into the database (not shown in FIG. 1) and/or existing data may be modified and/or non-useful data may be deleted from the database. In one example, the data may be stored in an external system, such as a Lightweight Directory Access Protocol (LDAP) directory and a Relational Database Management System (RDBMS). Functions of the components of the system 100 are now explained with reference to steps in flow diagrams in FIG. 2 through FIG. 5.
FIGS. 2A through 2B (collectively referred as FIG. 2) is a flow diagram illustrating a method for state based entropy computation for anomaly detection to predict machine failure, using the system of FIG. 1, in accordance with some embodiments of the present disclosure.
In an embodiment, the system 100 comprises one or more data storage devices or the memory 102 operatively coupled to the processor(s) 104 and is configured to store instructions for execution of steps of the method 200 by the processor(s) or one or more hardware processors 104. The steps of the method 200 of the present disclosure will now be explained with reference to the components or blocks of the system 100 as depicted in FIG. 1 and the steps of flow diagram as depicted in FIG. 2. Although process steps, method steps, techniques or the like may be described in a sequential order, such processes, methods, and techniques may be configured to work in alternate orders. In other words, any sequence or order of steps that may be described does not necessarily indicate a requirement that the steps to be performed in that order. The steps of processes described herein may be performed in any order practical. Further, some steps may be performed simultaneously.
Referring to the steps of the method 200, at step 202 of the method 200, the one or more hardware processors 104 receive a plurality of sensor readings at regular time stamps, wherein the plurality of sensor readings correspond to a plurality of features associated with a machine to be monitored for anomaly detection. The method 200 utilizes an approach that represents each sensor reading as a probabilistic value associated with the plurality of hidden states identified for that feature of the machine or engine associated with the sensor. An optimal number of the plurality of hidden states for each of the plurality of features is predetermined based on historical sensor readings corresponding to each of the plurality of features associated with the machine. The data obtained from recorded sensor reading for a machine of interest is as shown in table 1 below. The data of table 1 is split as training data and test data. The historical data refers to the training data that is processed by applying Silhouette analysis technique known in the art to obtain the optimal number of the plurality of hidden states. Each of the plurality of state probabilities of each sensor reading of each feature corresponding to a time stamp are obtained by applying a Gaussian Mixture Model (GMM) known in the art.
For any machine of interest to be monitored, the system 100 is fed with recorded sensor data of the machine such for a specified duration. Each data element comprises of several parameters or feature variables sensed by each of the plurality of sensors, which contain the values at a time a specific time interval. Therefore, the entire data set is the time sequence of data elements containing every feature value at a specific interval. For example, the following table 1 contains 3 data elements corresponding to a vehicle engine. Each data element represents at an interval contains values for the features sensed by sensors such as T: Temperature sensor, P: Pressure sensor, Fuel sensor, S: Speed sensor.
TABLE 1
Time T P F S
10:10:10 30 45 23 80
10:10:15 31 46 20 60
10:10:20 34 39 21 76

Each time interval represents a unique value as a whole, and each time sequence represents state of the vehicle or vehicle engine at a specific time interval. However, from the state it is difficult understand if the vehicle is operating normally or there are any anomalies as the state is multi-dimensional. Since the vehicle state comprises of all the feature variables at a specific time interval, it is complicated for a human to understand the behavior of the engine. Data represented in the above table 1 is split as test and train data. The test data is used to determine
At step 204 of the method 200, the one or more hardware processors 104 predict a plurality of state probabilities of each time stamp for each of the plurality of features. As mentioned, the plurality of state probabilities is predicted corresponding to each of a plurality of hidden states in a state space identified for each of the plurality of sensor readings as depicted in table 2 below.
