fault template extraction from industrial alarm …

FAULT TEMPLATE EXTRACTION FROM INDUSTRIAL ALARM FLOODS

Sylvie Charbonnier, Nabil Bouchair, Philippe Gayet

gipsa -lab

Industrial control systems based on SCADA architecture

SCADA servers

Diagnostic

Variables

PLC

Process

Human-Machine Interface

Alarms

gipsa -lab

Scada server

Alarm floodMore than 10 alarmsduring 10 min (ANSI/ISA-18,2)

Diagnostic may be complex

Human-Machine Interface

Fault

gipsa -lab

To assist the operatorconfronted to an alarm flood

Learn information on the alarm generationprocess (off line)

• Which alarm is relevant?• Which alarms are specific to a given fault?• Is a fault diagnosable from the alarm list?• Is there a specific pattern in the alarm flood ?

Decision support in operation (on line)• Suggest possible faults

Fault template: learnt from a set of alarm lists recorded during the occurrence of the fault

• sequential : The alarm order of appearence isused• vectorialAlarms are weighted according to their relevance to the fault

gipsa -lab

Outline

1. Methods

A. Template extraction

• sequential template

• vectorial template

• weighted sequential template

B. Knowledge extraction and decision support

2. CERN LHC process

3. Results

gipsa -lab

Learning set

f faults

::

::

………

k

………….

::

N = full number of alarms triggered by the control system

gipsa -lab

Sequential fault template

f faults

::

::

………

k

………….

::

of size N

N = full number of alarms triggered by the control system

An alarm list = a symbolic sequence

Sequential fault template : the minimal sequence formed of alarms present in the same order on more than half the lists generated by fault n°q

gipsa -lab

Template extraction using the Needlemanand Wunsch algorithm

Global optimal alignment of 2 symbolic

sequences – Insert gaps to increase similarity

A

The Needleman and Wunschalgorithm (1970)

• Used in bio-informatic to compare sequences of genes

• Use dynamic programming

gipsa -lab

Similarity between 2 sequences

Tuning parameters:

cost of a gap

C ( ) cost of susbtituting one element with

another

� Similarity index:+1 -1

l

−−−−−−

=111

111

111

C

=0

l

ss

SSsim

l

p

ap

ap

aaNWA

∑ σ= =1

21

21),(

),(

),(21 a

pap ssσ

gipsa -lab

Template extraction : multiple alignment

k sequences to align � ascendent hierarchical

clustering Template :<T,G,C,C,G,T>

Appearin more than halfthe lists

gipsa -lab

Outline

1. Method






2. CERN LHC process

3. Results

gipsa -lab

Vectorial alarm list representation

f faults

::

::

………k

………….

Alarm1

Alarm 2

Alarm N

N

::

N

[ ]]k,...,[q]f,...,[i

v....vvTq,i

Nq,iq,i

1 and 1with

V 21qi,

∈∈

=

qi,V is the qth alarm list of fault i

gipsa -lab

)1(*)1*2( ij

ij

ijw βα −−=

Weight wij : relevance of alarm j to fault i compared to

faults contained in Si

With Si : a set of faults excluding fault i ; m=card(Si)

w ij depends on the faults contained in Si

)( ,

1

k

pv ij

qij

k

qij

−∑

= =δ

α m

k

pv

iSh

ij

qhj

k

q

ij

∑

−∑

= ∈

=)( ,

1δ

β

Probability that alarm j is equalto p i

j in the examples of faultscontained in Si

Probability that alarm j is equal to p i

j in the k examples of fault i

0 f 0

0 if 1(x)

≠=

=xi

xδ

<∑

=

≥∑

=

=

=

5.0if 0

5.0 if 1

1q

qi,j

1q

qi,j

kp

kp

k

ij

k

ij

ν

ν

p ij : value of alarm j

for the majority of the k examples of fault i

gipsa -lab

Example : alarm 1

F1 F1 F1 F1 F1 F2 F2 F2 F2 F2 F3 F3 F3 F3 F3

1 0 1 1 0 1 1 1 1 1 0 0 0 0 0

F1 compared with F2 and F3 :

