Here we recall basic definitions of interest for anomaly detection, and explain three typical anomaly types that occur in hybrid production systems.
Generally speaking, the purpose of the anomaly detection is to find the anomalous (i.e. unlike, unexpected) objects, usually referred to as the outliers, which are caused by the faulty operating conditions. To be able to present types of these objects, we give the following two definitions, that we initially published in [VKBNM11b].
7.2 Anomalies in Hybrid Production Systems 103
Definition 24 (Path Through the Automaton). Let A = (S, s0, Σ, T, ∆, P, x, Θ)
be a hybrid automaton, according to Definition 14. A path PA through the automaton is defined as a sequence of transitions, i.e. P A ⊆ T .
Definition 25 (Observation of a System). An observation of a system is defined as a tuple o = (a, t, u, y), where:
• a ∈ Σ is the symbol that triggers a transition,
• t is a relative time value (relative to the last control signal change),
• u is the vector of values of the continuous input signals, which is used for predict- ing the output value yp,
• y is the observed value of the continuous output signal, which is compared with the predicted output yp.
Anomalies in complex systems can have various causes. It is well-known that every dataset coming from a real-world running entity (such as a component of a process plant) comprises a so-called natural (normal) variability. For example, while most of the measurements of some constant signal under the same normal operating conditions have similar values, sometimes a measurement appears whose value is “far away” from the others. Based on such a measurement, the anomaly detection algorithms could wrongly recognize a faulty condition of a system. This data variability can be created by the imperfections in sensors, measurement noise, external disturbances or a human factor. Anomaly detection algorithms often need to be adjusted to account for this phenomenon. We are however interested in detecting the real anomalies, i.e. those that are caused by the faulty operating conditions appearing in a system during its runtime. These are defined by a statistician D. Hawkins.
Definition 26 (Hawkins’ Definition of an Outlier [Haw80]). An outlier is an ob- servation that differs so much from other observations as to arouse suspicion that it was generated by a different mechanism.
Anomalies in hybrid production systems can originate in both discrete control system, as well as in the continuous physical system. Three common types of anomalies are explained in the following.
Control sequence anomaly: In production facilities, the process is controlled by a control system, which emits discrete control signals such as the signal to open or close a valve. After emitting such control signal, the control system receives the feedback signal within some predefined time interval. This feedback carries the information was the action successfully executed or not. The control sequence anomalyoccurs when the control or feedback signal is wrong. When we look at the automaton model of the system, where each control signal and its feedback is represented as a transition from one state to another, it gets clear that by following the transitions that are triggered in normal operating conditions, one can easily detect the abnormal behavior. Since the probability of triggering a non-existing transition is zero, the appearance of every transition-triggering symbol in any state in which that particular symbol should not occur, signals an anomaly.
This can be illustrated on the example of a heater that heats a raw material in some container. After the temperature reaches the predefined threshold, the following control signal (symbol) should be ‘heater off’. The control sequence anomaly is detected if instead of that symbol, a symbol ‘empty container’ occurs, which
104 7 Anomaly Detection Based on Learned Behavior Models
opens the container and releases the material. Figure 7.2 illustrate this scenario, where the anomaly is represented as a non-existing path through the automaton, i.e. PAautomaton6= PAobserved.
s4 s5 serr heater off empty container s3 heater on
PAautomaton = (...(s3, ´heater on´, s4, δ1), (s4, ´heater off´, s5, δ2), ...)
PAobserved = (...(s3, ´heater on´, s4, δ1), (s4, ´empty container´, serr, δerr))
δ1
δ2
δerr
Fig. 7.2 Example of the control sequence anomaly.
Timing anomaly: Using the automaton behavior model, observed timings of all occurring symbols (changes in discrete control signals) are simply compared with the learned timing constraints (i.e. time intervals δ, see Definition 13). The timing anomalyis detected when the existing symbol is observed before or after the corresponding time interval of the transition it triggers. Based on the existing time delays in the system and the requirements imposed on time (such as real-time requirements), the timing anomaly can be reported to the operator in various ways. When the symbol timing is “very close” to the transition time interval (but still outside of that interval, e.g. less than a second too early or too late), some sort of warning could be signaled. When the symbol timing is however “far away” from the interval, an alarm could be raised to the operator.
An example of such an anomaly is illustrated in Figure 7.3. While being in a state s1, an observation: o = (a, t, u, y) is recorded, where t = 7. Although the symbol
is correct, it can be seen that its timing t 6∈ δ since it occurred two time units too late. Thus, the anomaly is detected. Time units can be expressed as any time instance (e.g. seconds or minutes), depending on the concrete system in question.
s1 s2 ...
a δ=[2,5]
...
o = (a, 7, u, y)
Fig. 7.3 Example of the timing anomaly.
Process variable anomaly: Both aforementioned anomaly types originate in the discrete control system. A very important anomaly type that can occur in the continuous physical system is the process variable anomaly. In every system, it is important to monitor the values of the continuous output variables that depend on the values of the continuous input variables. Typically, all such outputs need to be compared with their reference (predicted) values, which describe their normal behavior. Normally, the thresholds are given for all output variables and when the difference between the observed and the reference value exceeds the corresponding threshold, an anomaly is signaled. The use of learned behavior