At step 206 of the method 200, the one or more hardware processors 104 compute an entropy of each of the plurality of features for each time stamp from the plurality of state probabilities. Table 2 further depicts state probabilities computed for 4 identified hidden states for feature (T). Similar computation is performed for other features to determine state probabilities associated with each of the hidden state among plurality of hidden states identified for each feature P, S, F. The entropy computation for a discrete random variable X with possible outcomes x_1,x_2,….x_n is based on the entropy equation well-known in the art as stated below:
Entropy = E(X)=-?_(i=1)^n¦?P(x?_i )× log?(?P(x?_i)) (1)
where ?P(x?_i) is probability of occurrence of outcome x_i . Thus ?P(x?_i) herein represents state probability of the feature to fall into of each of the hidden states. FIG. 3 illustrates a process overview of the state based entropy computation, in accordance with some embodiments of the present disclosure as explained above.
Once the entropy is computed, then at step 208 of the method 200, the one or more hardware processors 104 compute a mean entropy of each of the plurality of features for an entropy compute interval by aggregating the entropy for each time stamp over the entropy compute interval. Same is depicted in tables 2A, 2B and 2C below. The entropy compute interval is used to aggerate the entropies at a given interval. Instead of considering entropy at each time stamp, the method disclosed utilizes the interval approach. For example, an automobile engine may send sensor data every 5 seconds in such case capturing these data over a network may lead to loss of data and sensor data may not be availed for each and every time stamp. Thus, the method and system disclosed herein takes into consideration the previous and the next sensor data in the interval. Furthermore, as the engine states keep on changing frequently, it is infeasible to consider every case (If a temperature sensor is sending values such as 24,25,23,24,24 in 5-consecutive intervals, the resultant effect is more important than considering every individual value as the temperature is momentarily changed in the above example. Thus, the above technical challenge is resolved by the method by providing an entropy compute interval. Further, based on an end application the entropy compute interval can be preset by a subject matter expert in a look up table and further automatically selected by the system 100 during entropy computation based on the look up table.
At step 210 of the method 200, the one or more hardware processors 104 continue the mean entropy computation for successive entropy compute intervals and simultaneously compute a distance between a current mean entropy and a previous mean entropy for each of the plurality of features over the successive entropy compute intervals. The distance is computed using a distance computation technique such as Euclidean distance. The Euclidean distance is computed if previous mean entropy computation of the sensor reading for a previous entropy compute interval stamp is available, otherwise the current interval is marked this as first entropy compute interval for entropy computation. From sub sequent intervals, the distance is calculated and compared with the previous Computed Euclidean distance or preceding intervals to determine the rate of change of entropy state (mean entropy) as in step 212. If the change is significant i.e., default is 3 times (configurable) the previous state, then the interval is marked as anomaly and the previous one as normal.
TABLE 2A: Sensor data for T,P,F,S
Time T P F S
10:10:10 30 45 23 80
10:10:15 35 46 20 60
10:10:20 40 39 21 76

TABLE 2B: Mean entropy computation for T
Time T Probability of each state Entropy
10:10:10 30 [0.7, 0.1,0.1,0.09] 1.8
10:10:15 35 [0.8,0.1,0.02,0.08] 0.68
10:10:20 40 [0.5,0.3,0.1,0.09] 1.2
10:10:20 mean 1.2

TABLE 2C: Mean entropy state at time for all features 10:10:20
Time Mean Entropy T Mean Entropy
P Mean Entropy
F Mean Entropy
S
10:10:20 1.2 1.096025 1.096915 1.091211

At step 212 of the method 200, the one or more hardware processors 104 obtain rate of change of the mean entropy based on change in the distance between the current mean entropy and the previous mean entropy of the successive entropy compute intervals. At step 214 of the method 200, the one or more hardware processors 104 detect a plurality of anomalies in the plurality of sensor readings by analyzing the rate of change of the mean entropy.