111 =p

5

311 =α

10

511 =β 1.05.0*2.0)

10

51(*)1

5

3*2(1

1 ==−−=ω

F1 compared with F2 :

111 =p

5

311 =α 11

1 =β 0)11(*)15

3*2(1

1 =−−=ω

F2 compared with F3 :

121 =p 12

1 =α 021 =β 1)01(*)11*2(2

1 =−−=ω

gipsa -lab

Outline

1. Method






2. CERN LHC process

3. Results

gipsa -lab

Weighted sequential template : Ti

1 12

112

=−α

β−−α=

)*(

)(*)*(w

ij

ij

ij

ij

gipsa -lab

Outline

1. Method






2. CERN LHC process

3. Results

gipsa -lab

Weigth matrix representation

Fault number

Alarm number

1

2

3

4

5

6

7

8

=

iN

i

i

i

w

w

w

W 2

1

gipsa -lab

1

2

3

4

5

6

7

8

Wi with Si = {1,…,f}\ i

fi

w ij

to1for

)max(

=

Njw ij to1for )max( =

Weigth matrix representation

gipsa -lab

Knowledge extraction : fault diagnosability

Definitions :

- An alarm j is specific to a fault i compared to a subset of faults Si if

- if a fault i has at least one specific alarm, itcan be distinguished from the faults containedin Si , from its vectorial representation

1=ijw

gipsa -lab

Discriminability between pairs of faults (i,k)

=

iN

i

i

i

w

w

w

W 2

1

With Si = {k}1

=iW

j

Alarm j is specific to fault icompared to fault k

Alarm j can distinguishfault i from fault k

For k=1 to f except i,

Calculate using

If fault i can be distinguished from fault k

else it can be confused with fault k :

End

iW Si = {k}1)(max :1 ==

ijNj w

iFk ∈

Fault i is diagnosable from its alarm list{ }=iF

gipsa -lab

Decision support in operation : similarity betweenunknown alarm sequence S and template Ti

Weighted similarity between S and template T i (length : q)

α+−−

−α+−−−α+

=iN

ij

i

w

w

w

C

111

111

111 1

∑ −+

∑ σ=

=

=q

h

ih

ih

l

p

ap

iap

i

qlttC

st

TSWS

1

1

)(),(

),(

),(

−−−−−−

=111

111

111

C=0

l

st

TSsim

l

p

ap

iap

iNWA

∑ σ= =1

),(

),(

=0

Unweighted similarity between S and template T i (length q)

l

),( ap

iap stσ

Alarms present in Ti number of gaps added

gipsa -lab

Decision support in operation : information display

similarity between S and fault templates

gipsa -lab

Outline

1. Method






2. CERN LHC process

3. Results

gipsa -lab

Large Hadron Collider in CERN

large ring of 27 km 100 meters underneath

Collision of 2 beams of protons accelerated at the light speed

� Discovery of

new particules

gipsa -lab

Large Hadron Collider systems

LHC :

• the biggest particle accelerator in the world

• formed of many different systems

• all controlled using the same SCADA

architecture

The gas system : supply the detection chambers with a precisemixture of pure gases

gipsa -lab

CERN LHC process : the gaz system

CHAMBRES

MIXER

PURIFIER

PUMP

BUFFER EXHAUST

AIR MIX

gipsa -lab

Accurate simulator of the gas system

C++

Supervision layer

Control layer

Field layer

Server Scada

PLC

IHM � Linked to the real control system

� Faults can be created

Model

� Algebro-differentialequations

� 9195 equations

� Validated fromcomparison with the real system

28

gipsa -lab

f= 13 faults generated

CHAMBERS

MIXER

PURIFIER

PUMP

BUFFER EXHAUST

AIR MIX

5

2

2

3

1

k=6 alarm lists per faultN=160 alarms(triggered at least once)