A short lived anomaly is recorded if the rate of change of the mean entropy between two consecutive entropy compute intervals is higher than a predefined ratio, wherein the short lived anomaly captures sudden switching of a value of a feature among the plurality of features from a normal value to an abnormal value without providing prior indications. The short lived anomaly (suddenly going into abnormal state without giving prior indications) is marked if the rate of change of the mean entropy between 2 consecutive entropy compute intervals are high for example if t1, t2 are first 2 entropy compute intervals with entropies 5, 10 respectively, and t3 and t4 are the next consecutive intervals with entropies 15 and 80, then rate of change of entropy |t3-t4| / |t2-t1| = (80-15)/(10-5) = 65/5 = 13 times compared to the previous entropy states
An incremental anomaly is recorded if the rate of change of a current mean entropy as compared with aggregated mean entropies in an immediate previous predefined time interval satisfies an incremental anomaly entropy change criterion. The incremental anomaly captures slow insignificant deviations in the mean entropy at each entropy compute interval. Anomalies are not possible to detect if rate of entropy changes are small in every interval. To detect such anomalies, an example incremental anomaly entropy change criterion states that ‘it is required to check the rate of change of entropy of the current state with the aggregated states before a predefined time interval’ such as in last 15 minutes. For example, if the entropy changes at t1, t2, t3…t15 are 1, 2, 1.5, 1.7….1.9 i.e., assuming sum of all entropy states for last 15 minutes (1 + 2 + 1.5 + 1.7+ ….+10) = 60 (95th percentile), and the current entropy is 1200, then 1200/60 = 20 times more than the entropy for last 15 minutes. If the entropy change is significant then mark the current entropy as anomalies.
Once the anomalies are detected using the statistical method initially, the first deep learning model is built to predict the anomalies from real time sensor readings of the machine using supervised learning approach by training the first deep learning model with the computed entropy associated with one or more sensor readings that correspond to a complete machine failure, a partial machine failure and a normal condition of the machine. Supervised learning algorithms known in the art such as Support-vector machines (SVM), Linear regression and the like can be used.
The machine such as automobile or vehicle engines contains a large number of sensors that exceed 100. In such a scenarios the relationship among data points becomes complex and often non-linear. Using deep learning classification technique, the hidden layers, activation functions, neurons the model can be trained to higher accuracy compared to machine learning techniques.
Further, a second deep learning model is built to predict a time to failure of the machine using time durations recorded between the detected anomalies and the machine failure as training data. The second deep learning model is built based on the known Long Short-Term Memory (LSTM) network model, which is used as a time series forecast for predicting the time to failure.
FIG. 4 is an illustrates overview of the system of FIG. 1 depicting an example vehicle engine anomaly detection in the T,P,F,S sensors data with the data processing is described in table 2A, 2B and 2C, in accordance with some embodiments of the present disclosure.
The method uses sophisticated techniques such as deep learning, self-learning, probabilistic models for improving the accuracy of anomalies detection and failure predictions. This approaches addresses the deficiencies in the earlier approaches as it provides improved decision capabilities in deciding if the anomalies conditions is a real anomaly or merely a temporary state change, and in addition, if the anomalies detected are going to impact the health of the components under monitoring, which is achieved by the self-learning abilities through an execution of series of test scenarios.
The method 200 further utilizes a self-learning approach that learns from the computed entropy and predictions of the first deep learning model and second deep learning model to predict anomalies without deriving short term or incremental anomalies detection. As depicted in FIG. 5, the self-learning model uses both predictions of the first deep learning model and second deep learning model to learn various anomalies patterns and time series forecasting to estimate the anomalies and time series forecasting for the failure computations. The flow connectivity between the computed and predicted outputs of FIG. 4 to be used as inputs for the self-learning model of FIG. 5 are depicted via connectors ‘X’ and ‘Y’.
It can be understood by a person having ordinary skilled in the art that the state based entropy computation for anomaly detection can detect anomalies in any time series data not limited to machine sensor data. The machine herein is an example source that generates time series data from which anomalies are detected. However, source of the time series data can be any identified parameters that are critical for an event of interest, such as weather prediction, prediction from sales data in retail domain and the like. Thus, the method disclosed enables anomaly detection in any time series data collected for any end application. The entropy compute interval thus is predetermined based on frequency of data observation and analysis that is required by the event of interest. For example, weather data anomaly prediction requires a larger compute interval in comparison with engine anomaly detection.
The written description describes the subject matter herein to enable any person skilled in the art to make and use the embodiments. The scope of the subject matter embodiments is defined by the claims and may include other modifications that occur to those skilled in the art. Such other modifications are intended to be within the scope of the claims if they have similar elements that do not differ from the literal language of the claims or if they include equivalent elements with insubstantial differences from the literal language of the claims.
It is to be understood that the scope of the protection is extended to such a program and in addition to a computer-readable means having a message therein; such computer-readable storage means contain program-code means for implementation of one or more steps of the method, when the program runs on a server or mobile device or any suitable programmable device. The hardware device can be any kind of device which can be programmed including e.g., any kind of computer like a server or a personal computer, or the like, or any combination thereof. The device may also include means which could be e.g., hardware means like e.g., an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination of hardware and software means, e.g., an ASIC and an FPGA, or at least one microprocessor and at least one memory with software processing components located therein. Thus, the means can include both hardware means, and software means. The method embodiments described herein could be implemented in hardware and software. The device may also include software means. Alternatively, the embodiments may be implemented on different hardware devices, e.g., using a plurality of CPUs.
The embodiments herein can comprise hardware and software elements. The embodiments that are implemented in software include but are not limited to, firmware, resident software, microcode, etc. The functions performed by various components described herein may be implemented in other components or combinations of other components. For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can comprise, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
The illustrated steps are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope of the disclosed embodiments. Also, the words “comprising,” “having,” “containing,” and “including,” and other similar forms are intended to be equivalent in meaning and be open ended in that an item or items following any one of these words is not meant to be an exhaustive listing of such item or items or meant to be limited to only the listed item or items. It must also be noted that as used herein and in the appended claims, the singular forms “a,” “an,” and “the” include plural references unless the context clearly dictates otherwise.
Furthermore, one or more computer-readable storage media may be utilized in implementing embodiments consistent with the present disclosure. A computer-readable storage medium refers to any type of physical memory on which information or data readable by a processor may be stored. Thus, a computer-readable storage medium may store instructions for execution by one or more processors, including instructions for causing the processor(s) to perform steps or stages consistent with the embodiments described herein. The term “computer-readable medium” should be understood to include tangible items and exclude carrier waves and transient signals, i.e., be non-transitory. Examples include random access memory (RAM), read-only memory (ROM), volatile memory, nonvolatile memory, hard drives, CD ROMs, DVDs, flash drives, disks, and any other known physical storage media.
It is intended that the disclosure and examples be considered as exemplary only, with a true scope of disclosed embodiments being indicated by the following claims.
, Claims:
1. A processor implemented method (200) for predicting machine failures using entropy-based anomaly detection, the method comprising:
receiving (202), via one or more hardware processors, a plurality of sensor readings at regular time stamps, wherein the plurality of sensor readings corresponds to a plurality of features associated with a machine to be monitored for anomaly detection;
predicting (204), via the one or more hardware processors, a plurality of state probabilities of each time stamp for each of the plurality of features, wherein the plurality of state probabilities are predicted corresponding to each of a plurality of hidden states in a state space identified for each of the plurality of sensor readings;;
computing (206), via the one or more hardware processors, an entropy of each of the plurality of features for each time stamp from the plurality of state probabilities;
computing (208), via the one or more hardware processors, a mean entropy of each of the plurality of features for an entropy compute interval by aggregating the entropy for each time stamp over the entropy compute interval;
computing the mean entropy (210), via the one or more hardware processors, for successive entropy compute intervals and simultaneously computing a distance between a current mean entropy and a previous mean entropy for each of the plurality of features over the successive entropy compute intervals, wherein the distance is computed using a distance computation technique;
obtaining (212), via the one or more hardware processors, a rate of change of the mean entropy based on change in the distance between the current mean entropy and the previous mean entropy of the successive entropy compute intervals; and
detecting (214), via the one or more hardware processors, a plurality of anomalies in the plurality of sensor readings, wherein:
a short-lived anomaly is recorded if the rate of change of the mean entropy between two consecutive entropy compute intervals is higher than a predefined ratio, wherein the short-lived anomaly captures switching of a value of a feature among the plurality of features from a normal value to an abnormal value without providing prior indications; and
an incremental anomaly is recorded if the rate of change of a current mean entropy as compared with aggregated mean entropies in an immediate previous predefined time interval satisfies an incremental anomaly entropy change criterion, wherein the incremental anomaly captures slow deviations in the mean entropy at each entropy compute interval.