• Leaks• blockage of controllers• stoppage of pumps• broken bubblers (safety device) • sensor problems leading to

regulation issues

65/78 Alarm Floods(>10 alarms in 10 min)

gipsa -lab

Outline

1. Method






2. CERN LHC process

3. Results

gipsa -lab

Alarm lists length – Template length

0.5 0.8 0.6 0.8 1 1 1 1 1 0.5 1 0.6 0.8Percentage of alarm floods

Fault number

Num

berof alarm

rs

gipsa -lab

Similarity between sequential fault template : unweighted similarity

19 18 19 19 63 62 66 59 115 16 58 18 26

Alarm list averaged length

l

−−−−−−

=111

111

111

C

gipsa -lab

iSw ij except faults 13 with i =

• 17% of alarms are irrelevant

• Faults 4 and 9 can be diagnosed

31 to1for )max( =iw ij

601 to1for =j)wmax( ij

Weigth analysis

gipsa -lab

Weighted sequential fault template

Fault 4

Fault 9

gipsa -lab

Fault diagnosability (vectorial template)

1)(max :1 ==ijNj w

{ }ki

S =where

If

� fault i can be distinguished from fault k

undistinguishable

distinguishable

Faults 3, 4, 9, 10, 12, 13 are diagnosable from their alarm vectorsConfusion : {1,2}, {5,6,7} , {8,11}

gipsa -lab

Fault 1/ Fault 2 { }kiSijw = with

gipsa -lab

Fault 8/ Fault 11

gipsa -lab

Fault 5/ Fault 6

Leak in Mixer/ leak in Exhaust� Lack of instrumentation

gipsa -lab

Similarity between sequential fault templates : weighted similarity

{ }liSijw = with

α+−−

−α+−−−α+

=iN

ij

i

w

w

w

C

111

111

111 1

∑ −+

∑ σ=

=

=q

h

ih

ih

l

p

ap

iap

i

qlssC

ss

SSWS

1

1

)(),(

),(

),(

α=10

gipsa -lab

Fault templates for i =1 to 13


1 )1*2(

)1(*)1*2(

=−α

β−−α=i

j

ij

ij

ijw

gipsa -lab

Decision support in operation � diagnose unknownsequence S

The most similar fault: 10

Fault with a similarity higherthan 0.3 :

1, 10, 12

Weighted similarity between S, and Ti


∑ −+

∑ σ=

=

=q

h

ih

ih

l

p

ap

iap

i

qlttC

st

TSWS

1

1

)(),(

),(

),(

For i=1 to 13

gipsa -lab

Fault 10

Fault 12

Fault 1

gipsa -lab

Classification accuracy using the first nearest neighboor

For each of the 78 sequences

Classification : Assign unknown sequence S to the fault

whose template is the most similar (weighted similarity)

Validation : leave one out

- remove S from the data set

- extract fault templates Ti without S

Results :

Vectorial representation ; Hamming distance : 54/78

Sequential representation ; weighted similarity :

Full template, full alarm sequence : 75/78

gipsa -lab

Impact of the template length

TmaxTmaxTmaxTmax

gipsa -lab

Impact of the template length on the classification accuracy

Tmax

� The templates can be shorten to 35 alarms.

gipsa -lab

Impact of sequence length

When make the decision? Is it necessary to wait for the end of the

alarm flood ?

S is reduced to its L first alarms � the decision is made after L alarms

at the latest

L=30

gipsa -lab

Impact of sequence length

Fault number

Num

berof alarm

rs

gipsa -lab

Conclusion• Off line : A strategy to learn information from a fault data

set � valuable feed-back information on the alarm

generation process

• Irrelevant alarms

• Fault diagnosability from its alarm list

� Lack of instrumentation

• Typical fault pattern : guideline for non expert operators

• On line : A strategy to diagnose a fault on the occurrence

of an alarm flood, based on similarity

� No model required but a need for data

� Both the presence and the absence of alarms are

considered

fault template extraction from industrial alarm …

Documents