2. The method as claimed in claim 1, wherein an optimal number of the plurality of hidden states for each of the plurality of features is predetermined based on historical sensor readings corresponding to each of the plurality of features associated with the machine and are obtained by applying Silhouette analysis, and wherein each of the plurality of state probabilities of each time stamp for each of the plurality of features are obtained by applying a Gaussian Mixture Model (GMM).
3. The method as claimed in claim 1, comprising building a first deep learning model to predict the anomalies from real time sensor readings of the machine based on supervised learning using the computed entropy associated with one or more sensor readings that correspond to a complete machine failure, a partial machine failure and a normal condition of the machine.
4. The method as claimed in claim 3, comprising building a second deep learning model to predict a time to critical of the machine using time durations recorded between the detected anomalies and the complete machine failure as training data.
5. The method as claimed in claim 4, comprising utilizing a self-learning approach that learns from the computed entropy, predictions of the first deep learning model and predictions of the second deep learning model to predict anomalies without detecting short-lived anomalies or the incremental anomalies.

6. A system (100) for predicting machine failures using entropy-based anomaly detection, the system (100) comprising:
a memory (102) storing instructions;
one or more Input/Output (I/O) interfaces (106); and
one or more hardware processors (104) coupled to the memory (102) via the one or more I/O interfaces (106), wherein the one or more hardware processors (104) are configured by the instructions to:
receive a plurality of sensor readings at regular time stamps, wherein the plurality of sensor readings corresponds to a plurality of features associated with the machine to be monitored for anomaly detection;
predict a plurality of state probabilities of each time stamp for each of the plurality of features, wherein the plurality of state probabilities are predicted corresponding to each of a plurality of hidden states in a state space identified for each of the plurality of sensor readings;
compute an entropy of each of the plurality of features for each time stamp from the plurality of state probabilities;
compute a mean entropy of each of the plurality of features for an entropy compute interval by aggregating the entropy for each time stamp over the entropy compute interval;
compute the mean entropy for successive entropy compute intervals and simultaneously compute a distance between a current mean entropy and a previous mean entropy for each of the plurality of features over the successive entropy compute intervals, wherein the distance is computed using a distance computation technique;
obtain a rate of change of the mean entropy based on change in the distance between the current mean entropy and the previous mean entropy of the successive entropy compute intervals; and
detect a plurality of anomalies in the plurality of sensor readings, wherein:
a short-lived anomaly is recorded if the rate of change of the mean entropy between two consecutive entropy compute intervals is higher than a predefined ratio, wherein the short-lived anomaly captures switching of a value of a feature among the plurality of features from a normal value to an abnormal value without providing prior indications; and
an incremental anomaly is recorded if the rate of change of a current mean entropy as compared with aggregated mean entropies in an immediate previous predefined time interval satisfies an incremental anomaly entropy change criterion, wherein the incremental anomaly captures slow deviations in the mean entropy at each entropy compute interval.
7. The system as claimed in claim 6, wherein an optimal number of the plurality of hidden states for each of the plurality of features is predetermined based on historical sensor readings corresponding to each of the plurality of features associated with the machine and are obtained by applying Silhouette analysis, and wherein each of the plurality of state probabilities of each time stamp for each of the plurality of features are obtained by applying a Gaussian Mixture Model (GMM).
8. The system as claimed in claim 6, comprising building a first deep learning model to predict the anomalies from real time sensor readings of the machine based on supervised learning using the computed entropy associated with one or more sensor readings that correspond to a complete machine failure, a partial machine failure and a normal condition of the machine.
9. The method as claimed in claim 8, comprising building a second deep learning model to predict a time to critical of the machine using time durations recorded between the detected anomalies and the complete machine failure as training data.
10. The system as claimed in claim 9, comprising utilizing a self-learning approach that learns from the computed entropy, predictions of the first deep learning model and predictions of the second deep learning model to predict anomalies without detecting short-lived anomalies or the incremental anomalies.